I am running a short study at the 2026 ISACA Rwanda Chapter Annual Conference on 5 and 6 October, and if you were handed a card with a code on it, this is what it points to.
Take part
The study is open until 30 October 2026. It is the same five questions as at the conference, and you choose how to answer them.
Either way, you get your own one-page snapshot by 6 November. If the buttons do not open your email, write to study@governancemeridian.com.
Here is the whole thing. Five questions, about five minutes, standing up, no laptop. I spoke to the first group across the two days of the conference, and the study now continues by call and email. The questions are about where AI has already turned up in your organisation, who would answer for it if the board asked today, and how long it would take you to show a regulator how one decision about someone's personal data was made. None of them are trick questions and none of them are a test. Most of the honest answers are gaps, which is the point, because a study where everybody says they are fine tells nobody anything.
You get your own snapshot back: within a week if you spoke to me at the conference, and by 6 November if you take part after it. One page. Your five answers written back to you in plain words, where each one sits against the anonymised group, and three things I noticed reading them. No score, no maturity level, no proposal attached. When the full findings are written up, you get those too.
Your answers are anonymous and aggregated by default. Nothing is attributed to you or your organisation unless you tell me separately that I may quote you by name, and if you do, I will come back and confirm the exact wording before anything is published. Answers from conversations and calls live on one device, never in the cloud, and come off it at the end of each day. Written answers arrive by email and are deleted from the mailbox once I have copied them over. If you change your mind at any point, email study@governancemeridian.com and I will delete your response.
The full privacy notice is at governancemeridian.com/privacy.
I moved to Kigali from Denver in August, so I am asking rather than telling. That is the honest reason this is a study and not a point of view. I have spent twenty years running enterprise programmes, the last six of them in security, and the method here is not new to me even though the market is. What I do not have yet is a picture of what is actually true across the region, and neither does anyone else. Thirty conversations is a start on one.
If you would like the findings when they are written, leave your email below. That is the only thing this page asks of you.