AI Readiness Assessment: A Practical Checklist For Growing Businesses

An AI readiness assessment is a structured check of whether a business can use AI in a way that pays off. It looks at six areas: the problems worth solving, your data, your systems, your people, how risk is governed, and how well specific workflows suit AI. The result is a score for each area and a clear next step.

The question matters more than it used to. In the survey period ending May 3, 2026, 19.8% of US businesses told the Census Bureau (opens in a new tab) they use AI, rising to 37% of firms with 250 or more employees. Use is not the same as readiness, though. In the Federal Reserve's latest small business survey, 46% of firms said the business or its employees use AI, but only 7% of those users had fully integrated it into the business (Small Business Credit Survey, 2026 (opens in a new tab)). The two figures differ because the Fed survey is a self-selected sample of 6,525 small employers and counts staff using AI on their own, while the Census survey is nationally representative.

This guide gives you a complete AI readiness assessment you can run yourself: what to check in each area, a scorecard with what each level looks like, a checklist, a way to decide which workflows should use AI and which should not, and a worked example. It is written for owners and managers of businesses with roughly 10 to 500 people, so it also works as an AI readiness assessment for small business teams with no dedicated AI staff.

What Is An AI Readiness Assessment?

An AI readiness assessment, sometimes called an AI readiness audit or AI readiness check, comes before any tool is chosen. It asks whether there is a real problem worth solving, whether the needed data exists and can be trusted, whether systems can connect to an AI tool, whether people have the skills and time, and who owns the risks.

It is not a technology shopping list, and it is not a vendor demo. A good assessment can end with the conclusion that a workflow needs a simple rule-based automation, a process fix, or no change at all. That outcome is useful, because it stops money going into AI where it will not help.

It is also different from an AI audit in the compliance sense. When people search for "AI audit," they often mean checking an AI system that is already running, for bias, accuracy, security or legal compliance. An AI readiness assessment comes earlier. It checks whether the business is ready to use AI at all, and where to start.

Why Assess AI Readiness Before Building Anything

Most of the reasons AI projects fail are organizational, not technical. RAND interviewed 65 experienced AI practitioners and found five root causes (RAND, 2024 (opens in a new tab)):

• The problem to be solved is misunderstood or poorly communicated.

• The organization lacks the data needed to train or run an effective model.

• The focus is on using the latest technology rather than solving a real problem for users.

• The infrastructure to manage data and deploy the AI is not in place.

• The problem is too difficult for AI to solve.

An AI readiness assessment checks for all five before money is spent, including the last one, through the workflow fit area. Data is a common gap. In a February 2025 release, Gartner reported that 63% of organizations either do not have, or are unsure whether they have, the right data management practices for AI, and predicted that through 2026 organizations will abandon 60% of AI projects that are not supported by AI-ready data (Gartner, 2025 (opens in a new tab)).

The gap between using AI and getting value from it shows up in large companies too. In McKinsey's 2026 survey, nearly nine in ten respondents reported regular AI use in at least one business function, but only 37% said AI had contributed to their organization's EBIT (operating profit), a share essentially unchanged from the year before (McKinsey, The state of AI in 2026 (opens in a new tab)). Cisco's 2025 AI Readiness Index, a survey of more than 8,000 leaders at organizations with over 500 employees, found that only about 13% are fully prepared, and that this group is four times more likely to move pilots into production (Cisco, 2025 (opens in a new tab)). Those are large-company figures, but smaller firms show a similar gap: in the Federal Reserve survey above, only 7% of small businesses using AI had fully integrated it.

The Six Areas Of An AI Readiness Assessment

Most published frameworks use five to seven areas. Cisco's index, for example, assesses strategy, infrastructure, data, talent, governance and culture (Cisco AI Readiness Index (opens in a new tab)), and Microsoft's free wizard asks about business strategy, technology and data strategy, AI strategy and experience, organization and culture, and AI governance and security (Microsoft AI Readiness Wizard (opens in a new tab)). The six areas below form a simple AI readiness assessment framework that covers the same ground in terms a growing business can check, with one area added for growing businesses: whether the specific workflows you care about actually suit AI.

1. Business Goals And Use Cases

This area checks whether AI is being considered to solve a named problem with a measurable outcome, such as "cut the time to answer a customer email from a day to an hour," rather than because competitors are talking about it. The strongest sign of readiness is a short list of specific problems, each with an owner and a number that would show improvement.

Weak readiness here looks like a general wish to "use AI more," a tool bought before anyone agreed what it was for, or several departments running separate experiments with no shared view of what worked.

