The short answer
AI readiness is less about the model and more about the groundwork around it. Before you invest, you should be able to name the problem AI will solve and its owner, point to the data it needs, show that only the right people can see that data and explain how you will check results and measure value.
The worksheet below covers nine areas. Score each from evidence, not optimism. If you find gaps, you are in good company, and the fix nearly always starts with data and permissions.
Why readiness matters more than the model
AI magnifies whatever is already true about your organization. An assistant that searches your files finds the outdated policy as easily as the current one, and one that works with each person's permissions surfaces every folder shared too widely years ago.
Governance is part of readiness too. The US has no comprehensive federal AI law, but existing law already applies to AI. The FTC Act prohibits unfair or deceptive practices, including in how organizations collect, use and protect personal information (FTC), sector laws such as HIPAA govern health information, and state privacy laws such as California's CCPA (California Attorney General) and the Texas Data Privacy and Security Act add notices, consumer rights and assessments for high-risk processing. Some states have added AI-specific rules too (see AI laws in the US). Accountability for decisions stays with your organization, not with an automated system. This is general information, not legal advice. For a structure to grow into, borrow from the voluntary NIST AI Risk Management Framework: govern, map, measure, manage.
The AI readiness worksheet
Tick an item only when you can show evidence: a document, report, setting or named person.
Strategy and ownership
- An executive sponsor who can make decisions and remove obstacles
- Two or three written business goals AI should support
- A business owner for each use case, not only IT
- A budget that separates one-time build costs from ongoing license and usage costs
Use cases
- Candidates scored on value, feasibility, data readiness, risk and cost
- A first use case that is frequent, contained and easy for a person to check
Data
- Location: you know where the information each use case needs lives
- Quality: key documents and records are current, with obsolete versions archived
- Access: the data is reachable through supported APIs, connectors or exports
- Sensitivity: personal, confidential and regulated information is identified and labeled where your tools allow
Systems and integration
- An inventory of core systems: Microsoft 365 or Google Workspace, ERP, CRM and line-of-business applications
- AI features already built into those systems are known, with a decision on each
- A test environment that keeps AI trials away from live records
Identity and permissions
- Individual accounts for everyone, protected by multifactor authentication
- Content shared with "everyone" or all-staff groups reviewed
- A named owner for every site, team and shared drive
- Access removed promptly when people leave or change roles
Security
- Managed, patched devices for anyone using AI tools
- Logging on, and retained, for the systems AI will touch
- Unapproved AI apps, browser extensions and add-ins detected or blocked
- AI applications you build tested for prompt injection and data leakage
Privacy and governance
- Policy: an AI acceptable use policy that staff have read
- Register: approved AI tools and use cases, each with an owner
- Risk review: a short assessment for each new use case, including privacy
- Human review: rules for checking outputs that affect people, money or compliance
- Vendor terms on training, retention and processing location reviewed
- Deployment model chosen for sensitive data: an enterprise AI service, models in your own cloud account or self-hosted open-weight models
People and skills
- Practical training on approved tools, including their limits
- Champions in each team who share what works
- A person accountable for each AI solution after launch
Measurement
- A baseline for each use case (volume, time per item, error rate)
- Success measures and a stop threshold agreed in advance
- A review date and someone responsible for the numbers
For security and people, pair the worksheet with the basics CISA promotes for every organization through Secure Our World, such as multifactor authentication, updated software and spotting phishing, and add the AI-specific habits: choose vendors carefully, limit what information you provide and train employees.
How to score your readiness honestly
Give each area a score:
- 0, not in place: it does not exist, or nobody can show it.
- 1, partly in place: it is informal, covers only some teams or systems, or lives in one person's head.
- 2, in place: it is documented, has a named owner and could be shown to an auditor or board.
Four rules keep the score honest. Score today, not the plan: a draft policy is a 1. Ask the people who do the work, who often rate data quality and permissions lower than their managers. Look at the lowest score, not the average: strong strategy does not make up for a zero on permissions. Score per use case where it differs: supplier invoices may be ready while shared drives are not.
| What your scores show | What it usually means | Sensible next step |
|---|---|---|
| Mostly 2s, no zeros | Ready for a contained first use case | A proof of concept on your own data, with agreed accuracy and cost thresholds |
| A mix of 1s and 2s | Ready for a narrow, low-risk pilot | Pilot one use case and close the gaps in parallel |
| A zero in data, permissions or governance | Not ready for AI that reads internal content | Fix that foundation first |
| Mostly zeros and ones | Early stage | Policy, approved tools, permissions and data clean-up |
These bands are a rule of thumb, not a formal standard.
Rather talk it through? If your scores are mixed or hard to judge, we can work through the checklist with your team and tell you plainly what to fix first. Talk to a Promatics specialist
If you are not ready yet
Not being ready is the normal starting point, and it usually means AI would have exposed problems you already had. A sensible order of work:
- Set rules for today's use. Staff are probably using AI already. Publish a short policy and name approved tools so work moves out of personal accounts (see our guides to an AI acceptable use policy and shadow AI).
- Fix permissions. Review content shared with everyone, give every site an owner and remove stale access. Planning Copilot? Read our Copilot readiness guide.
- Clean the data for one use case, not the whole organization.
- Measure the task you want to improve, so you can tell later whether AI helped.
- Then choose one contained use case that is frequent, easy to check and low in risk.
This pays off even without AI: tidier permissions and data reduce risk on their own.
What usually goes wrong
- Scoring the plan, not the reality. The checklist looks green, then the pilot stalls waiting for data access.
- Starting with a platform. Licenses are bought before anyone agrees what problem they solve.
- No owner after launch. Accuracy, costs and permissions drift once the pilot team moves on.
When to bring in help
You can run this checklist yourself, and a general AI chatbot can help you draft the questions. A small team using AI features built into its existing software, under a clear policy, may need nothing more for now.
Bring in a professional when AI will read your internal documents or records, when personal or regulated information is involved, when you must choose between platforms, or when a board or funder wants evidence. A checklist cannot open your sharing reports or test what an assistant would reveal to a junior employee.
Our AI strategy and readiness service does that work: interviews with your teams, a review of your data, systems, identity and security, a scored use-case shortlist and a 90-day plan with owners. Because we also deliver managed IT and cybersecurity, the people who find the gaps can help you close them.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Privacy and security business guidance, Federal Trade Commission
- California Consumer Privacy Act (CCPA), State of California Department of Justice, Office of the Attorney General
- AI Risk Management Framework, National Institute of Standards and Technology (NIST)
- Secure Our World, Cybersecurity and Infrastructure Security Agency (CISA)
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.