AI Readiness Checklist: Is Your Business Ready for AI?
A scored AI readiness checklist covering strategy, data, processes, people and governance, so you can spot gaps before you invest in AI tools.
Your business is ready for AI when you have a clear problem to solve, reasonably clean and accessible data, documented processes, people with time and basic skills to use the tools, and simple governance rules for data, review and risk. Score yourself on these 5 areas below; fix any area that scores low before spending heavily on AI.
Photo: Unsplash
On this page
Plenty of AI projects stall for reasons that have nothing to do with the AI. The data lives in 6 spreadsheets nobody trusts. The process the AI is supposed to speed up is not written down. Nobody has time to learn the tool. Or someone pastes customer records into a public chatbot and the project gets shut down.
An AI readiness check catches those problems before you spend money. This guide gives you a scored checklist across 5 areas: strategy, data, processes, people and governance. It takes about 30 minutes with your leadership team, and the result tells you whether to start now, start small or fix the foundations first.
What AI readiness actually means
AI readiness is your organization’s ability to adopt AI tools in a way that delivers value safely. It is not about owning the latest technology. A 10-person firm with clean records, clear processes and a simple AI policy is often more ready than a large company with messy data and no ownership.
Readiness also depends on the kind of AI you plan to use:
- Off-the-shelf assistants (AI built into email, documents and spreadsheets) need mostly people and governance readiness.
- AI inside business systems (help desk, CRM, accounting) needs good data in those systems.
- Custom AI built on your own data needs strong data, technical and governance readiness.
Be clear which one you are scoring for.
How to score this checklist
Score each item:
- 0 = not in place
- 1 = partly in place or informal
- 2 = in place and working
There are 20 items across 5 areas, for a maximum of 40 points. Score honestly; the point is to find gaps, not to pass a test. Have 2 or 3 people score independently, then compare. Disagreements are useful signals.
Area 1: Strategy and use cases
| # | Checklist item | Score (0-2) |
|---|---|---|
| 1 | We have named 1 to 3 specific problems AI should help with (not “use AI more”) | |
| 2 | Each use case has a measurable goal, such as hours saved, response time or error rate | |
| 3 | A leader owns AI adoption and has budget authority | |
| 4 | We have estimated costs beyond licenses: usage, integration, data work and training |
If you score low here, stop and pick use cases first. Good starting points are repetitive, text-heavy tasks: drafting replies, summarizing documents, preparing reports. Our guide on AI implementation cost helps with item 4.
Area 2: Data
| # | Checklist item | Score (0-2) |
|---|---|---|
| 5 | The data each use case needs is identified and lives in known systems | |
| 6 | That data is reasonably accurate, current and free of major duplicates | |
| 7 | File and system permissions reflect who should see what, with no broad oversharing | |
| 8 | We know which data is sensitive (customer, health, financial, employee) and where it is |
Item 7 is the one most businesses miss. AI assistants that work across your files can surface anything a user has permission to open. If sensitive folders are shared with “everyone,” AI makes that problem visible quickly. Clean up permissions before rollout. The same least-privilege thinking behind zero trust security applies here.
Key takeaway: Data and permissions are the most common reasons AI projects disappoint or get paused. If you score below 5 out of 8 on data, fix that before buying more tools.
Area 3: Processes
| # | Checklist item | Score (0-2) |
|---|---|---|
| 9 | The processes AI will support are documented, even as a simple checklist | |
| 10 | We know who reviews and approves AI outputs at each step | |
| 11 | We have a baseline measurement (time, cost or quality) to compare against | |
| 12 | There is a clear path for exceptions the AI cannot handle |
AI speeds up a working process. It does not fix a broken one. If 3 staff members do the same task 3 different ways, standardize first, then automate.
Area 4: People and skills
| # | Checklist item | Score (0-2) |
|---|---|---|
| 13 | Staff have time set aside to learn and try AI tools | |
| 14 | At least 1 person per team can act as an AI champion | |
| 15 | People know how to check AI output for errors before using it | |
| 16 | We have discussed openly how AI will change roles, and staff concerns have been heard |
Skills here do not mean data science. They mean writing clear instructions, checking facts and knowing when not to trust an answer. Our guide on how to use AI at work covers practical review habits to train on.
Area 5: Governance, security and compliance
| # | Checklist item | Score (0-2) |
|---|---|---|
| 17 | We have a written AI use policy: approved tools, allowed data and review rules | |
| 18 | We review AI vendors for data use, retention, training opt-out and security | |
| 19 | We know which laws apply to our AI uses, such as hiring, customer chat or privacy | |
| 20 | Someone monitors AI use and can pause a tool if something goes wrong |
You do not need a heavy framework to start, but established frameworks help structure your thinking:
- The NIST AI Risk Management Framework (AI RMF 1.0), released January 26, 2023, is voluntary guidance built around 4 functions: govern, map, measure and manage. NIST notes a revision is in progress.
