In this guide
An AI readiness assessment checks whether one business workflow can support AI before you pay for a build. Score 16 checks from 0 to 2 across use case, process, data, systems, risk and operations. A gate item at 0 blocks the build. Otherwise, the total tells you to fix foundations, run a bounded pilot or build.
The checklist is written for small and mid-size B2B teams weighing a first or second AI workflow, such as lead triage, document processing, account research or support replies. It turns public guidance from NIST, ISO, Microsoft, the EU AI Act, the UK ICO and OWASP into checks a team can run against its own systems and records. The worked example scores a fictional company.
Download the AI readiness scorecard (CSV). It has all 16 checks, why each one matters, how to check it, what earns a 2, a 1 or a 0, and an empty column for your scores.
What is an AI readiness assessment?
An AI readiness assessment is a structured check of whether a specific process, its data and the people around it can absorb an AI system safely and usefully. The output is a decision: build, pilot, fix something first, or drop the idea.
Score one workflow at a time. A company can have a strong data team and still own one process with no owner, no test examples and customer data that nobody has screened. Microsoft’s Cloud Adoption Framework for AI makes a related point about data: organizations do not need an entirely new data strategy before they start, because the data each AI capability needs depends on the use case.
The same framework asks leaders to name the business outcomes AI should support, set central rules for responsible use, and pair staff access to approved AI tools with training. Those three ideas show up in the checklist as the owner, the success criteria and the AI use policy.
Which AI readiness frameworks should a small company use?
The public frameworks are worth borrowing from even if you never adopt one formally. Each covers a different part of the problem.
On smaller screens, scroll to compare all columns.
| Source | What it covers | What a small team can take from it |
|---|---|---|
| NIST AI Risk Management Framework (January 2023) | A voluntary framework organized into four functions: Govern, Map, Measure and Manage | Name who is accountable, describe the context of each use, test it, and act on what the tests show |
| NIST AI 600-1, Generative AI Profile (July 2024) | Risks specific to generative AI and actions to manage them | A list of failure modes to test for, including made-up answers and data leakage |
| ISO/IEC 42001:2023 | Requirements for an AI management system, for organizations of any size that provide or use AI | Policy, roles, impact assessment and lifecycle control, without the certification effort |
| EU AI Act, Article 4 (Commission Q&A) | AI literacy duties for providers and deployers of AI systems | Staff who use AI tools should understand the tools and their risks |
| UK ICO guidance on AI and data protection | Accountability and data protection impact assessments (DPIAs) for AI | Screen personal data use before the build and record the decision |
| OWASP Top 10 for LLM Applications 2025 | Security risks in applications built on large language models | Limit what an AI step can access and do, and treat its output as untrusted input |
ISO/IEC 42001 is the heaviest of these. It specifies requirements for establishing, running and improving a management system, and certification is a project of its own. A small team can use its headings as a reminder of what a mature setup covers and certify later if customers ask for it.
What should an AI readiness checklist include?
The 16 checks below cover six areas. Four are gate items, marked in the table: a 0 on any of them stops the build, however high the total. The CSV adds the full scoring guide for 0 and 1.
On smaller screens, scroll to see every column.
| Check | How to check it | Scores 2 when |
|---|---|---|
| 1. One named workflow has a business owner (gate) | Ask who signs off on the output and who loses time if the workflow breaks | One person owns the workflow and has agreed to define success |
| 2. Today’s volume, effort and error rate are measured | Pull one month of volume from the system of record and time ten real items end to end | Volume, time per item and error rate are written down from real data |
| 3. The task needs judgment on messy input | List the decisions in the task and mark which ones a written rule could already make | Most decisions need reading or interpretation that rules cannot cover |
| 4. The current process is written down step by step | Have the person who does the work write the steps, then compare them with one real case | A current written process matches what people actually do |
| 5. Exceptions have a named path | Trace three unusual cases from last month to whoever handled them | A named person or queue receives exceptions, with a response time |
| 6. The inputs the AI needs are accessible by export or API (gate) | List every input field and confirm you can export it or read it through an API on your current plan | All required inputs can be read programmatically |
| 7. A sample of records is complete and consistent | Check 50 recent records for the fields the workflow uses: filled, valid values, no duplicates | Most sampled records are complete and consistent |
| 8. Each critical field has one owner and one writing system | For each field the workflow reads or writes, find which systems and people can change it | One owner and one writing system per critical field |
| 9. A test set of real examples with correct answers exists | Collect 20 to 50 past cases and record the answer a careful person would give | A labeled test set of 20 or more real cases |
| 10. The target system accepts writes and has a safe place to test | Confirm the API can write the fields you need and that a sandbox or test area exists | Writes work through an API, with a sandbox or isolated test area |
| 11. Personal data use has been screened (gate) | List the personal data involved, read the vendor’s data terms and record whether a DPIA is needed | Screening recorded, DPIA done where needed, vendor terms reviewed |
| 12. AI access is limited to what the task needs | List the accounts, keys and permissions the AI step would use and remove what the task does not need | Dedicated credentials with the narrowest permissions that work |
| 13. A rule says which outputs a person reviews before they take effect (gate) | Write down which actions run alone, which need approval and which the AI may never take | A written review rule tied to risk, with a named reviewer |
| 14. Staff know the approved AI tools and their limits | Look for a list of approved tools, banned data types and a training or briefing record | A written policy and a training record for the people involved |
| 15. Someone has time budgeted to run the workflow after launch | Ask who will review errors, update prompts and approve changes, and how many hours a month that takes | A named operator with time allocated and a change log |
| 16. Success, failure and stop criteria are agreed before the build | Write the metric, the target, the minimum quality on the test set and the result that ends the project | Metric, target and stop rule agreed in writing |
Use case and value (checks 1 to 3)
Start with a workflow somebody wants fixed. Without an owner, nobody defines good output, and the project fades after the demo. A baseline matters for the same reason: if you never timed the manual work, you cannot show that the AI version saved anything. The AI automation ROI guide shows how to turn that baseline into a business case.
