Most AI projects do not collapse because someone picked the wrong model. They collapse because nobody checked whether the business could absorb the thing before the money was committed. An AI readiness assessment catches that gap early, and it takes days rather than quarters. MIT’s Project NANDA reviewed more than 300 enterprise deployments and found that roughly 95% of generative AI pilots produced no measurable return, and the researchers traced the failures to integration and organizational habits rather than model quality.
So the question worth asking is not which vendor to sign. Instead, ask whether your organization can turn a working model into a changed workflow. Below are the twelve questions we put to clients before any build starts. Answer them honestly and you will know within a week whether to proceed, delay, or fix something else first.
Why an AI readiness assessment beats a vendor demo
Vendor demos run on clean data, a narrow use case, and someone who knows exactly which button to press. Your business runs on none of those things. That gap explains most of the disappointment that follows a signed contract.
Consider the numbers. Gartner surveyed data management leaders and found that 63% either lacked the right data practices for AI or were unsure whether they had them, and predicted that organizations would abandon 60% of AI projects unsupported by AI-ready data. Meanwhile, McKinsey’s global survey shows 88% of organizations using AI in at least one function, yet only about a third scaling it. Adoption is easy. Absorption is not.
An AI readiness assessment forces those constraints into the open while they are still cheap to fix. Run it before procurement, not after the first sprint stalls.
The four dimensions to score
Group the twelve questions into four areas. Each one can sink a project on its own, so a strong average score hides nothing useful. Look at the weakest dimension instead.
- Data and infrastructure. Does the raw material exist, and can the system reach it?
- Business case and value. Will anything measurable change?
- People and process. Will anyone actually use it?
- Governance and risk. What happens when it gets something wrong?
Data and infrastructure: questions 1 to 3
1. Can you name the exact data this use case needs, and does it exist today?
Not “we have lots of customer data.” Name the tables, the fields, and the date range. A support automation project needs resolved ticket histories with outcomes attached, not just ticket volumes. A forecasting model needs consistent definitions of revenue across regions.
Good answer: a named list of sources with row counts and a sample someone has actually opened. Red flag: anyone who answers by describing a system rather than a dataset.
2. Who owns that data, and how long does access take?
Ownership disputes kill more timelines than engineering problems do. Because the data usually sits with a team that gains nothing from your project, access becomes a negotiation rather than a ticket. Find out now whether that negotiation takes two days or two months.
Ask specifically about production access, not sandbox exports. Teams often prove a concept on a stale CSV and then discover the live pipeline requires a security review nobody scheduled.
3. Can the output reach the place where work already happens?
An answer that lives in a separate dashboard gets checked twice and then forgotten. Therefore the integration question matters as much as the model question. If your agents work in Zendesk, the output belongs in Zendesk.
Check whether the target system has a usable API, who maintains it, and whether your IT roadmap already has three projects queued against it. If retrieval over internal documents is part of the plan, our guide to building a RAG pipeline for a business knowledge base
Business case and value: questions 4 to 6
4. Which decision or task changes, and who does it differently on Monday?
Name the role. Name the task. If you cannot describe what one specific person stops doing or starts doing, you have a technology purchase rather than a business change.
This question also exposes scope creep early. Projects described as “improving customer experience” tend to fail. Projects described as “cutting first-response time on tier-one tickets from four hours to twenty minutes” tend to ship.
5. What is the baseline today, and what counts as success at 90 and 180 days?
Measure before you build. Otherwise the review meeting turns into a debate about whether things feel better, and feelings lose budget fights. Write down the current number even if collecting it takes a week.
Set two tiers. Leading indicators show up within a fortnight, such as adoption rate or time saved per task. Lagging indicators land at 90 and 180 days, such as cost per resolution or revenue per rep. Any AI readiness assessment that skips this step leaves the CFO with nothing to approve a second phase against.
6. What is the full cost of ownership, not just the pilot?
Pilot budgets flatter everyone. Real cost includes inference at production volume, data preparation, integration work, monitoring, retraining, and the internal time nobody logs. In practice, data preparation alone consumes a large share of total effort on most projects.
Model the second year, not the first. Costs that look trivial at pilot scale often become the largest line item once volume triples.
People and process: questions 7 to 9
7. Who owns this internally, and can they change the workflow?
A sponsor without authority to redesign a process cannot deliver an AI project, however enthusiastic they are. Because adoption requires telling people to work differently, the owner needs standing with the team whose work changes.
Watch for the innovation-team trap. Projects run entirely by a central innovation function, with no operational owner, stall at handover almost every time.
8. What happens to the people currently doing this work?
Answer this before the rumour mill does. Teams that suspect a tool exists to replace them will find quiet ways to make it fail, and they will be right to protect themselves if nobody has told them otherwise.
Say plainly whether roles change, shrink, or shift toward exception handling. Honest answers survive contact with reality. Vague reassurance does not.
9. How will people learn the tool, and who supports them at week six?
Launch-day training is the easy part. Week six is when the novelty fades, the edge cases pile up, and people quietly revert to the old process. Someone needs to own that period.
