What an AI readiness assessment inspects

Leaders who commission an AI readiness assessment usually want to hear that the pilot can start on schedule. A useful assessment checks preconditions in four areas, data, systems, people and governance, and it matters because a pilot launched without them tends to stall or be retired.

What does readiness actually mean?

AI readiness is usually asked about in the hope of a particular answer: leadership wants to hear that the organisation is close, so that the pilot can start on schedule. Readiness is duller than that. It is a set of preconditions that can be inspected, most of which have nothing to do with which model to choose, and an assessment is worth commissioning only if it is allowed to report that some of them are absent.

What does the assessment check in your data and systems?

The inspection starts with data, and with its meaning before its volume. For each dataset a proposed use case depends on, an assessor wants to know whether a data dictionary (a list of what each field means) exists and whether it matches the tables; whether the same customer, patient or supplier appears once or three times across systems; whether the fields that matter are filled consistently or left blank after the second screen of a form; whether the history goes back far enough to learn from; and whether the records are structured at all or are scanned documents, sometimes in more than one language, that will need extraction before anything else. It also asks who owns each dataset, which is a governance question in a data question’s clothes. Messy data does not disqualify an organisation. It changes what the first project should be, and it is often the first project.

Systems come next, because a model that cannot reach the data or be reached by its users is a demonstration. The questions are practical: whether there is an interface to the system of record or only a nightly export; whether the organisation has a single sign-in system that a new application can use; whether there is an environment a pilot can run in, with the security team’s approval path for a new system already known; whether servers can run where the data’s classification requires (the organisation’s own premises, a chosen cloud region, or private GPUs), or whether that has to be procured first; and whether the existing systems produce logs, because without logs there is no audit trail, and without an audit trail there is no defensible AI system. Where a security framework or a regulator already sets expectations on identity, logging and hosting, readiness means those controls are in force in the environment where the pilot will live.

Who has to be in place on your side?

People are assessed for capacity and for ownership. Capacity means an engineer or analyst on the client side who works alongside the build and takes the system over at handover, with the hours genuinely freed in their week. Ownership means a named business owner for each use case, who decides what a good output looks like and is accountable for what the system produces once it is live. Sponsorship sits above both: an executive who will still be answering questions about the pilot in its fourth month, when the launch attention has moved on and the unglamorous fixes are what remains. A technically sound pilot without that person stalls.

What governance has to exist before launch?

Governance is the area organisations most often skip, because it is less interesting than model selection and because it is assumed to belong to another department. The inspection is concrete: whether an AI policy exists and names who approves a system before it goes live; whether there is a list of the AI models in use, or nobody could name the AI systems already running; whether a data protection officer has been appointed where the applicable data protection law requires one, and whether an impact assessment has been done for any use case that touches personal data; and whether a person can overrule the system, with a path for raising problems that ends at a named person. Widely used AI ethics principles set out what is expected on accountability, transparency and human oversight, and a readiness assessment checks whether the organisation’s structure could meet them for this specific system. Immature governance does not disqualify anyone either, but the gap has to be named before launch rather than discovered after it.

When is the right answer to wait?

Sometimes the finding is that the organisation should wait. The signs are recognisable: a dispute over who owns the underlying data that nobody has resolved; a use case nobody will be accountable for; a workflow that a well-built spreadsheet or a scheduled report would serve better than a model; a data pipeline that has to be repaired before any model could learn from it. Naming these before the engagement starts is the job. A proper list of possible uses scores each one for value, feasibility and risk, and records the ones we advise against alongside the ones we recommend.

What an assessment should produce is a staged plan the organisation can stop at any phase, with a price for each phase and the preconditions for the next one stated. If the finding is that six months of data work come before any model, that is the plan, and it is worth more than a pilot that launches on schedule and is quietly retired a year later. Our AI strategy and governance page shows how we start this work.