Strategy
AI readiness assessment: the checklist we use and how to score it
The short version
An AI readiness assessment checks whether a company can start an AI build in the next 90 days without wasting the budget. Ours scores 25 checks from 0 to 2 across 5 areas: strategy and ownership, data, systems, people, and risk. A total of 20 to 34 out of 50 supports one contained pilot. Below 20, fix ownership and baselines first. Any area under 4 out of 10 caps you at a pilot.
- Published
- Updated
- Reading time
- 11 minutes
- Written by
- The Method Crew
Key takeaways
Score only what you can show. A 2 needs a document, an export or a budget line, not a belief.
Three checks are gates: a named owner with budget, a measured baseline, and 50 to 200 real examples you can export within a week. A 0 on any of them means stop.
Your weakest area matters more than your total. Any area under 4 out of 10 caps you at a single contained pilot.
Most companies scoring 20 to 34 should prove one workflow with human review before funding anything bigger.
The checklist takes 45 to 60 minutes with 3 people in the room. Pay for an outside assessment only when they disagree or the stakes are high.
What does "ready for AI" mean in practice?
A company is ready for AI when it can name a specific workflow, measure how that work is done today, hand a builder real examples within a week, and point to one person who will decide whether the result is good enough. Everything else in this checklist is detail under those 4 conditions.
Most readiness frameworks measure maturity: culture, vision, data strategy, an innovation roadmap. Those matter over years. They don't tell you whether the invoice intake project on your desk will work by March. We wrote this checklist for the narrower question a COO has to answer: if we fund a build this quarter, what will stop it?
The answer is rarely the model. Current large language models read invoices, draft replies and summarize calls well enough for many business tasks, provided a person checks the output. Projects stall on the unglamorous parts. Nobody owns the outcome. The data sits in a shared inbox that one person understands. The CRM plan doesn't include API access. Legal hears about the project in week 6.
How does the scorecard work?
You score 25 checks from 0 to 2, in 5 areas of 5 checks each, for a maximum of 50. A 0 means no, a 1 means partly or informally, and a 2 means yes and you can show it.
That last condition is what makes the scorecard worth filling out. A 2 needs evidence you could hand to an outsider: a written policy, a data export, a budget line, a name on an org chart. "We're pretty good on data" is a 1 at best. Self-assessments drift upward when nobody asks for proof, and an inflated score sends you into a build that fails for reasons you could have found in an afternoon.
Fill it out with 3 people in the room: the executive who would own the outcome, the operations lead who runs the workflow, and whoever administers your core systems. It takes 45 to 60 minutes. Where 2 of them score the same check 2 points apart, write the disagreement down. It is a finding.
Three checks are gates, marked in the tables below. A 0 on any gate means stop and fix it before you spend on a build, whatever your total says.
Strategy and ownership: who is accountable for the result?
This area tests whether anyone will decide, fund and judge the work. Weak scores here kill more projects than weak data, because a pilot without an owner never gets a go or no-go decision.
| # | Check | 0 points | 1 point | 2 points |
|---|---|---|---|---|
| 1 | A named executive owns AI outcomes (gate) | Nobody, or a committee | Owner named, no budget authority | Owner with budget and a quarterly review on the calendar |
| 2 | You can name 3 to 5 workflows you want changed | "Use AI across the business" | Departments named, workflows vague | Workflows named, each with the team that runs it |
| 3 | Each candidate workflow has a measured baseline (gate) | No numbers | Estimates from memory | Volume, minutes per item and error rate from system data or a timed sample |
| 4 | A success bar and a stop rule are agreed before building | Neither | Success bar only | Both written down and signed off by the owner |
| 5 | The budget covers running costs as well as the build | Build cost only | A rough monthly figure | Approved monthly budget for model usage, hosting and maintenance |
Check 3 is the easiest one to score generously. "The team spends a lot of time on invoices" is not a baseline. "1,400 invoices a month at 7 minutes each, with 3% keyed wrong" is. Our guide to measuring AI automation ROI shows how to take that measurement in 2 weeks.
Data: can a pilot get real inputs within a week?