Budget for three to five worked examples per role rather than a generic overview session. Teams learn faster from their own use cases, which is also why our primer on prompt engineering for non-technical teams focuses on task patterns instead of theory.
Governance and risk: questions 10 to 12
10. What is the worst realistic failure, and what does it cost?
Every model gets things wrong. So the useful question is what happens downstream when it does. A wrong product recommendation costs a click. A wrong eligibility decision costs a lawsuit.
Map failure cost to oversight design. Low-stakes outputs can run unsupervised. High-stakes outputs need a human checkpoint, and McKinsey found that high performers are far more likely to have defined human-in-the-loop validation than everyone else. Notably, nearly two-thirds of respondents named security and risk as the top barrier to scaling agentic AI, ahead of regulation or technical limits.
11. Where does your data go, and who else can see it?
Trace the path. Which provider processes the request, in which region, under what retention terms, and does anything get used for training? Procurement often assumes answers that the contract does not actually give.
Also check the tools your staff already use without approval. Shadow usage is widespread, and an AI readiness assessment that ignores it measures the wrong organisation.
12. Which regulations apply, and on what timeline?
European exposure changed recently, so check your assumptions. The European Parliament and Council approved the Digital Omnibus in June 2026, which moved Annex III high-risk obligations from 2 August 2026 to 2 December 2027. Many published guides still cite the older date.
That extra runway is not a reason to stop. Rather, use it to build the documentation trail now, while the work is cheap. The NIST AI Risk Management Framework gives you a free, sector-agnostic structure built around four functions: govern, map, measure, and manage. Most mid-market teams can adopt a light version of it without hiring a compliance function.
How to score your AI readiness assessment
Score each question from 0 to 3. Zero means nobody knows. One means someone has an opinion. Two means it is documented. Three means it is documented and tested.
Then read the result by dimension rather than by total, because the lowest dimension sets your actual ceiling.
- 28 to 36: proceed. Build the narrowest useful version and measure it.
- 18 to 27: proceed carefully, with a fixed remediation list running alongside the build.
- Below 18: stop and fix foundations first. Spending now buys a pilot you cannot scale.
- Any single dimension under 5: treat it as a blocker regardless of the total.
Run the AI readiness assessment with the operational team in the room, not just leadership. The gap between what executives believe and what the people doing the work know is usually where the real answer sits.
What to do when the score comes back low
A low score is useful information, not a verdict. Most organizations that score badly on their first AI readiness assessment score well within a quarter, because the fixes are unglamorous and well understood.
Fix in this order
Start with data access, since everything else waits on it. Next, name an operational owner with authority. After that, write the baseline metrics down. Finally, pick a smaller use case than the one you started with.
Shrinking scope is the single most reliable move. A narrow workflow with clean data and a named owner beats an ambitious programme with none of those things, every time. Once the first one works, the second is far easier to fund. Our overview of agentic AI for business leaders covers where those first workflows usually pay off.
Repeat it quarterly
Readiness moves. New systems land, people leave, and regulation shifts. Therefore treat the AI readiness assessment as a recurring check rather than a gate you pass once. Quarterly works well for most mid-market teams.
Run yours before the next budget cycle
Twelve questions, honestly answered, will tell you more about your odds than any vendor evaluation. If you would rather have someone outside the org ask them, we run structured AI readiness assessments for mid-market teams across the US and Europe, and you get a scored report with a prioritised fix list at the end of it.
Book a 30-minute readiness call and bring your most contested use case. We will tell you whether it is ready, and if it is not, exactly what to fix first. You can also read more about our AI and automation consulting work.
Frequently Asked Questions
An AI readiness assessment is a structured review of whether an organisation can successfully deploy and sustain an AI system, covering data availability, business case, people and process, and governance. It happens before investment, and it produces a score plus a remediation list rather than a technology recommendation.
For a single use case, two to three weeks is typical: about a week of interviews, a week of data verification, and a few days to score and write up findings. Assessments covering an entire organisation take four to six weeks, mostly because more stakeholders need scheduling.
Include the executive sponsor, the operational manager whose team’s work changes, someone who owns the relevant data, an IT or engineering representative, and whoever handles legal or compliance. Leaving out the operational manager is the most common mistake, because that is where the honest answers live.
Yes, and many teams do. The main limitation is candour, since internal reviewers rarely tell a sponsor that their favourite project is not viable. If the investment is significant or politically sensitive, an outside reviewer usually surfaces more.
Using the 0 to 3 scale across twelve questions, 28 or above supports proceeding. Between 18 and 27, proceed with a documented remediation plan. Below 18, fix foundations first. Also treat any single dimension scoring under 5 as a blocker, whatever the total says.
It can. The Act reaches providers and deployers whose AI system outputs are used in the EU, regardless of where the company sits. Consequently, US firms serving European customers frequently fall in scope. Confirm your classification with counsel, because obligations differ sharply between limited-risk and high-risk categories.
Quarterly for active programmes, or whenever something material changes such as a new data platform, a reorganisation, or a regulatory update. Readiness is a moving target, so a single annual review tends to miss the changes that matter most.
