AI readiness checklist: is your business ready?

Most AI readiness checklists are written for companies with a Chief Data Officer, a steering committee and an MLOps budget. If you run a 40-person business, half the boxes don't apply and the other half are written in a language nobody in your building speaks.

This AI readiness checklist is the one I'd want if I were the owner signing the cheque. It's short enough to fill in over a coffee and honest enough to stop you buying something you can't use yet.

The short answer: your business is ready for AI when you can name one specific, frequent task you want done better, you can get at the data that task depends on, someone senior owns the outcome, staff have basic rules on what they may put into AI tools, and you've checked the data protection position. You don't need perfect data or an AI strategy deck. You need those five things, for that one job.

Key points:

• Readiness is per use case, not per company. You can be ready for one job and nowhere near ready for another.
• In June 2026, 35% of UK businesses with ten or more employees used some form of AI, but only 10% of those users said they used it extensively (ONS).
• Gartner predicts organisations will abandon 60% of AI projects that aren't supported by AI-ready data, through 2026 (Gartner).
• The weakest area on your checklist sets the pace, not the average.

What does "AI ready" actually mean?

It means you can take a specific task, put AI into it, and have the result survive contact with real customers, real staff and real data.

The UK picture tells you why this matters. According to the Office for National Statistics, AI use among UK businesses with ten or more staff rose from around 12% in late 2023 to around 35% in June 2026. Yet only 15% of those businesses have more than half their people using AI in daily work, and only 11% have trained more than half their workforce.

Plenty of companies have "adopted AI" in the sense that somebody has a licence. Far fewer have changed how work gets done. Having a ChatGPT login is not the same as being ready.

The AI readiness checklist: 20 questions

Answer each one yes, partly or no. Be harsh. "We could probably find that data" is a no.

Prefer to answer on the page? Try the self-assessment. Question 20 is the one almost every checklist leaves out. Kill criteria are far easier to agree before you've spent the money than after.

How do you score an AI readiness assessment?

Plenty of AI readiness frameworks and assessment tools will give you a score out of 100 with weighted pillars. The weights are usually invented, and the false precision makes people argue about decimals instead of fixing gaps.

I use a cruder rule. Group your answers into the six areas above and give each area a colour:

• Green: all yes. Proceed.
• Amber: any "partly", no hard "no". Proceed, with a named fix and a date.
• Red: any "no". Fix before you spend money on tools or builders.

Then apply one rule: your readiness is your weakest area, not your average. Brilliant data and no owner is red. A keen owner and no data access is red. Averages hide the thing that will kill the project.

Reds in Problem or People call for a scoping conversation before any tool. Reds in Data or Tech call for preparation work. Reds in Rules need the responsible person to assess what is missing. A simple policy may be quick; legal review, supplier checks or a DPIA can take longer.

Is your data good enough for AI?

Probably for some jobs, probably not for others. Gartner's survey of data management leaders found 63% of organisations either don't have or aren't sure they have the right data management practices for AI, and it predicts that through 2026 organisations will abandon 60% of AI projects unsupported by AI-ready data (Gartner). In RAND's interviews with AI practitioners, poor or unsuitable data was one of the two most cited root causes of failure; the other was leaders misunderstanding the problem the AI was meant to solve.

The good news for smaller businesses is that "AI-ready" depends on the job. Drafting proposals from your past proposals needs a tidy folder of past proposals. Forecasting demand needs years of clean sales history. Those are wildly different bars.

For any single use case, check four things:

• Location: where does the data live, and who can export it?
• Quality: would you trust a new hire to work from it without asking questions?
• Sensitivity: does it contain personal data, client confidential material or anything under NDA?
• Freshness: is it updated as part of normal work, or only when someone remembers?

If the answer to the quality question is "only if they asked Sarah first", your data lives partly in Sarah's head. That's normal. It also means Sarah needs to be in the project.

Do you need a DPIA before using AI?

