Most organizations do not arrive at artificial intelligence through a strategy. They arrive because a staff member found a tool that saved them an afternoon, or because a board member asked at the wrong moment what the plan was, or because a vendor sent a proposal that looked cheaper than the problem it claimed to solve.
That is a normal starting point, and it is not a bad one. What makes it dangerous is committing money before anyone has established whether the organization can support what it is buying. The questions below are the ones we find most useful for that. None of them requires technical knowledge to ask, and every one of them has an answer that tells you something you can act on.
Ask them in a room with the people who would actually be affected, not only with IT.
1. What are we trying to improve, and how would we know if it worked?
This is the question that separates a plan from an intention, and it is the one most often skipped because it feels too obvious to ask. If the answer is "efficiency" or "modernization", there is no plan yet. A usable answer names a process, a group of people, and a number that would move: response times on a particular queue, hours spent producing a particular report, backlog in a particular team.
If nobody can name the number now, nobody will be able to say afterwards whether the investment worked. That matters more in a public body than a commercial one, because you will eventually be asked.
2. Who is accountable for this, and can they stop it?
Somebody should be able to approve AI work, fund it, and cancel it. Those three powers usually need to sit together, and in many organizations they sit nowhere at all: IT is asked to deliver something the business has not decided it wants, with money that has not been allocated.
The second half of the question is the important half. An owner who can start things but cannot stop them is not an owner, and pilots that cannot be cancelled tend to become production systems by default rather than by decision.
3. What AI tools are our staff already using?
Ask this one plainly and without consequence attached, because the honest answer is almost always "more than you think". People adopt tools that make their work easier, and they do it faster than any approval process moves.
This is not a disciplinary finding. It is a signal: the tools are genuinely useful, and no approved route exists yet. The risk is not that staff are using AI, it is that nobody knows what information has gone into which service under whose terms. That question is examined properly in the cybersecurity risks worth assessing before deployment.
4. Where does the information live that this would depend on?
Every AI use case rests on information. The useful question is where that information physically sits: in a system, in a shared drive, in a set of documents nobody maintains, or in the judgment of two people who have been here twenty years.
If the answer is the last one, the honest finding is that the process needs documenting before it can be automated or assisted. That is real work, it is worth doing on its own merits, and it is much cheaper to discover now than after a platform has been chosen.
5. Can that information be read by a machine?
Different question, and the one that most often stops a project. Records may exist, be accurate, be well maintained, and still be unreachable: held in an application with no interface, exportable only as a formatted report, or locked in scanned documents.
You do not need to answer this yourself. You need to ask your IT team or your supplier, in writing, and get a specific answer for each system rather than a general reassurance. "We can integrate with anything" is not an answer.
6. Which of our records are sensitive, and does everyone agree?
Most organizations have an intuition about this and no written classification. That is survivable until an AI service is introduced, because the service inherits whatever access the person operating it has, and intuition does not scope permissions.
A first pass does not need to be elaborate. Three categories, applied to the systems in scope, and agreement on who owns each set. If your organization holds student records, health information, or anything with a contractual confidentiality obligation attached, this question moves to the front of the list rather than the middle.
7. Who may approve a new AI tool, and how would they decide?
If there is no answer, the practical answer is that anybody may approve one, and several people already have. Governance sounds like a heavyweight exercise and does not need to be: a named approver, a short written position on acceptable use, and the same supplier review you already apply to anything else handling your information.
What matters is that a decision can be made and recorded. We set out a proportionate version for public bodies in an AI governance framework for public-sector organizations.
8. Where would a wrong answer actually hurt?
AI systems produce confident output that is sometimes wrong. That is a property of the technology rather than a defect to be fixed, so the design question is where a wrong answer would do damage before anyone noticed.
Drafting a first version of a routine letter is low consequence. Anything that affects a person's eligibility, safety, employment, grade or benefit is not, and belongs behind a human review that is real rather than nominal. Deciding this early is what lets you move quickly on everything else.
9. Who will check the output, and are they equipped to?
This is the question that decides whether a deployment survives its first year, and it is the one most often left out of a business case.
If the people receiving AI output cannot tell a good answer from a plausible wrong one, the tool will either be trusted blindly or abandoned quietly. Both are failures, and the second one is expensive and invisible. The remedy is training aimed at the specific work rather than a general awareness session.
10. What will this cost to keep running?
Pilots are cheap and production is not. Usage rises when a tool is useful, licensing often scales per person, integration needs maintaining, and somebody has to own the thing after the project closes.
Ask for a running cost at realistic volumes rather than pilot volumes, and ask what happens to that cost if adoption doubles. A supplier who cannot model it has not deployed at your scale before, which is itself worth knowing.
What the answers usually reveal
Two patterns come up repeatedly.
The first is that the constraint is rarely the AI. Organizations expect to be told they need a better product and are usually told instead that their information is not yet in a form a machine can read, or that nobody is accountable for the decision. Both are fixable, and both are cheaper to fix before a purchase.
The second is that the organization is further along than it believes on some dimensions and further behind on others, and the gap between those two is where the risk sits. A body with excellent infrastructure and no governance is exposed in a way that a body with weak infrastructure and clear governance is not, because the first one can move quickly in the wrong direction.
Turning ten questions into a decision
These questions are diagnostic rather than systematic. If you want the systematic version, the seven dimensions of AI readiness sets out the framework we assess against, and the readiness checklist for public-sector organizations turns it into something you can work through with your own team.
You can also get a score in about eight minutes. The AI Readiness Self-Assessment asks twenty eight questions across the same seven dimensions and returns a result with recommendations for wherever you scored lowest. It is a benchmark rather than an audit, and it says so.
Where the answers point to a real programme rather than a single tool, an AI readiness assessment examines the evidence instead of your impression of it, and produces a written roadmap you can take to a board. If a cooperative contract is your likely purchasing route, the TIPS members page covers that side.
If you would rather just talk it through first, tell us what you are considering. The conversation is free and it frequently ends with us saying that the timing is not right yet, which is a legitimate outcome.