What is an AI readiness assessment?
An AI readiness assessment checks whether a business can run AI safely and usefully today: a clear use case, usable data, connected tools, a named owner, known rules and a way to measure results. It shows what to fix before a build.
US business AI use, Census BTOS
There are two levels to it. One asks which process should get AI first; our AI consulting page covers that with a five-factor score for each process. This checklist is the other level: whether the company around those processes is ready to run any AI system at all. A business can have a perfect first process and still fail because the data sits in inboxes, nobody owns the result, or nobody checked the rules.
Most businesses have not started yet. The U.S. Census Bureau's Business Trends and Outlook Survey put AI use at 19.8% of US businesses as of May 3, 2026, with 37% of firms with at least 250 employees using it and fewer than 20% of firms with four or fewer employees (Census Bureau, May 26, 2026, read October 30, 2026). Our AI agent adoption statistics collect more of these figures with their sources.
What should an AI readiness checklist include?
Six areas: the use case and its baseline numbers, data quality and access, tools and accounts, people and ownership, risk and compliance, and how results will be measured and run. Each area needs evidence you can show, not a gut feeling.
The six areas of the checklist
The 30 checks below are ours. To keep them grounded, we mapped each one to a category of the NIST AI Risk Management Framework core (Govern, Map, Measure, Manage, read October 30, 2026), and the compliance checks to the EU AI Act article they come from. NIST describes the framework as voluntary; the mapping helps if a larger customer or your board asks which standard you followed. Answer each check yes or no, and only say yes if you can point to the evidence in the third column.
1. Use case and baseline
| # | Check | Evidence to have on hand | NIST AI RMF |
|---|---|---|---|
| 1 | One named process is the first target, with a monthly volume you can count | "About 600 inquiries a month" from the CRM or phone log | MAP 1 (context) |
| 2 | Success is written down as a number | "Reply to every lead within 5 minutes, day or night" | MAP 3 (benefits and costs) |
| 3 | Today's baseline is measured | Current response time, minutes per task, error rate | MEASURE 1 (metrics) |
| 4 | The cost of a wrong output is known | "A wrong quote costs a refund; a wrong booking costs a call" | MAP 3, MAP 5 (impacts) |
| 5 | There is a budget for tools as well as the build | Monthly figure for model usage, seats and numbers | MAP 3 |
2. Data
| # | Check | Evidence to have on hand | NIST AI RMF |
|---|---|---|---|
| 6 | The data for the process sits in a system with an API or export | CRM, helpdesk, accounting tool, not paper or personal inboxes | MAP 4 (components and third parties) |
| 7 | A spot check of recent records passed (method below) | Share of records missing the fields the AI needs | MEASURE 1 |
| 8 | There is one source of truth for each record type | Contacts live in one place; duplicates are merged | MAP 4 |
| 9 | Written rules or past examples exist for the task | 20 to 50 past cases with the right answer | MAP 1 |
| 10 | You know which data is personal or regulated | A list: health, card, children's or employee data | MAP 5, GOVERN 1 (policies) |
3. Tools and accounts
| # | Check | Evidence to have on hand | NIST AI RMF |
|---|---|---|---|
| 11 | Every tool you pay for is listed with who holds the login | A one-page tool list | GOVERN 6 (third-party risk) |
| 12 | Accounts and API keys are in the company's name | Billing and admin email on a company address | GOVERN 6 |
| 13 | Each AI vendor's data terms have been read | Whether inputs train models; how long logs are kept | GOVERN 6, MANAGE 3 (third parties) |
| 14 | The output will land where staff already work | The CRM record, shared inbox or team chat | MAP 1 |
| 15 | Failures can raise an alert to a person | Error workflow or monitoring in the automation tool | MANAGE 4 (response and recovery) |
4. People and ownership
| # | Check | Evidence to have on hand | NIST AI RMF |
|---|---|---|---|
| 16 | One named person owns the result | A name, not a department | GOVERN 2 (accountability) |
| 17 | The people who do the task today helped define it | Their list of exceptions and awkward cases | GOVERN 5 (engagement) |
| 18 | Staff who run the system get short written guidance | What it does, what it must not do, who to call (EU AI Act Article 4) | GOVERN 2 |
| 19 | Someone has authority to pause it | Named, with access to the off switch | GOVERN 2, MANAGE 4 |
| 20 | There is a handover rule to a person | When the agent or workflow passes to staff, and how | MANAGE 2 (benefits and impacts) |
5. Risk and compliance
| # | Check | Evidence to have on hand | NIST AI RMF |
|---|---|---|---|
| 21 | You know whether the output reaches people in the EU | Yes or no per system (EU AI Act Article 2) | MAP 1 |
| 22 | No use falls in a high-risk area, or you know it does | Checked against Annex III: hiring, credit, insurance pricing, education | MAP 2 (categorization) |