Some tasks do not need AI at all. If a written rule or a lookup table can make the decision, a plain workflow is cheaper to build and easier to test. The guide to choosing between rules, AI and agents walks through that choice.
Process (checks 4 and 5)
A process that lives in one person’s head cannot be automated or reviewed. Writing it down often shows that two people do the same job differently, and that needs settling before any model sees it. Exceptions need the same attention. Every AI workflow meets cases it cannot handle, and those cases need a named place to go.
Data (checks 6 to 9)
The data checks tell you how much of the build will be data work. Check 6 is a gate because a workflow whose inputs sit in inboxes, PDFs or spreadsheets on someone’s laptop needs a data pipeline before it needs a model. Checks 7 and 8 look at quality and ownership: when a form, an import and an integration all write the same field, nobody can say which value is right, and a model repeats the confusion with confidence.
A test set of twenty to fifty real cases with agreed answers lets you compare prompts, models and vendors on your own work, and later tell you when quality has slipped.
Systems and security (checks 10 and 12)
AI output has to land somewhere, usually a CRM field or a ticket. You need a working write path and a place to test it without touching the records the team depends on. Access limits keep the damage small when something goes wrong. OWASP’s 2025 list of LLM application risks includes prompt injection and excessive agency, meaning a model that can take more actions than its task needs. Give the AI step its own credentials with the narrowest permissions that work.
Risk and governance (checks 11, 13 and 14)
Sending personal data to an AI service is processing under data protection law. The UK ICO says that in the vast majority of cases, using AI will involve processing likely to result in a high risk, which triggers a DPIA, and that you need to document your reasoning even when you conclude that one is not required. The ICO notes that this guidance is under review after the Data (Use and Access) Act 2025. Do that screening, and read the vendor’s data terms, before the build.
The review rule decides where a person stays in the loop. Review effort should follow risk: anything sent to customers, anything that moves money and anything that deletes records needs a person first. The guide to AI agent guardrails covers permissions, review steps and tests in more detail.
People need to know the tools too. Article 4 of the EU AI Act, as amended by Regulation (EU) 2026/1744 in force since 27 July 2026, asks providers and deployers of AI systems to take measures to support the development of AI literacy among the staff who use them. The European Commission’s Q&A says no certificate is needed and gives the example of employees using ChatGPT to write ad copy, who should be told about risks such as made-up answers. A short written policy and a briefing record cover most small teams.
Operations (checks 15 and 16)
Prompts, models, vendors and source data all change after launch. A workflow with no operator degrades quietly. Name that person and set aside their time. Agree the metric, the target and the stop rule before anyone builds, so the pilot ends in a decision.
How do you score an AI readiness assessment?
Score each check 0, 1 or 2 from evidence you can show. A 2 means the evidence exists today. A 1 means it exists in part or only informally. A 0 means it is missing. When the team disagrees, take the lower score and write down why.
- Gate items are checks 1, 6, 11 and 13. Any of them at 0 blocks the build until it is fixed, whatever the total.
- 0 to 12 out of 32: fix the foundations first.
- 13 to 22: ready for a bounded pilot on one workflow.
- 23 to 32: ready to build, keeping the stop rule from the pilot.
The gate rule exists because a total can hide a fatal gap. A workflow can score well on data and systems and still have no rule for what the AI may send to customers. The bands are a planning convention for this checklist and come from no external study, so adjust them if your risk tolerance differs.
Score as a group: the workflow owner, someone who does the work every day and the person who runs the systems involved.
Worked example: scoring a fictional lead triage workflow
Example Co is a fictional 40-person B2B software company. It wants AI to read inbound contact-form messages in its CRM, classify each one as a sales inquiry, support request, partner request, job application or spam, and route it to the right person. The scores below are illustrative and describe no real client.
