Quick answer: An AI readiness assessment evaluates whether an organization can adopt AI successfully by reviewing six areas: business strategy and use cases, data quality and access, technology and integration, security and privacy, people and skills, and governance. For a small business or nonprofit it typically takes 1-3 weeks and produces a scored gap analysis and a prioritized AI roadmap.
Key takeaways
- AI readiness depends as much on data, people and governance as on technology.
- Score six dimensions on a simple 1-4 scale to find the gaps that would block adoption.
- Data access and permissions problems are the most common blockers for AI assistants.
- The output should be a short, prioritized roadmap with one to three pilot use cases.
- Readiness is not all-or-nothing; low-risk uses can start while gaps are being closed.
Most AI projects that fail do not fail because the model was not good enough. They fail because the data was scattered, permissions were a mess, nobody owned the project or staff did not trust the output. An AI readiness assessment finds those problems before you spend money on tools. This guide explains how to run one for a small business or nonprofit and is part of our AI consulting series.
What is an AI readiness assessment?
An AI readiness assessment is a structured review of whether an organization has the strategy, data, technology, security, skills and governance needed to adopt AI successfully. It produces a scored picture of strengths and gaps and a prioritized roadmap.
It is different from a technology evaluation. The question is not "Which AI tool is best?" but "What would have to be true for AI to deliver value here, and how close are we?"
Why should small organizations assess readiness first?
Small organizations have less room for failed experiments, so a short assessment protects budget and staff goodwill. It also addresses risks that already exist.
- Shadow AI. Staff are likely already using consumer AI tools, sometimes with sensitive data.
- Oversharing. AI assistants that search company content expose permission problems that were previously hidden.
- Unclear value. Without a baseline, nobody can tell whether a tool is worth its license cost.
- Change fatigue. A failed rollout makes the next attempt harder.
What six dimensions does an AI readiness assessment cover?
Assess six dimensions, each scored from 1 (not ready) to 4 (ready).
| Dimension | Key questions | Signs of readiness |
|---|---|---|
| Strategy and use cases | Do we know which business problems AI should solve? Is there an executive sponsor? | Named sponsor, three or more concrete use cases with owners |
| Data | Is data accurate, current, accessible and labeled? Do we know where sensitive data lives? | Central, well-organized repositories with clear owners |
| Technology | Are core systems cloud-based with APIs? Is identity centralized? | Modern cloud productivity suite, single sign-on, integrable systems |
| Security and privacy | Are permissions least-privilege? Is MFA enforced? Is data classified? | MFA everywhere, sensitivity labels, recent access review |
| People and skills | Do staff understand AI basics? Is there appetite for change? | AI champions in teams, leadership modeling use |
| Governance | Is there an AI usage policy, vendor review process and accountability? | Written policy, approved tool list, risk review for new uses |
Total the scores for an overall view, but pay most attention to any dimension scoring 1, because a single weak area can block an otherwise strong plan.
How do you assess strategy and use cases?
Start with business goals, not AI features. Interview leadership about priorities for the next 12 to 24 months, then interview each team about where time goes.
Look for tasks that are frequent, text-heavy, rules-based or repetitive, and where a mistake can be caught before it causes harm. Examples include drafting proposals, summarizing meetings, answering internal policy questions and categorizing requests. Capture each candidate with its owner, frequency, current time spent and risk level. Our list of generative AI use cases for small business is a useful prompt for these conversations.
How do you assess data readiness?
Data readiness is about whether AI can reach the right information and only the right information.
- Location. Where do documents and records live: file servers, SharePoint, Google Drive, CRM, email?
- Quality. Are there duplicate, outdated or contradictory versions of key documents?
- Structure. Is important information in searchable text, or locked in scanned images and personal spreadsheets?
- Ownership. Does each data source have someone accountable for accuracy?
- Sensitivity. Do you know where personal, financial, health or client data is stored?
- Permissions. Do access rights match job roles, or are folders shared with "everyone"?
Permissions deserve special attention. Tools like Microsoft 365 Copilot respect existing permissions, which means they also surface anything users can technically access. The Microsoft 365 Copilot readiness checklist covers this in depth for Microsoft environments.
How do you assess technology and security?
