An AI readiness assessment is a structured review of whether an organization can actually support artificial intelligence in the places it wants to use it — and, where it cannot yet, what has to change first.
It is a diagnostic rather than a plan. The output is a set of findings: these processes are suitable, that data is not usable in its current state, this system cannot be integrated without work, that access model would have to change. Deciding what to do about those findings comes afterwards.
What it is not
Three things get sold under this name that are not this:
- A product demonstration. If the review concludes with a recommendation for one specific platform, and that platform belongs to the firm doing the review, it was a sales process with a report attached.
- A maturity score. Being told your organization is “Level 2 of 5” is not actionable. A number is not a finding, and benchmarks against unnamed peers are not evidence.
- A strategy. An assessment establishes what is true. Choosing what to do about it — what to pursue, what to decline, what to spend — is a separate exercise.
Why organizations run one
Usually because something has already gone slightly wrong, or is about to. The common triggers:
- AI tools have appeared across the business without anyone approving them, and leadership wants to know the exposure.
- A pilot produced disappointing results and nobody can say whether the problem was the tool, the data, or the process.
- A vendor has quoted a significant figure and the business wants an independent view before signing.
- A customer, insurer, or regulator has asked what controls are in place.
- Leadership has agreed AI matters and genuinely does not know where to start.
The last is the best reason and the least common. An assessment run before money is committed is considerably cheaper than one run to explain why the money did not work.
The eight dimensions
A competent assessment covers all eight. Skipping any of them tends to produce a plan that fails at exactly that point.
1. Business readiness
What the organization is actually trying to achieve, who owns that objective, and whether there is a budget and a decision-maker attached to it. An assessment that never speaks to anyone outside IT will produce a technically sound answer to a question the business did not ask.
2. Process readiness
Whether the candidate processes are documented, consistent, and stable enough to automate or assist. A process that three people perform three different ways is not ready, and the finding is that it needs standardising before any tool is introduced.
3. Data readiness
Usually the binding constraint. Is the information held somewhere a machine can read, rather than in an individual’s judgment; is it current; is it consistent; is there a single authoritative version; can it be accessed programmatically; and is it labelled well enough to be found. Most disappointing results trace back here.
4. Infrastructure readiness
Whether the environment can support the workload and the integration it implies — compute, storage, network, and the ongoing cost at realistic usage rather than pilot usage. Also whether the estate is stable enough that adding to it is wise.
5. Application readiness
Whether the systems holding the relevant data can be integrated at all. A line-of-business application with no API and no supported export is a hard constraint, and discovering it after selecting a platform is expensive.
6. Security and privacy readiness
What classification the data carries, whether access can be scoped to the minimum required, what obligations apply (contractual as well as regulatory), and whether the organization can evidence any of it. AI systems tend to be given broad access because narrowing it is work; this is where that gets caught.
7. Governance readiness
Whether anyone is accountable for AI decisions, whether an acceptable-use position exists, and whether there is a way to approve or decline a new tool. Most smaller organizations score poorly here and are surprised to learn it matters this early.
8. Workforce readiness
Whether the people doing the work can evaluate the output. This is the dimension most often left out and it decides whether the deployment survives: a tool whose output nobody is competent to check either gets trusted blindly or quietly abandoned.
Identifying candidate use cases
Alongside the diagnostic, a good assessment produces a shortlist of specific, named opportunities — not “customer service” but “drafting first responses to the forty routine enquiries that arrive each day”. Each candidate should carry an estimate of volume, the time currently spent, and what an error would cost.
Crucially, the shortlist should also record what was considered and rejected, and why. That list is often more useful than the accepted one, because it is what stops the same idea being re-proposed every quarter.
What you will be asked to provide
Assessments stall on access rather than on analysis, and the delay is almost always the same handful of items. Gathering them in advance shortens the exercise considerably:
- A list of systems, however rough — what runs the business, who administers each, and which are cloud versus on-premises.
- Licence and subscription records, including anything paid on an individual card. This is where undeclared AI tools surface.