2. Data

AI can only work with the information it can reach, and it will repeat whatever mistakes that information contains. This area checks whether the data a use case needs exists, where it lives, who owns it, how accurate and current it is, and whether it can be accessed safely. For most growing businesses that data sits in a mix of business software, spreadsheets, shared drives and email.

AI data readiness does not mean perfect data. It means you know which data a specific use case needs, you have checked a sample of it, and the gaps are known and fixable. A business that cannot say where its customer records live, or has three versions of the same price list, is not ready for AI that depends on them.

3. Systems And Tools

This area checks whether your current software can share data with an AI tool, usually through an API (a standard way for one system to request data from another), and whether the business has a sensible view of which AI tools staff already use. It also covers basics such as single sign-on (one company login for every tool), backups and who manages each system.

Readiness does not require new infrastructure. Many useful AI projects in growing businesses connect to systems already in place, such as accounting, CRM or job management software. The warning sign is a core system that cannot export or share data at all, or that only one person understands.

4. People And Skills

AI changes how work gets done, so this area checks whether the people affected understand what is planned, whether someone has the time to own the project, and whether staff have basic skills in using AI tools safely. It also looks at whether the people who do the work will be involved in designing the change, since they know the exceptions and workarounds that a new system must handle.

Time is a common gap. Among small businesses planning to use AI in the Federal Reserve's survey, 37% named the time needed to implement it or train employees as a challenge (Small Business Credit Survey, 2026 (opens in a new tab)).

5. Governance, Risk And Security

This area checks whether there are clear rules for how AI is used: which tools are approved, what data may and may not be shared with them, who reviews AI output before it reaches customers, and who is accountable when something goes wrong. It also covers the vendors you rely on, since most growing businesses use AI through someone else's product.

The NIST AI Risk Management Framework is a useful free reference, intended for voluntary use (NIST AI RMF (opens in a new tab)). Its core organizes AI risk work into four functions: Govern, Map, Measure and Manage (NIST AI Resource Center (opens in a new tab)). NIST also publishes a Generative AI Profile covering risks specific to tools such as chatbots and writing assistants. A growing business does not need to adopt either in full. A short written AI use policy, a list of approved tools and a review step for customer-facing output are enough to reach level 3 on the scorecard below. Businesses that need formal assurance can look at ISO/IEC 42001, a certifiable standard for AI management systems that applies to organizations of any size, though certification is not needed for a level 5 score (ISO/IEC 42001:2023 (opens in a new tab)).

Accuracy is the risk small businesses mention most. In the same Federal Reserve survey, 46% of firms using AI named accuracy as a challenge, which is why review steps belong in this area of the assessment rather than being added later.

6. Workflow Fit

The first five areas describe the business as a whole. This one looks at individual workflows, because a business can be ready for AI in one process and not in another. For each candidate workflow, it checks how often the work happens, whether it follows clear rules or needs judgment, whether the inputs are structured (forms, spreadsheets) or unstructured (emails, documents, images), what a mistake would cost, and whether success can be measured.

Workflow fit is where an AI readiness assessment most often concludes that AI is not the answer. The section on when AI is not the answer, further down, explains how to make that call.

How To Score Your AI Readiness

Score each of the six areas from 1 to 5. The rule that makes the score useful is evidence: only give a score if you can point to something that proves it, such as a document, a system setting, a named owner or a sample of data you have checked. A score based on what people believe to be true will flatter almost every business.

Add the six scores and divide by six to get an overall AI readiness score. An average below 2.5 means fix foundations first, 2.5 to 3.4 means run one focused pilot, and 3.5 or more means scale what works. Then apply one rule before reading the average: if Data or Governance scores 1, treat the result as "fix foundations first," whatever the average says. Those are the two areas where weakness turns a promising pilot into a costly mistake.

These thresholds are a practical rule of thumb from Fossilite's approach, not a published standard. Their purpose is to turn the scores into a decision, which is the step many online checklists skip.

What Your AI Readiness Score Means

The overall score points to one of three next steps. Each has a different goal, so it helps to agree on which one you are in before anyone starts looking at tools.

Fixing foundations is not a failure result. It can be a few weeks of focused work: writing an AI use policy, choosing approved tools, cleaning the data one use case needs, and naming an owner. Rerun the assessment afterwards. A pilot that starts on fixed foundations carries fewer of the failure causes RAND identified.

A focused pilot should cover one workflow, with a measure taken before it starts, a human reviewing output, and a fixed date to decide whether to continue. Our guide to running an AI proof of concept shows how to set those measures and a stop line. Our guide to moving an AI demo into production covers how to take a pilot that works into everyday use.

