AI Readiness Assessment Checklist

An AI readiness assessment checks whether your organization can take an AI use case from idea to production without stalling on data, access, people, policy, security or money. This checklist has 30 points across those six dimensions. Score each point 0, 1 or 2, add them up, and you have a readiness score you can act on, whether you are a founder with one product, a growing company with a backlog of ideas, or a department inside a larger organization that must pass security and procurement review. Assess for one specific use case first; organization-wide readiness is the sum of several of these, not a prerequisite for starting.

Six dimensions

AI projects rarely fail on the model. They fail on the things around it. The six dimensions below cover those things in the order they usually bite.

Dimension	What it covers	Typical blocker
Data	Availability, quality, ownership, labels, retention	Nobody can approve use of the data, or the correct answers are not recorded anywhere
Systems	APIs, identity, cloud, integration surfaces, environments	The system of record has no API and a shared login
People	Owner, reviewers, skills, change appetite, executive sponsor	No one owns the system after launch
Governance	Policy, inventory, risk assessment, vendor review, decision rights	The first AI policy is written after the pilot is already running
Security	Data terms, secrets, logging, access control, privacy	Provider terms never reviewed; prompts contain personal data nobody redacted
Budget	Build cost, run cost, review cost, licenses already owned	Run cost discovered at the first full-volume invoice

The 30 points

Score each point: 0 means no or unknown, 1 means partly or informally, 2 means yes and documented. Be honest; the score is for you.

Data (points 1 to 5)

1. The input data for the use case is identified, and we know which system holds it.
2. Someone with authority has confirmed the data may be used for this purpose, including any consent and retention rules.
3. We can reach the data through an API, a database connection or a scheduled export without manual copying.
4. We have, or can quickly build, a labeled sample of real inputs with correct outputs (a golden set) agreed by the people who do the task today.
5. Data quality for the fields that matter is known: completeness, duplicates, formats, and how often the ugly cases occur.

Systems (points 6 to 10)

6. The systems the AI must read from or write to have APIs or supported integration paths; where they do not, we know whether RPA or an export is acceptable.
7. Identity is managed centrally (single sign-on), so an AI feature can act with a user’s permissions rather than a shared account.
8. We have a cloud environment, or an approved path to one, where models can be called and data can be processed in the required region.
9. We have separate development, test and production environments and a way to deploy changes with version control.
10. Logging and monitoring exist for the applications involved, so AI requests can be traced alongside everything else.

People (points 11 to 15)

11. A named person will own the AI system after launch, including the prompts, the knowledge base and the review queue.
12. Reviewers are identified for the output, and their time is budgeted.
13. An executive sponsor has agreed the success criteria and will accept a stop decision if the numbers say so.
14. The team affected by the change has been involved in choosing the use case and knows what will change for them.
15. We have, or have access to, the skills to design evaluation and integrate models, in-house or through a partner.

Governance (points 16 to 20)

16. An acceptable-use policy for AI exists and has been communicated, covering approved tools, data that may not be entered, and review requirements.
17. There is an inventory of AI systems in use or planned, with purpose, data, model, vendor, risk rating and owner.
18. A risk assessment method exists for AI use cases, proportionate to the consequence of a wrong output.
19. Vendor and model review is defined: who checks the data terms, who approves, and how often it is revisited.
20. Decision rights are clear: who can approve a new use case, who can switch one off, and who answers for it.

Security (points 21 to 25)

21. The model provider’s terms for training on customer data, retention, region and sub-processors have been reviewed for the route we will use.
22. API keys and secrets are stored in a vault, rotated, and never placed in prompts, code or shared documents.
23. Personal and sensitive data is minimized or redacted before it reaches a model, and we know which data classes are in scope.
24. Prompts, retrieved context, outputs and tool calls are logged with access controls and a retention period.
25. Defenses for prompt injection and content filtering are planned for any AI feature that reads untrusted documents, email or web pages.

Budget (points 26 to 30)

26. The build cost for a proof of concept and a pilot is approved.
27. The run cost per task at full volume has been estimated from the model tier, tokens and steps involved, not guessed.
28. The people cost of review and ownership is included in the business case.
29. Licenses already owned (Microsoft 365 Copilot, Google Workspace, your CRM or helpdesk vendor’s AI features) have been checked before buying something new.
30. A stop rule exists: the number below which the proof of concept is ended rather than extended.