- NIST AI 600-1, the Generative AI Profile published July 26, 2024, applies the framework to generative AI risks.
- ISO/IEC 42001:2023, published in December 2023, is a certifiable standard for an AI management system, more relevant to larger organizations or vendors.
For item 19, check our roundup of state AI laws, since rules differ by state and by use case. This is not legal advice.
Reading your score
Add your totals from all 5 areas.
| Total score | What it means | What to do |
|---|---|---|
| 32 to 40 | Ready | Launch your top use case with a pilot group and measure results |
| 22 to 31 | Ready to start small | Pilot low-risk use cases while fixing your lowest-scoring area |
| 12 to 21 | Foundations needed | Focus on data, process documentation and an AI policy first |
| 0 to 11 | Not ready | Pick 1 use case and build the basics around it before buying tools |
Also look at each area on its own. A high total with a 0 in governance still means risk. Any area scoring 3 or less out of 8 is a priority, no matter the total.
Where to start: closing your gaps in 30 days
- Week 1: Pick 1 use case and define its goal and owner (items 1 to 3).
- Week 1: Write a 1-page AI use policy listing approved tools, data that must never be entered and who reviews outputs (item 17).
- Week 2: Audit data and permissions for that use case. Remove broad sharing on sensitive folders (items 5 to 8).
- Week 2: Document the process and measure how long it takes today (items 9 and 11).
- Week 3: Train a pilot group of 5 to 10 people on the tool and on checking outputs (items 13 to 15).
- Week 4: Launch the pilot, track results against your baseline and rescore the checklist.
For more starting ideas, see our guide to generative AI for small business.
The bottom line
AI readiness is less about technology and more about clarity: a clear problem, clean and well-permissioned data, documented processes, prepared people and simple rules. Score yourself honestly, fix the weakest area first and start with a small pilot. You will spend less and get better results than businesses that buy tools first and figure out the rest later.
Sources
- AI Risk Management Framework (NIST) — AI RMF 1.0, its 4 core functions and revision status
- NIST AI 100-1, Artificial Intelligence Risk Management Framework (NIST) — framework text and January 2023 release
- NIST AI 600-1, Generative AI Profile (NIST) — generative AI risks and actions, July 2024
- ISO/IEC 42001:2023, AI management systems (ISO) — AI management system standard published December 2023
Frequently asked questions
What is AI readiness?
AI readiness is how prepared your business is to adopt AI and get value from it safely. It covers 5 areas: clear use cases and goals, usable and well-permissioned data, documented processes, people with time and skills to use the tools, and governance rules for data, review and risk. A business can be small and still highly ready if these basics are in place.
How do I know if my business is ready for AI?
Score yourself on a checklist covering strategy, data, processes, people and governance. If you have specific problems to solve, reasonably clean data, documented workflows and a basic AI use policy, you are ready to pilot. If data is scattered, permissions are loose or nobody owns the project, fix those first. Any area scoring very low is a priority regardless of your total.
What is the first step in preparing for AI?
Pick 1 specific problem with a measurable goal, such as cutting time spent drafting customer replies. Then name an owner, write a short AI use policy and check that the data the use case needs is accurate and properly permissioned. Starting with a single, well-defined use case keeps costs low and gives you real results to build on.
Do small businesses need an AI policy?
Yes, even a 1-page policy helps. It should list approved AI tools, data staff must never enter (such as customer financial or health details), who reviews AI outputs before they are used and who to contact with concerns. A policy prevents the most common problems, like sensitive data pasted into unapproved tools, and makes it easier to adopt AI with confidence.
What data do I need before using AI?
It depends on the use case. Off-the-shelf assistants for writing and summarizing need little preparation beyond good file permissions. AI that answers customer questions needs accurate, current help content and policies. Custom AI needs organized data in known systems, free of major duplicates and errors. In every case, know where sensitive data lives and who can access it.
What framework should I use for AI governance?
Many US organizations use the NIST AI Risk Management Framework, a free, voluntary framework built around 4 functions: govern, map, measure and manage. NIST also publishes a Generative AI Profile (NIST AI 600-1). Larger organizations and AI vendors may pursue ISO/IEC 42001 certification. Small businesses can start with a simple AI policy and vendor review process.
How long does it take to become AI ready?
Most small and midsize businesses can close basic gaps for a first use case in about 30 days: choose the use case, write a policy, clean up data permissions, document the process and train a pilot group. Broader readiness across the whole organization takes longer and improves as you learn from each pilot.
Was this guide useful
No reviews yet. Share your experience and help other readers.
Write a review
Manishdai
Manishdai writes about the technology that is reshaping every industry — from AI agents and cloud platforms to healthtech, fintech and the IT companies building it all across the United States.
manishdai.com