| 23 | Chat and voice agents say they are AI | The opening line, written down (EU AI Act Article 50) | GOVERN 1 |
| 24 | Sector rules are listed | HIPAA for health data, US calling and texting rules for phone work | GOVERN 1 |
| 25 | Public claims about your AI are accurate | Website and sales copy say only what the system does | GOVERN 1 |
6. Measurement and running
| # | Check | Evidence to have on hand | NIST AI RMF |
|---|---|---|---|
| 26 | A test set of real past cases exists, including awkward ones | The examples from check 9 plus edge cases from check 17 | MEASURE 1 |
| 27 | Someone reviews a sample of outputs every week at first | A calendar slot and a simple log | MEASURE 3 (tracking over time) |
| 28 | Spending caps and usage alerts are set | Limits in the model provider and automation tool | MANAGE 1 (prioritised response) |
| 29 | Runs are logged and kept | Execution history; at least six months if you deploy a high-risk system (Article 26) | MEASURE 3 |
| 30 | There is a way back if it goes wrong | The old process still works; you know how to switch off | MANAGE 4 |
For checks 21 to 23, our FAQ on whether the EU AI Act applies to US companies explains the scope test, roles and dates. For check 24, see our guides to HIPAA-compliant automation and the rules for AI phone calls. Check 25 matters in the US as well: when the FTC announced five actions over deceptive AI claims on September 25, 2024, its Chair said "there is no AI exemption from the laws on the books" (FTC).
How do you score an AI readiness assessment?
Give one point per check you can prove, so each area scores 0 to 5 and the total is out of 30. Look at the weakest area before the total: any area at 2 or below is the first thing to fix.
Scores in the worked example
This is our working method, not an industry standard. How we read the result:
| Result | What it means | What to do next |
|---|---|---|
| 25 to 30, no area below 3 | Ready to build | Pick the first process and get a fixed build price |
| 18 to 24, no area below 3 | Ready for a narrow first build | Build one process with a person reviewing outputs; close the gaps in parallel |
| Any area at 2 or below | That area will sink the project | Make the weak area the first project, usually data clean-up or naming an owner |
| Under 18 | Not ready yet | Fix data, ownership and baseline numbers before paying for AI |
Worked example: a 40-person home services company (illustrative)
This company is invented to show the scoring. It wants an AI agent to answer and book inbound leads.
| Area | Score | Why |
|---|---|---|
| Use case and baseline | 4 / 5 | Clear target and volume; no budget set for tool usage |
| Data | 2 / 5 | Leads split between a CRM and two personal inboxes; duplicates common |
| Tools and accounts | 4 / 5 | Tools listed, but the phone account is in a former manager's name |
| People and ownership | 3 / 5 | Owner named; no written guidance or handover rule yet |
| Risk and compliance | 4 / 5 | No EU customers, no high-risk use; AI disclosure line not written |
| Measurement and running | 1 / 5 | No test set, no logs, no spending caps |
| Total | 18 / 30 | Two areas at 2 or below |
The total says "narrow first build", but two areas are at 2 or below, so the plan starts with them: move all leads into the CRM and merge duplicates, then set up logging, caps and a test set of 30 past leads. The agent build comes after. Once it is live, our automation ROI calculator turns the baseline from check 3 into a monthly saving you can track.
How do you check if your data is ready for AI?
Pull 50 recent records for the process and count three things: records missing a field the AI needs, duplicates, and records that live outside the main system. The shares tell you whether to build now or fix the data first.
Fifty is enough to see a pattern without a data team. The thresholds below are our working rules of thumb, not published standards.
- Pick the fields the AI will use. For a lead agent: name, phone or email, service wanted, location.
- Export the last 50 records from the main system.
- Count gaps. Example: 11 of 50 have no phone number. 11 / 50 = 22% missing.
- Count duplicates. Example: 6 of 50 are the same person entered twice. 6 / 50 = 12%.
- Count outside records. Ask staff how many of last week's leads never reached the system. Example: 8 of 40 = 20%.
| Share of records | Our reading | Fix |
|---|---|---|
| Under 10% missing, duplicate or outside | Usable | Build, and let the workflow flag the gaps it meets |
| 10% to 20% | Usable with a clean-up step | Add required fields to forms; merge duplicates before launch |
| Over 20% | Fix first | Route every channel into one system and fix capture before adding AI |
In the example, missing phones (22%) and outside records (20%) are the problems. Neither needs AI to fix: a required field on the web form and a rule that sends every inbox lead into the CRM do it. That clean-up is often the first build in a roadmap, and it is the kind of work our AI workflow automation and CRM automation teams do before any agent goes live.
