Is Your Company Ready for AI? A 25-Point Readiness Assessment

Readiness is the ability to run a controlled experiment and make a credible decision from the result. A company with excellent cloud infrastructure but no workflow owner is less ready than a smaller company with clean support records, a clear escalation process and a manager who owns resolution time.

Statistics Canada reported that cybersecurity or privacy concerns were the leading AI barrier in the second quarter of 2026 at 13.4%, followed by cost at 10.6%. The useful response is not a longer vision deck. It is a bounded use case, approved data, a cost ceiling and evidence requirements.

Award one point for each condition: the workflow repeats at least weekly; inputs and outputs are identifiable; a person owns the result; common exceptions are documented; and success has a measurable business definition. A workflow scores five when a new employee could follow its written path and an experienced reviewer could explain why exceptions occur.

A vague goal such as “improve customer service with AI” scores poorly. “Draft an evidence-linked reply for delivery-status tickets and route low-confidence cases to tier two” is testable. Narrow language exposes the systems, policies and decisions the product must handle.

Give one point each for representative historical examples, known outcomes, documented access rights, usable data quality and a refresh process. Data does not have to sit in one warehouse. It must be retrievable, interpretable and legally usable for the defined purpose.

Inspect 50 to 100 real cases before selecting a tool. Look for missing fields, inconsistent labels, scanned documents, stale policies and outcomes recorded only in employee memory. That sample often changes the architecture and the expected automation rate.

Score identity and access control, usable APIs or exports, a safe test environment, logging and a deployment owner. Avoid giving a model broad credentials because an integration is inconvenient. A pilot should use the same permission boundaries expected in production, even when the interface is temporary.

A five does not require custom infrastructure. A managed product can score highly when it supports required data controls, exportable logs and dependable integration. Custom engineering becomes valuable when the workflow, proprietary context or customer experience creates differentiation.

Give points for an executive sponsor, workflow owner, domain reviewers, technical owner and employee learning time. One person may cover several roles in a smaller company, but the responsibilities must remain explicit. The process owner, not the vendor, decides what an acceptable outcome means.

Microsoft’s 2026 Work Trend Index found organizational factors such as culture, manager support and talent practices accounted for more than twice the reported AI impact of individual factors. Training power users while managers preserve the old metrics creates frustration rather than transformation.

Award points for an approved purpose, data rule, risk classification, human escalation and incident process. These controls can fit on two pages for a low-risk pilot. Their value comes from use during design and release, not document length.

The team should know which actions require approval, who can suspend the system and which records are preserved after a failure. Public-facing, high-impact or personal-data use cases require stronger privacy, legal, security and accessibility review before testing.

A score below 10 means the use case needs discovery before software selection. From 10 to 14, run a short data and workflow study. From 15 to 20, a low- or moderate-risk pilot can begin if no dimension is zero. From 21 to 25, focus on production evaluation and change management rather than more readiness workshops.

Treat a zero as a stop sign. An unavailable data source, absent owner or undefined privacy basis cannot be repaired by a better model. Fix the missing condition or choose a different workflow with stronger foundations.

Choose the highest-value use case scoring at least three in workflow and data readiness. Assign owners, inspect 100 cases, record the baseline, approve permitted data and write ten failure tests. End the second week with a pilot brief containing scope, evidence, budget ceiling, approval points and a decision date.