This area tests whether the information a workflow needs can be reached by software, and whether you know which parts of it are sensitive. You don't need a data warehouse. You do need to know where things live and who is allowed to touch them.
| # | Check | 0 points | 1 point | 2 points |
|---|---|---|---|---|
| 6 | The data each workflow needs sits in systems you can query or export | Paper, personal inboxes, spreadsheets on laptops | Some in systems, some not | All in systems, with access confirmed by an admin |
| 7 | Documents the workflow reads live in one place with current versions marked | Scattered, many duplicates | One location, versions unclear | One source per topic, each with an owner |
| 8 | Someone owns the quality of key fields such as customer, product and status | Nobody | Informal cleanup when something breaks | Named owner and a fix process |
| 9 | Personal, confidential and regulated data are defined as data classes | Not defined | Understood but not written | Written classes that staff can look up |
| 10 | You can export 50 to 200 real examples for a pilot within a week (gate) | Not possible | Possible with effort or approvals | Sample can be exported now |
Check 7 carries the most weight if you plan a knowledge assistant built on retrieval-augmented generation. Duplicated and outdated documents are a common reason a RAG assistant gives confident wrong answers, and cleaning them up is usually the longest task in the schedule. Our RAG build guide covers that cleanup. If you aren't building an assistant, score check 7 on whatever documents your chosen workflow reads, such as price lists or a policy manual.
Systems and integrations: can software reach the work?
This area tests whether an automation can read from and write to the tools your team already uses. Problems here tend to surface late, often when a vendor's API turns out to require a higher plan tier or an admin nobody can reach.
| # | Check | 0 points | 1 point | 2 points |
|---|---|---|---|---|
| 11 | Core systems (CRM, accounting, helpdesk, email) offer API access on your current plan | Unknown, or no API | API exists, plan or admin access unclear | Confirmed, with admin access available |
| 12 | There is an inventory of the tools in use and who administers each | None | Partial list | Current list with owners |
| 13 | Credentials and service accounts are company-owned | Personal logins everywhere | Mixed | Company accounts with shared admin access |
| 14 | A place to run automations exists or is approved | None | Trials on personal accounts | An approved platform such as n8n, Make or Zapier, or a cloud account, owned by the company |
| 15 | Someone in-house can read a run log and restart a failed run | Nobody | One person, undocumented | Two people, with written steps |
Check 14 is cheap to fix. If your team is choosing a platform, our comparison of n8n, Make and Zapier sets out the pricing models and where each one fits. Check 15 matters more than it looks. Every automation fails at some point, and a system that only its builder can restart is a liability the day that builder is on vacation.
People and skills: who will check the output?
This area tests whether the people who do the work today will help build its replacement, and whether anyone can say what a correct output looks like. AI output needs a reviewer for the first months at least, and the people running the process now are the right ones.
| # | Check | 0 points | 1 point | 2 points |
|---|---|---|---|---|
| 16 | The team doing the work has time allotted to the project | No time set aside | Ad hoc | 2 to 4 hours a week per person during the build, agreed with their manager |
| 17 | A process owner can define a correct output and will review results | Nobody | Someone, without authority to decide | Named owner with authority to approve or reject |
| 18 | Staff are trained on approved AI tools and know what they must never paste into them | No training | Informal guidance | Training delivered and recorded |
| 19 | Managers have decided where freed hours will go | Not discussed | Discussed loosely | Named work that the freed time moves to |
| 20 | You know which AI tools staff already use | No idea | Anecdotes | A survey or log review in the last 6 months |
Check 19 looks like a finance question. It sits here because freed time that nobody plans for gets absorbed into longer meetings and slower email, and the project then shows no return. Check 20 is about honesty. In Microsoft and LinkedIn's 2024 Work Trend Index, 78% of AI users said they bring their own AI tools to work (Microsoft, May 2024 (opens in a new tab)), and finding out how much of that happens in your company tells you both where the demand is and where the data risk is.
Risk, security and policy: what are you allowed to do?
This area tests whether the rules are written down before the build starts. None of these checks need a lawyer to start, though a couple of them end with one.
| # | Check | 0 points | 1 point | 2 points |
|---|---|---|---|---|
| 21 | A written AI acceptable use policy that staff have read | None | Draft, or published but not acknowledged | Published, acknowledged and reviewed in the last 12 months |
| 22 | Written rules say when a human must approve AI output | None | Case by case | A rule covering anything that touches customers, money or official records |
| 23 | Each AI vendor is reviewed for data retention and training use | Not reviewed | Reviewed informally | Written review on file per vendor |
| 24 | You know which regulations apply to each AI use case | Unknown | General awareness | Written list per use case, checked by counsel where needed |
| 25 | Someone will own monitoring after launch: errors, cost and misuse | Nobody | The builder, informally | Named owner with a monthly review |
If check 21 scores 0, start with our AI acceptable use policy template. For check 22, the usual pattern is human-in-the-loop approval on any step that sends, pays or files. For check 25, the OWASP Top 10 for LLM Applications (opens in a new tab) (2025 edition) is a practical list of what to watch, starting with prompt injection and sensitive information disclosure. The controls themselves are AI guardrails: input filters, output checks and limits on what the system is allowed to do.
