An assessment is bought as a number of days and remembered as a document. The days end. The document is what you still have twelve months later, when the person who commissioned it has moved on and somebody asks why a particular sequence of work was chosen.
So it is worth being specific, before the work starts, about what changes hands at the end: what the deliverable set is, who owns it, what you may do with it, and what has to be true before you accept it. None of that is difficult to agree. It is simply easier to agree beforehand than afterwards.
What changes hands at the end
The engagement produces a set of documents rather than a single one. Treating it as a set matters, because the pieces are used by different people at different times, and a set delivered as one undifferentiated slide deck tends to be read once and filed.
A complete set contains a findings report, a scored profile against each dimension assessed, the evidence the findings rest on, a prioritised sequence of work, and a register of the risks and assumptions that sequence depends on. Building an AI technology roadmap covers what belongs inside that sequence in detail, including dependency mapping, phasing and budgeting. This page is about the set as an object you own.
What the artifact contains
The findings report states what was examined, what was found, and what was not examined. That last part is the one most often left out and the one most often needed later. An assessment reaches as far as the access and the time allowed, and a report that says so is more useful than one that implies completeness it did not have.
The scored profile places the organization against each dimension. LABUSA assesses seven, described in the AI readiness framework. A score is a way of comparing the same organization with itself over time, which is its real value. It is not a measurement of a physical quantity and should not be presented as one, a caution set out on the methodology page.
The evidence appendix is what separates an assessment from an opinion. It records who was interviewed and in what role, which systems and documents were examined, what was sampled and how, and the date each observation was made. When a finding is challenged eighteen months later, the appendix is the answer. When it is absent, the finding rests entirely on the reputation of whoever wrote it.
The risk and assumption register carries the things the recommendations depend on but do not control: a contract renewal date, a post that is vacant, a system due for replacement, a budget cycle. Each should carry the date it was recorded, because an assumption with no date cannot be reviewed.
The prioritised sequence is the part usually called the roadmap. What belongs in it, how to phase it and how to keep it alive is covered at length in the roadmap article linked above.
How it is produced
The work runs in checkpoints rather than arriving whole at the end, and the checkpoints are worth naming in the order form: an agreed outline, a draft for comment, and a final version. An outline reviewed early is the cheapest moment to discover that the assessment is answering a slightly different question from the one the organization is asking.
Production is not one sided. The organization owes access to named people for a stated amount of time, access to the systems and records agreed, and decisions by the dates the schedule depends on. Where those slip the assessment does not fail, but its evidence thins, and a good supplier will say so in the report rather than quietly write around it.
The supplier owes the checkpoints on the dates agreed, a stated method, and a record of what it could not reach. The framework LABUSA works to is described on the methodology behind our readiness work, and its structure follows the accountability principles published by the U.S. Government Accountability Office, which organize oversight of an AI programme around governance, data, performance and monitoring.
One further habit is worth adopting from the same body of work. In April 2026 GAO reported that agencies acquiring AI were not consistently collecting and applying lessons learned, and that some had difficulty understanding what their AI efforts cost. An assessment is a cheap place to start that record, because it is already producing written evidence about the organization's own conditions.
How it is used afterwards
Four uses account for almost all of the value, and each suggests something about how the set should be written.
It becomes the specification for the next purchase. Requirements written from an assessment are more precise than requirements written from a vendor conversation, because they start from what the organization has rather than from what is being sold. This is the use that pays for the work.
It becomes the board paper. Whoever has to ask for money will lift the profile, the sequence and two or three findings straight out of the set. A report written so that this is possible without rewriting is worth noticeably more than one that is not.
It becomes the successor's briefing. Staff move. The set is what allows the next person in the post to understand why the current sequence exists without starting again.
It becomes the baseline. Re-scoring against the same dimensions later is the most direct evidence available that anything changed, which is the subject of measuring the value of an AI readiness assessment. That comparison only works if the original scores and the method behind them were kept.
What happens in the weeks immediately after delivery, including the findings presentation and the sequencing decisions, is covered in what happens after an AI readiness assessment.
What you may do with it afterwards
This is the section most often left unwritten, and it is the one that decides whether the document is an asset or a souvenir.
Agree that the organization owns the deliverable and may use it without further permission. Agree that it arrives in a format the organization can edit, not only as a PDF or a slide deck, because a document nobody can update stops being maintained on the day it is delivered. Agree whether it may be shared with a peer organization, which matters a great deal in the public sector, where a school district or a city may reasonably want to hand its approach to a neighbour buying through the same cooperative contract. Agree whether it may be shown to another supplier, including one competing for the implementation work, because a roadmap that cannot be shown to the people who would deliver it has lost most of its purpose.
Where a supplier retains anything, such as its own templates or a proprietary scoring method, that should be stated plainly rather than left to be discovered. LABUSA states it: the findings, the evidence and the sequence are yours.
What makes the deliverable acceptable
Acceptance needs three things, and all three are one sentence each in the order form.
A named acceptor, by role rather than by person, with an alternate. Roles survive holidays and resignations in a way that named individuals do not.
A completeness test the acceptor can actually apply: the set contains the items listed above, the evidence appendix supports the findings, and anything not examined is stated. This is a test somebody can carry out in an afternoon, which is the point.
A review window with a consequence attached. Fourteen days is common. What matters is what happens at the end of it, because a window with no stated consequence is not a window.
None of this makes the assessment a certification, and it should not be described as one. It is a structured opinion supported by evidence, and management system standards such as ISO/IEC 42001, published by the International Organization for Standardization, inform how that evidence is organized without the assessment being an audit against them.
Surviving a staff change
Assume the person who commissioned the work will not be there when it matters most. Three small decisions make the set survive that.
Store it somewhere institutional rather than in the sponsor's mailbox. Keep the editable source alongside the published version, and record who holds it. Put a review date on the document itself, so that a reader in fourteen months knows whether they are holding a current view or a historical one.
The habit of documenting decisions so they can be understood later is the substance of the governance function in the NIST AI Risk Management Framework, and it applies to the assessment itself as much as to anything the assessment recommends.
Sources and further reading
- U.S. Government Accountability Office, Artificial Intelligence: An Accountability Framework for Federal Agencies and Other Entities, GAO-21-519SP, June 2021.
- U.S. Government Accountability Office, AI Acquisitions: Agencies Should Collect and Apply Lessons Learned, GAO-26-107859, April 2026.
- National Institute of Standards and Technology, AI Risk Management Framework.
- International Organization for Standardization, ISO/IEC 42001, Artificial intelligence management system.
- UK Government Digital Service, Artificial Intelligence Playbook for the UK Government, February 2025.
Every source above was opened and read on 19 August 2026. If you would like to talk through what a readiness assessment would hand over in your organization, get in touch, or start with the self-assessment.