Scoring your AI readiness assessment

Add the points per dimension (maximum 10 each) and overall (maximum 60). Use the per-dimension scores to find what to fix; use the overall score to decide how to proceed.

Overall score	Reading	Sensible next step
45 to 60	Ready for this use case	Build the golden set if it is missing and start a timeboxed proof of concept
30 to 44	Ready with fixes	Close the zeros in data, security and governance, then run the proof of concept in parallel with the rest
15 to 29	Not yet	Pick a narrower use case, or spend a short sprint on data access, ownership and policy before building anything
0 to 14	Foundations first	Start with data governance and a basic AI policy; an AI proof of concept now would stall

Any dimension scoring 3 or less is a blocker regardless of the overall score. A high total with a zero in security, for example, is not readiness; it is a project that will stop at the first review.

What to fix first

Fix in this order, because each step removes a blocker for the next.

1. Ownership (points 2, 11, 13). Nothing moves without someone who can approve data use, someone who will own the system, and a sponsor who accepts the success criteria. These are conversations, not projects, and they can be done this week.
2. Data access and the golden set (points 3, 4, 5). Getting to the data and recording correct outputs is the longest lead item in most organizations. Start it before anything else, and keep the golden set small but real. Our guide to data governance for AI explains why this is the prerequisite most teams try to skip.
3. Policy and inventory (points 16, 17, 19). A one-page acceptable-use policy, a spreadsheet inventory and a named approver are enough to start. They can mature later; see what AI governance is for the full picture.
4. Provider terms and secrets (points 21, 22, 23). Choose the route (for example an enterprise API tier, Azure OpenAI, Vertex AI or a cloud marketplace) whose terms you can accept, put keys in a vault, and decide what gets redacted.
5. Run-cost estimate and stop rule (points 27, 30). A rough estimate of tokens per task times volume, and a written number at which you stop, protect the budget from a pilot that never ends.

Everything else can be fixed during the proof of concept. Readiness is not a gate you wait behind; it is a list of things that would otherwise surprise you later. The step-by-step method in how to implement AI in your business picks up from here.

Where PS3G fits

PS3G runs AI readiness assessments as part of its AI consulting service, using this checklist as the starting point and adding interviews, system checks and a review of your data and provider terms. The output is a scored report with the blockers for your first use case, a fix-first plan, and, where you want it, a fixed-scope proof of concept designed around the result. The engineers who would build the use case take part in the assessment, so the recommendations are things that can be built. We ship AI features inside our own HIPAA-compliant EHR and telehealth platform, DocVilla, so the governance and security points above reflect what we practice on our own product. Engagements start with a first conversation.

Related reading

• How to Implement AI in Your Business (Without Dead Pilots)
• Data Governance for AI: The Prerequisite Nobody Wants to Fund
• What Is AI Governance? A Practical Guide for Any Size of Organization
• AI consulting services

Frequently asked questions

What is an AI readiness assessment?

A structured check of whether an organization can take an AI use case to production: whether the data is accessible and usable, the systems can be integrated, people are in place to own and review the system, policy and governance exist, security requirements are met, and the budget covers build, run and review costs. It produces a score and a list of blockers to fix before or during a proof of concept.

Should we assess the whole company or one use case?

One use case first. Organization-wide AI readiness is abstract and tends to produce long reports and no action. Assessing the data, systems, people, governance, security and budget for a single use case produces a short list of concrete fixes and a proof of concept you can start. Repeat the assessment for the next use case; the second pass is faster because most fixes carry over.

How often should the AI readiness checklist be repeated?

Before each new use case, and once a year for the governance and security dimensions, because provider terms, regulations and your own systems change. A repeat assessment should take much less time than the first, since the inventory, policy, secrets handling and evaluation pipeline already exist. Treat a falling score in any dimension as an early warning rather than a formality.

Can a small business score well on AI readiness?

Yes, often better than a larger one on people and governance, because decisions are fast and ownership is obvious. The usual gaps are data access (information in email and spreadsheets rather than systems) and security hygiene (shared logins, keys in documents). Both are fixable in a short sprint, and a small business can then move to a proof of concept faster than a large organization can clear procurement.

Do we need AI strategy consulting to use this checklist?

No. The checklist is designed to be scored internally in an afternoon by the people closest to the use case. AI strategy consulting helps when the score is contested, when the fixes cross departmental lines, when you need an outside view of provider terms and architecture, or when you want the assessment to flow directly into a proof of concept built by the same team.