How do you read your score?
Add the 25 scores for a total out of 50. Before you trust the total, check 2 things: whether any gate scored 0, and whether any single area scored under 4 out of 10. Either one overrides the total.
| Total | What it means | What to do |
|---|---|---|
| 0 to 19 | Not ready to build. Money spent on a build now mostly pays for discovery | Fix ownership and baselines, publish the policy, train the team |
| 20 to 34 | Ready for one contained pilot on one workflow, with human review on every output | Pick the workflow with the best baseline and run a 2 to 3 week pilot |
| 35 to 44 | Ready for production builds on 2 or 3 workflows, including AI agents or a knowledge assistant | Fund a sequenced program with a monthly run budget |
| 45 to 50 | Rare, and worth a second look at the evidence behind every 2 | If it holds, your constraint is choosing what to build, not readiness |
The floor rule: an area score under 4 out of 10 caps you at the 20 to 34 band, whatever your total. A company with 41 points and a 3 in systems will hit the systems problem in week 2 of a production build. We would rather you hit it in a pilot that costs a fraction as much.
The gates trump everything. A 0 on check 1, 3 or 10 means no owner, no baseline or no sample, and any of those makes a pilot impossible to judge. A pilot nobody can judge drifts for months.
What should you do next at each score?
Below 20, spend on foundations instead of a build. A half-day AI workshop for the leadership team ($3,000 to $6,000 with us) and a published policy will move checks 1, 2, 18 and 21 within a month. Take the baseline measurements yourself. All they need is a stopwatch and a spreadsheet.
At 20 to 34, choose one workflow and prove it. A good first candidate has high volume, a clear definition of correct, and an output that can be reversed: draft replies, invoice extraction with review, lead enrichment. The invoice processing pipeline blueprint shows the second of those in full, with its build time, price and review step. Our AI automation builds for a single workflow run $4,000 to $10,000. If a rule-based automation does the job, we build that instead, because it is cheaper to run.
At 35 to 44, plan a sequence. Order workflows by value and by dependency; the CRM cleanup goes before the sales agent that depends on it. This is where a corporate AI consulting engagement is worth paying for: $12,000 to $40,000 per phase for the roadmap, vendor decisions and the first builds. Companies that want an AI lead in their leadership meetings every month use a fractional AI lead instead, from $4,000 a month.
At any score, get an outside view if the 3 people in the room disagreed on more than 5 checks. Our AI readiness audit runs this same scorecard with evidence behind every score: interviews, a review of systems and access, sample data pulls and a ranked list of opportunities with cost and effort. The snapshot version takes 1 to 2 weeks and costs $3,000 to $5,000. The full audit takes 3 to 4 weeks and costs $7,500 to $15,000.
How does this compare to NIST AI RMF and ISO/IEC 42001?
This checklist answers a short-range question: can you start a build this quarter? It is not a governance framework and it won't satisfy an auditor. If you are large, regulated or selling AI products, use the formal frameworks as well.
The NIST AI Risk Management Framework (opens in a new tab), released in January 2023, organizes AI risk work into 4 functions: Govern, Map, Measure and Manage, with a Generative AI Profile (NIST AI 600-1) added in July 2024. ISO/IEC 42001 (opens in a new tab) is a certifiable management system standard for organizations that develop or use AI. Both ask for more than a company with 10 to 500 staff needs before a first project. Read them before your third. Our checks 21 to 25 map loosely onto NIST's Govern and Manage functions and are a floor.
When is a readiness assessment a waste of money?
When you already know the answer. If you have a named workflow, a measured baseline, a sample you can export and an owner who will judge the result, skip the assessment and go straight to a pilot. A paid audit would tell you what you already know.
It is also wasted when the decision has already been made. If the board has committed to a specific vendor or project, an assessment turns into a justification exercise. Spend the money on the pilot and measure it honestly.
Companies with fewer than about 10 staff rarely need one either. The owner knows where the hours go.
Finally, the scorecard can't tell you whether a specific idea is worth doing. A company can score 44 and still pick a workflow that saves 6 hours a month. Readiness and value are separate questions, and the second one needs its own arithmetic, which is what our ROI guide covers.