Assess the processing case by case. The ICO says AI will often involve high-risk processing that requires a DPIA. If you conclude yours does not, record the reasons. If a DPIA identifies high residual risk you cannot reduce, consult the ICO before processing.

Worth knowing: the ICO's AI guidance is marked as under review following the Data (Use and Access) Act, so check the current version before you rely on any detail. The DPIA principle isn't going away.

A DPIA should be proportionate to the processing and its risks. There is no useful page-count shortcut. Record what goes in, who can access it, how people could be affected and how those risks will be controlled.

If you trade into the EU, or deploy AI that touches EU customers, there's a second layer. I cover that in what UK businesses need to do about EU AI Act compliance.

Do you need to be fully ready before you start?

No. Waiting for company-wide readiness is how businesses spend two years preparing and never ship anything.

What you need is readiness for the first use case, plus a list of what's red for the next ones. The first small project then becomes part of your readiness work. You'll learn more about your data in a six-week AI proof of concept than in six months of auditing.

The exception is Rules. Your staff are almost certainly already pasting things into AI tools, sanctioned or not. A one-page usage policy and a short training session should happen this month, whatever else you decide. The guide to AI training for employees covers what that training should include.

What I've seen in practice

The readiness gap is rarely technical. A failure pattern to watch for: a business assumes its problem is data or software, and the real blocker is that nobody has the time or authority to change the process. Technology is usually the easier part to fix.

Shadow AI is the readiness signal nobody measures. If staff are quietly using personal AI accounts for work, that tells you two things. There's real demand, and you have an unmanaged data risk. Both are worth knowing before any vendor demo.

Approval gates matter more than clever models. In Ascendancy IQ, my own lab of AI agents doing real work, the parts that took the most thought weren't the models. They were the rules about what an agent may do alone, what needs a human to approve, and what gets logged. Smaller businesses need the same thinking, at a smaller scale.

Assessments that end in a report usually end there. My take: if your AI readiness assessment doesn't finish with one named use case, one owner and one start date, it was a research exercise. Useful, maybe. Not readiness.

How to run an AI readiness assessment in a week

1. Day 1: list ten candidate tasks with the people who do them. Keep the three that are frequent, measurable and low risk.
2. Day 2: for each of the three, write down where the data lives and who can export it. Pull a real sample.
3. Day 3: run the 20 questions for each candidate. Colour the six areas green, amber or red.
4. Day 4: check the rules: draft or update your AI usage policy and start a DPIA for the front-runner.
5. Day 5: pick one use case. Name the owner, the budget for 90 days, the success measure and the result that would make you stop.

Then move to implementing AI in your business for that one use case, and keep the reds on a list. If the week shows you're nowhere near ready, that's a good result too: far cheaper to learn now than after a build. For what goes wrong when people skip this step, read why AI projects fail.

Frequently asked questions

What is an AI readiness assessment? It's a structured check of whether your business can use AI for a specific purpose and get value from it. It looks at the problem, data, people, rules, technology and budget, and ends with a decision about where to start.

How long does an AI readiness assessment take? For a small or mid-sized business focused on a handful of use cases, a week of part-time effort is enough to reach a decision. Large organisations assessing every function take longer, often because of the number of stakeholders rather than the analysis.

What is the difference between AI readiness and AI adoption? Readiness is whether the conditions for success exist. Adoption is whether people actually use AI in their work. Limited daily use does not itself prove unreadiness: a specialised use case may only need a few trained users.

Is there a free AI readiness assessment template? Use the interactive self-assessment, or copy the 20-question table into a spreadsheet and apply the same rule. Many free vendor templates are built to lead to their own product.

Sources

• Artificial intelligence in UK businesses: 2023 to 2026, Office for National Statistics, July 2026
• Lack of AI-ready data puts AI projects at risk, Gartner, February 2025
• The root causes of failure for artificial intelligence projects and how they can succeed, RAND Corporation, 2024
• What are the accountability and governance implications of AI?, Information Commissioner's Office

If you've run the checklist and want a second opinion on where to start, or what to fix first, let's talk.