- Whatever documentation exists for the candidate processes, in whatever state. “We do not have any” is itself a finding, and a common one.
- Access to speak to the people who do the work, not only to their managers. The description of a process from above and from inside it are frequently different documents.
- Client and regulatory obligations that constrain where data may go — usually already written into contracts nobody has read recently.
- Read access to the relevant systems, or a screen-share with someone who has it.
A firm that asks for none of this and still produces a confident report has produced an opinion.
How long it takes
For an organization of twenty to two hundred people, a competent assessment is normally two to four weeks of elapsed time and a few hours of internal effort spread across several people — interviews, a systems walkthrough, and a review of what was found.
Substantially faster than that usually means the evidence-gathering was skipped. Substantially slower usually means the scope has drifted into doing the remediation work as it goes, which is worth catching early: the assessment should tell you what to fix, not quietly become the fixing.
What the report should contain
A useful assessment report is specific enough to act on and honest enough to be uncomfortable in places:
- Findings by dimension, with evidence — what was examined, not just a conclusion.
- Gaps ranked by whether they block anything. A gap that blocks every candidate use case is not the same as one that blocks a nice-to-have.
- A shortlist of candidate use cases with rough effort and value, and the rejected list.
- Prerequisites — what must be true before each candidate is viable.
- An explicit statement of what is not ready, in plain language.
- Recommended next steps that do not all require the assessing firm.
If every gap in the report happens to be solved by a service the assessor sells, treat the report as a proposal.
What happens after
Three outcomes are legitimate, and a good assessment makes clear which one applies:
- Proceed. At least one candidate is viable now. The next step is deciding scope and success criteria, then a pilot.
- Fix first. The most common outcome for smaller organizations. The real project turns out to be documentation, data cleanup, or access control — work that is valuable on its own terms and would have been necessary anyway.
- Not yet. The honest conclusion when the objective does not need AI, or when the cost of readiness exceeds the value on offer. An assessor who has never delivered this outcome is not assessing.
The finding organizations least expect
Across smaller organizations the same result recurs often enough to be worth stating in advance: the constraint is almost never the technology, and almost always the state of the information.
Documentation that was accurate three reorganisations ago, four overlapping versions of the same price list, a customer record split across a CRM and a spreadsheet that disagree, procedures that describe a system replaced in 2022. None of it is unusual and none of it is anyone's fault; it is what accumulates in a business that has been busy.
It matters here because it is invisible until something tries to read it at scale. A person consulting a stale document notices it is stale. A system does not, and answers anyway. That asymmetry is the reason data readiness sits where it does in the list above.
How to judge an assessment
Before commissioning one, four questions are worth asking:
- Who will you speak to? If the answer does not include people outside IT, the business-readiness dimension will be guessed.
- What will you actually examine? Interviews alone produce an opinion. Ask whether they will look at the systems, the data, and the access model.
- What do we own at the end? The findings, the inventory, and the shortlist should be yours in a portable form.
- What would make you tell us not to proceed? The answer reveals whether the exercise can produce a negative result.
Can you run it yourself?
Yes, and for a smaller organization with an experienced technology lead it is a reasonable option. The eight dimensions above are the checklist; the work is honest evidence-gathering rather than specialist knowledge.
Two things make self-assessment harder than it looks. The first is that people find it difficult to record their own processes as they actually are rather than as they are supposed to be. The second is that the uncomfortable findings — the data nobody maintains, the system one person understands — are exactly the ones an internal reviewer is least well placed to write down. Where those are likely, an outside view earns its cost.
Once the diagnostic is done, the next question is what to do about it. That is the subject of arriving at an AI strategy, and the sequencing that follows is covered in turning that position into a phased plan. The governance findings, which most assessments flag, are dealt with in AI governance for smaller organizations.
Want an independent assessment of where your organization stands? Schedule an AI & Technology Readiness Assessment, or read how it fits into our Virtual CIO and IT consulting work.