Which rules should an AI readiness assessment cover?
At least four: the EU AI Act if any output reaches the EU, the extra duties for high-risk uses such as hiring and credit, your sector rules such as HIPAA or calling laws, and US consumer protection law on what you claim AI does.
The EU duties most US businesses meet first are AI disclosure for chat and voice agents (Article 50) and staff AI literacy (Article 4). If you deploy a high-risk system, Article 26 adds concrete duties that belong in the checklist, read October 30, 2026:
| Article 26 duty | Checklist item it maps to |
|---|---|
| Use the system according to the provider's instructions for use (26(1)) | Check 18: written guidance for staff |
| Human oversight by people with "the necessary competence, training and authority" (26(2)) | Checks 16 and 19: named owner with authority to pause |
| Input data you control is relevant and sufficiently representative (26(4)) | Checks 7 and 8: data spot check, one source of truth |
| Monitor operation; suspend and report if it may present a risk (26(5)) | Checks 15, 27 and 30: alerts, weekly review, way back |
| Keep automatically generated logs for at least six months (26(6)) | Check 29: logs kept |
| Inform workers' representatives and affected workers before workplace use (26(7)) | Check 17: involve the people who do the task |
The EU high-risk rules for Annex III uses apply from December 2, 2027, according to the European Commission's AI Act page. Most business agents are not high-risk, but a readiness check is the cheapest point to find out. This guide is not legal advice.
What do you do after an AI readiness assessment?
Fix the weakest area first, then score candidate processes to pick the first build, then build one process with review and logging. Re-run the checklist after launch, because ownership and data drift as teams change.
- Close the blocking gaps. Usually data capture, account ownership or a missing owner. Our page on who owns the automations and data covers the account side.
- Choose the first process. Use the per-process score on our AI consulting page: volume, rule clarity, data access, error cost and compliance.
- Price the tools as well as the build. Our list of software costs on top of a build shows what to budget.
- Build narrow, then widen. One process, a person reviewing outputs, logs from day one.
- Re-run the 30 checks three months after launch.
If you want a second pair of eyes, our strategy call and first audit are free and cover this checklist; see what happens on the call.
More questions about AI readiness assessments
What questions are in an AI readiness questionnaire?
The useful ones ask for evidence: which process, how many a month, what success looks like as a number, where the data lives, how many records are incomplete, who owns the result, who can pause it, whether output reaches the EU, and how you will test it. Questions about enthusiasm or "AI culture" tell you little about whether a build will work.
What is the difference between AI readiness and AI maturity?
Readiness asks whether you can run a specific AI system now. Maturity describes how far a company has come over years, from first pilots to AI across many teams. A small business can be ready for one well-scoped agent long before it is "mature", and a large company with many pilots can still fail a readiness check on data or ownership.
Do small businesses need an AI readiness assessment?
A short one, yes. A small business can run these 30 checks in an afternoon, and the data spot check alone often saves the cost of a failed build. The Census survey found fewer than 20% of firms with four or fewer employees used AI as of May 2026, so most small firms are starting from zero and benefit from checking first.
Who should run the assessment inside a company?
The person who will own the result, with the people who do the task today. The owner answers the ownership and budget checks; the staff answer the data and exceptions checks, because they know where records really live. Bring in IT or an outside team for the accounts, logging and vendor terms checks.
How often should you repeat an AI readiness assessment?
Before each new AI build, and about three months after a launch. Data quality, tool accounts and ownership change as staff come and go, and a system that was safe at launch can drift. A quick re-run of the 30 checks catches a lapsed owner or a broken alert before customers notice.
Is there an AI readiness assessment template we can use?
The six tables on this page are a working template: copy the checks into a spreadsheet, add a yes or no column and an evidence column, and sum each area. Keep the NIST column if you need to show a customer or board which framework the review followed. The NIST AI RMF itself is free to read.
Does passing the checklist mean we comply with the EU AI Act?
No. The checklist flags where the Act may apply and which duties to look at, such as AI disclosure, staff literacy and the Article 26 duties for high-risk systems. Whether a specific system complies depends on its role, its use and the full legal text, which is a question for a lawyer.
Sources and further reading
- U.S. Census Bureau, Large Firms With at Least 20 Employees Biggest AI Users (May 26, 2026; read October 30, 2026)
- NIST AI Resource Center, AI RMF Core: Govern, Map, Measure, Manage
- AI Act Service Desk, Article 26: deployer obligations for high-risk systems
- AI Act Service Desk, Article 4: AI literacy
- AI Act Service Desk, Article 50: transparency obligations
- European Commission, AI Act regulatory framework and timeline
- FTC, Operation AI Comply press release, September 25, 2024