In the first pass, the head of sales owns the workflow and has agreed to define success (2). The team knows monthly volume from the CRM but has never timed triage (1). The messages are free text, and routing by form fields alone sends many of them to the wrong place, so the task suits AI (2). The process is partly written down (1), and nobody knows what happens to messages that fit no category (0).
On data, the CRM API exposes every field the workflow needs (2). A sample shows company fields often missing (1), and lead source is written both by the form and by a monthly import (1). There is no test set (0). The CRM accepts writes through its API but has no sandbox (1). Messages contain names and email addresses, and nobody has read the AI vendor’s data terms (1). The planned integration user has broad rights (1). There is no review rule (0). AI guidance is informal (1). An operator is named but has no time allocated (1), and the metric is chosen with no stop rule (1).
On smaller screens, scroll to compare the before and after scores.
| Area | Maximum | First pass | After fixes |
|---|---|---|---|
| Use case and value (1 to 3) | 6 | 5 | 5 |
| Process (4 and 5) | 4 | 1 | 2 |
| Data (6 to 9) | 8 | 4 | 6 |
| Systems and security (10 and 12) | 4 | 2 | 2 |
| Risk and governance (11, 13 and 14) | 6 | 2 | 4 |
| Operations (15 and 16) | 4 | 2 | 2 |
| Total | 32 | 16 | 21 |
A total of 16 falls in the pilot band, but check 13 is a gate item at 0, so the result is “blocked”. Example Co fixed three things before going further:
- A review rule (check 13, now 2): the AI suggests a category and a person confirms it, anything that mentions pricing or contracts goes straight to sales, and nothing is deleted automatically. The head of sales reviews the rule monthly.
- A test set (check 9, now 2): the team labeled 40 past messages with the category a careful person would choose.
- An exception path (check 5, now 1): unclear messages go to a named queue owner, with no response time agreed yet.
The second pass scores 21 out of 32 with no gate at 0, which puts Example Co in the pilot band. Its pilot runs in suggestion mode on one form, is measured against the 40-message test set, and stops if the agreed accuracy target is missed. Data quality, field ownership and the integration user’s rights stay on the fix list for before a wider rollout.
What should you do with your AI readiness score?
Start with the gate items. Three of them (owner, personal data screening and review rule) are fixed with a written decision. Data access can take longer if the inputs sit in email or documents. Once no gate is at 0, use the band.
If you scored 0 to 12
Fix the process and data before spending on AI. Write the process down, name the owner and collect the test examples. Check whether a rules-based workflow would solve most of the problem. If the workflow has never been automated in any form, plain automation may be the cheaper first step.
If you scored 13 to 22
Run a bounded pilot on one workflow. Keep the AI in suggestion mode, measure it against your test set, set a time limit and agree the stop rule before you start. Use the pilot period to raise the 1s that would block a wider rollout, such as data quality or access rights.
If you scored 23 to 32
Build, with the guardrails in place: scoped credentials, the review rule, monitoring and an operator. Re-score after the first month of live use.
Where to get help
If the workflow you scored runs through Clay and HubSpot, such as account research, enrichment, lead qualification or sales follow-up, our Systems Readiness Review examines one agreed workflow and returns a current-state map, prioritized findings and a pilot and acceptance plan. Scope, access, price and schedule are agreed on a 30-minute call before work starts. For document processing, internal agents and other AI workflows, see AI systems and automation.
Frequently asked questions
How long does an AI readiness assessment take?
Scoring one workflow with the owner, a daily user and the systems owner fits in a single working session when the evidence is at hand. Gathering missing evidence takes longer: timing the manual work, sampling records and labeling a test set may each take days of work. Score what you can, mark the rest 0, and re-score once the evidence exists.
Do small companies need ISO/IEC 42001 certification to use AI?
No. ISO/IEC 42001 is a voluntary standard for an AI management system. A small team can use its structure for policy, roles and impact assessment, and consider certification if customers or tenders ask for it.
Does the EU AI Act require AI training for staff?
Article 4, as amended in 2026, asks providers and deployers of AI systems to take measures to support the development of AI literacy among staff who operate or use them, without guaranteeing a set level for each person. The European Commission’s Q&A says no certificate is needed and that training should fit the people and the context. National authorities supervise and enforce the rules from 2 August 2026. This is general information and not legal advice.
Is AI readiness the same as data readiness?
Data is one of six areas in this checklist. A workflow can have clean, accessible data and still fail on ownership, review rules or personal data screening, so score all six.
Score one workflow with the AI readiness scorecard first. If that workflow runs through Clay and HubSpot and you want a second opinion on what to fix before building, book a Systems Readiness Review.
Reviewed by Andrii Gorbenko, founder of AGI Technologies