Check whether your environment can support AI tools securely.
- Is your productivity suite (Microsoft 365 or Google Workspace) on a business plan that includes enterprise data protections?
- Is multi-factor authentication (MFA) enforced for all users?
- Are line-of-business systems cloud-based with APIs that AI tools could connect to?
- Are endpoints managed and patched?
- Is there logging that would show who used which AI tool and how?
- Are data sensitivity labels or classifications in use?
If your infrastructure is still largely on-premises, a cloud readiness assessment may be a sensible companion step.
How do you assess people and governance?
AI adoption is a change-management exercise. Assess:
- Current AI usage, including personal tools, through an anonymous staff survey.
- Attitudes, including enthusiasm, anxiety about jobs and concerns about accuracy.
- Who could serve as AI champions in each team.
- Whether leadership is willing to model use and set expectations.
- Whether an AI usage policy, approved tool list and review process exist.
If governance is missing, our AI governance policy template provides a starting point.
What does an AI readiness scorecard look like?
Use this checklist to score yourself quickly. Each "yes" suggests readiness in that area.
- An executive sponsor is named for AI
- At least three use cases have owners and estimated time savings
- Key documents live in a central, cloud-based repository
- Sensitive data locations are known and labeled
- File and site permissions were reviewed in the last year
- MFA is enforced for all accounts
- The organization uses business-grade, not consumer, AI tools
- A written AI usage policy exists and staff have read it
- Staff have received basic AI training
- There is a way to measure time saved or quality improved
Seven or more checks usually means you can pilot confidently. Four to six means pilot low-risk uses while closing gaps. Fewer than four means start with governance, permissions and training.
What should the assessment deliver?
A useful assessment produces a short report, not a binder:
- A scorecard across the six dimensions with evidence for each score.
- A list of gaps ranked by how much they block value.
- One to three recommended pilot use cases with success measures.
- A 90-day roadmap covering quick fixes, governance and pilots.
- A rough budget range for tools and implementation.
How Desai InfoTech runs AI readiness assessments
Desai InfoTech runs assessments through short interviews, a technical review of your data and security configuration, and a working session to agree on pilots. The result is a roadmap you can act on with or without us. Learn more about AI consulting in Seattle or contact us to schedule an assessment.
How to run an AI readiness assessment: step-by-step summary
Define goals and scope
Agree with leadership on the business goals AI should support and which teams and workflows are in scope.
Inventory workflows and use cases
Interview teams to list time-consuming, repetitive and text-heavy tasks that could benefit from AI.
Assess data and technology
Review where data lives, its quality, how it is permissioned and which systems would need to integrate with AI tools.
Review security, privacy and governance
Check identity controls, data classification, current AI usage and whether an AI policy exists.
Assess people and skills
Gauge staff familiarity with AI, change appetite and who could own AI initiatives.
Score and prioritize
Score each dimension, list gaps and produce a roadmap with recommended pilot use cases.
Frequently asked questions
How long does an AI readiness assessment take?
For a small business or nonprofit, an AI readiness assessment typically takes 1-3 weeks. The time is spent on leadership and team interviews, a review of data sources, systems and security controls, and preparing a scored report and roadmap. Larger organizations or those in regulated sectors may need longer for data and compliance review.
Can we assess our own AI readiness?
Yes. The checklist in this article can be completed internally and will surface many gaps. An external assessment adds value through experience with what typically blocks AI projects, an objective view of data and security risks, and practical knowledge of which tools fit which use cases. Many organizations start with a self-assessment and bring in help for the technical review.
What is the most common AI readiness gap?
The most common gap is data access and permissions. AI assistants surface whatever information users can technically reach, so oversharing in file shares, SharePoint sites or Google Drive becomes visible quickly. Other frequent gaps are the absence of an AI usage policy, unclear ownership of AI initiatives and data that is scattered or out of date.
Do we need to be fully ready before using any AI?
No. Low-risk uses, such as drafting non-sensitive content with an approved enterprise AI tool, can start while larger gaps are addressed. What matters is matching each use case to the organization's current readiness. Customer-facing assistants or uses involving sensitive data should wait until data permissions, governance and evaluation processes are in place.
Part of the AI Consulting hub.