AI Readiness Assessment Checklist

Use this checklist as an AI readiness assessment template. Answer each item yes or no, and only answer yes if you can show the evidence. Each group of four matches one of the six areas, so adding one to the number of yes answers in a group gives a rough score for that area, from 1 with no yes answers to 5 with four.

Checklist: Business Goals And Use Cases

• We have named two or three specific problems AI might help with.

• Each problem has an owner and a number that would show improvement.

• We know what each problem costs today, in time, money or errors.

• Leadership agrees which problem comes first.

Checklist: Data

• We know where the data for each problem lives and who owns it.

• We have checked a real sample for accuracy, gaps and duplicates.

• Data can be accessed without copying it into personal files or unapproved tools.

• We know which data is confidential, personal or regulated.

Checklist: Systems And Tools

• Our main systems can share data through an API, integration or export.

• We have a list of AI tools staff already use, including free ones.

• Each core system has a named person who looks after it.

• Access is controlled with individual logins, not shared accounts.

Checklist: People And Skills

• One person owns the AI initiative and has time set aside for it.

• The people who do the work have been asked about it.

• Staff have had basic guidance on using AI tools safely.

• We have a plan for how roles or tasks will change.

Checklist: Governance, Risk And Security

• We have a written AI use policy that staff have seen.

• We know which AI tools are approved and what data may be shared with them.

• AI output that reaches customers or affects money is reviewed by a person.

• We have checked how our AI vendors store and use our data.

Checklist: Workflow Fit

• We have mapped the candidate workflows as they actually run, including exceptions.

• We know how often each workflow runs and what a mistake costs.

• Each workflow has a baseline measure we could compare against.

• We have decided, for each workflow, whether it needs AI, simple automation or no change.

When AI Is Not The Answer

A good AI readiness evaluation should be willing to say no. Anthropic, which builds the Claude models, gives developers similar advice, recommending "finding the simplest solution possible, and only increasing complexity when needed," and noting that this "might mean not building agentic systems at all" (AI that takes multi-step actions on its own) (Anthropic, Building effective agents (opens in a new tab)). For a business, the simplest solution is often a clearer process or a rule-based automation.

For each candidate workflow, the assessment should reach one of four verdicts. The deciding questions are whether the work follows clear rules, whether its inputs are structured, and what a mistake would cost.

For many growing businesses, the second and third verdicts are where the first gains come from. Our guide to automating repetitive business tasks covers how to choose between rules, integrations and AI for a specific task, and our guide to human-in-the-loop AI covers how to design the review step when mistakes matter. If the idea is to predict something, such as which customers will leave, check first whether it is really a prediction problem.

How To Run An AI Readiness Assessment

You can run a first AI readiness assessment yourself in a handful of working sessions. The steps below keep it practical and evidence-based.

1. 1

   Name a sponsor and a scope. One person owns the assessment. Decide whether it covers the whole business or two or three departments.

2. 2

   List the problems, not the tools. Ask each team where time, money or quality is lost today. Write each as a problem with a rough cost.

3. 3

   Talk to the people who do the work. They know the exceptions, workarounds and hidden steps that decide whether AI can help.

4. 4

   Map the data and systems for each problem. Note where the data lives, who owns it, and check a real sample.

5. 5

   Review current AI use and policies. List the AI tools staff already use and what data goes into them. If you have no rules yet, our guide to writing an AI acceptable use policy includes a free template.

6. 6

   Score the six areas with evidence. Use the scorecard and checklist above, and record the evidence for each score. Score as a small mixed group, including people who do the work, not the sponsor alone.

7. 7

   Give each workflow a verdict and choose the next step. Agree on one outcome, one first workflow and one measure of success.

Free online tools can help as a starting point. Microsoft's AI Readiness Wizard asks 10 questions across five areas, and the OECD is piloting an SME AI Readiness Tool that takes about five minutes, labeled "for testing purposes only" (OECD SME AI Readiness Tool (opens in a new tab)). Both give a quick overall picture. Neither looks at your actual data or workflows, which is where most of the useful findings come from.

Doing It Yourself Vs. Getting Outside Help

A self-assessment is usually enough for a business with a few clear problems, simple systems and someone with time to own it. Outside help is worth considering when the data is spread across many systems, when customer or regulated data is involved, or when nobody internally can judge which workflows suit AI. If the assessment points to buying a tool instead of building one, see our guide to choosing an AI vendor.

If you do bring in help, look at what the assessment delivers. A useful one produces scores with the evidence behind them, a verdict for each workflow, a short list of first projects with measures, and a plain list of risks. Be wary of an assessment that always recommends the provider's own product, gives a score without evidence, or never concludes that something should stay as it is. Our guide on how to choose an AI consulting partner covers what to ask before you sign.

Common AI Readiness Mistakes

• Starting with a tool. Buying an AI product first and looking for uses afterwards reverses the order that works.

• Scoring on opinion. Without evidence, people score what they hope is true, and the assessment loses its value.

• Treating data as an IT problem. The people who use the data every day are the ones who know where it is wrong.

• Ignoring the AI already in use. Staff often use free AI tools with business data before any policy exists. Find out first.

• Assessing the business but not the workflows. A business-wide score does not tell you which process to start with.

• Never reassessing. Readiness changes as data is cleaned, policies are written and pilots succeed. Rerun the assessment after each major step.

An Example AI Readiness Assessment (Illustrative)

This example is hypothetical, to show how the scoring works. It is not a Fossilite client project.

A property management company with about 70 staff looks after 2,000 rental units. Its team wants to use AI for three things: sorting tenant maintenance requests, matching rent payments to tenant accounts, and scheduling annual inspections. Requests arrive by email and phone, records sit in property management software, and some staff already paste tenant emails into a free chatbot to draft replies.

The average is 2.5, which would normally point to a pilot. The minimum rule changes that: Governance scored 1, so the minimum rule applies and the first step is to fix foundations. The company writes a one-page AI use policy, stops tenant data going into unapproved tools, chooses an approved AI service on a business plan whose contract limits how the vendor stores and uses its data, and cleans up unit IDs in the two systems.

Each workflow also gets a verdict. Rent payment matching follows clear rules on structured data, so it gets simple automation, not AI. Inspection scheduling already runs smoothly in the property management software, so it gets no change. Maintenance request sorting needs judgment on messy emails, and a mistake could leave an urgent leak unattended, so it gets AI with human review: the AI sorts each request and suggests how urgent it is, and a coordinator confirms before any work is scheduled.

After the foundation work, the company reruns the assessment, scores Governance at 3 and Data at 3, and starts a pilot on maintenance requests with one measure: time from request to first response.

How Fossilite Approaches AI Readiness

Fossilite starts from the work, not from a preselected technology. An AI audit with Fossilite looks at how work moves through your existing tools, which tasks are worth simplifying or automating, and whether AI would help at all. That can mean recommending a simpler fix where AI is not needed.

Engagements follow five stages: understand the work, define what needs to change, design with the business, build and connect, then hand over and improve. The aim is to use the systems, data and processes that already matter to the business, and to leave the team with something it can own.

Frequently Asked Questions

Common questions from business owners considering an AI readiness assessment.

What Does An AI Readiness Assessment Include?

An AI readiness assessment usually includes a review of business goals, data, systems, people and skills, governance and risk, and how well specific workflows suit AI. It ends with a score for each area, the evidence behind each score, a verdict for each workflow, and a recommended next step such as fixing foundations or running one pilot.

How Long Does An AI Readiness Assessment Take?

A first AI readiness assessment for a growing business can be done internally in a handful of working sessions spread over a few weeks. Free online self-checks take minutes but only give a broad picture. A detailed assessment takes longer when data is spread across many systems or several departments are involved.

How Much Does An AI Readiness Assessment Cost?

Costs vary widely. A self-assessment using a scorecard and checklist costs only staff time, and free online tools exist from Microsoft and the OECD. Paid assessments from consultancies depend on the number of workflows, systems and departments covered, so ask for a fixed scope and a clear list of deliverables before agreeing to a price.

Is An AI Readiness Assessment The Same As An AI Audit?

Not usually. An AI readiness assessment checks whether a business is ready to use AI and where to start. The term AI audit often means reviewing an AI system already in use for accuracy, bias, security or compliance. Some providers, including Fossilite, use "AI audit" for a workflow review that comes before any build.

Can A Small Business Do An AI Readiness Assessment Itself?

Yes. A small business with a few clear problems and simple systems can run an AI readiness assessment itself using a scorecard, a checklist and conversations with the people who do the work. The key is scoring only on evidence. Outside help becomes worthwhile when data, systems or regulated information make the picture complicated.

What Is The Biggest Sign A Business Is Not Ready For AI?

The clearest warning sign is not being able to name the specific problem AI should solve, with an owner and a measure. The second is weak data or governance, such as not knowing where key data lives or having no rules about which AI tools staff may use with business information.

How Often Should We Reassess AI Readiness?

Reassess after each major step, such as writing an AI policy, cleaning a data source or finishing a pilot, and at least once a year. AI readiness changes as foundations improve and as new tools appear, so an assessment that is a year old may no longer reflect what the business can do.

Once you know which workflow to start with, our guide to automating repetitive business tasks is a practical next read.