AI readiness checklist: what to check before your business spends on AI

What is AI readiness?

You may already have a list of AI ideas: something a vendor demonstrated, something a competitor announced, a staff member who drafts emails with ChatGPT. Before any of them gets a budget, the question is whether the business can support one. AI readiness is that question: whether the work, the data, the systems and the people are in a state where an AI tool could do a real job, and someone could tell whether it did the job well.

Every two weeks, the Census Bureau’s Business Trends and Outlook Survey asks US firms whether they used AI in the past two weeks. As of May 3, 2026, 19.8% said yes, and the share sat between 17% and 20% from December 2025 to May 2026, with 20% to 23% expecting to use AI within the next six months. Size made a difference: in the bureau’s figures, 37% of firms with at least 250 employees reported using AI, against fewer than 20% of firms with four or fewer employees. The bureau reworded the question in November 2025, from AI used in producing goods or services to AI used in any business function, so figures from before then answer a narrower question.

Readiness is judged one task at a time. A company can be ready to use AI on incoming orders and nowhere near ready on pricing.

What should be on an AI readiness checklist?

Eight checks cover most of it. Run them for a single task, such as answering supplier emails or reading incoming purchase orders:

The data and the rules rows carry the most weight. An AI step can only work from what it’s given, so if the details for a task sit in three inboxes and on a whiteboard, getting them into one place is the first project. The rules row matters at any size: decide which customer or staff data may go into an AI tool, who may use which tools, and which decisions stay with a person. Some uses carry legal duties of their own, as the section on AI audits below shows.

Each “not ready yet” goes on the list of what to do first.

How do I know if my business is ready for AI?

Three questions settle most cases:

• The task and its cost: can you say what the task is and what it costs now? “Answering quote requests takes one person most of Monday” is a start. “We want to use AI” isn’t.
• Written instructions: could a new hire do the task from them? If so, there are rules an AI step can follow and a person can check. If the task takes years of experience to judge, start somewhere else.
• Catching mistakes: would you notice if it got something wrong? A person or a check should catch a wrong answer before a customer does.

Signs that it’s too early: the data the task needs isn’t in any system, the people who would own it are already stretched, or the main reason to start is that a competitor announced something. None of those is permanent, and fixing each one pays off with or without AI.

How can businesses evaluate AI readiness?

A checklist answers whether to start. For a structure to keep using once AI is in place, the National Institute of Standards and Technology (NIST) offers its AI Risk Management Framework. It came out on January 26, 2023, is voluntary, and sorts the work into four functions:

• Govern: the policies, roles and culture for managing AI risk. NIST treats it as running through the other three.
• Map: setting out the context, meaning what the system is for, who it affects and where its risks lie.
• Measure: methods, whether numbers, judgment or both, to analyze, benchmark and track those risks.
• Manage: putting resources on the risks that were mapped and measured, on a regular basis, with plans to respond to and recover from incidents.

Under each function sit specific actions, and NIST says they don’t make a checklist and needn’t follow a set order. Once the govern outcomes are in place, it expects most users to start with map and go on to measure or manage. In July 2024 it added a Generative AI Profile, which helps organizations find the risks particular to generative AI and suggests actions for managing them.

For an owner-run business, the four functions come down to four short documents: who decides what AI may be used for, a description of the task and who it touches, how you’ll tell whether it works, and what happens when it doesn’t.

What is an AI maturity model?

An AI maturity model places a company on a ladder of AI use, from first experiments to AI built into how it runs, and describes what moves it up a rung. The MIT Center for Information Systems Research (MIT CISR) published one in December 2024, built on its October 2022 survey of 721 companies:

• Stage 1, experiment and prepare (28% of companies): educating staff, setting rules for acceptable use, making data easier to reach, deciding where people need to stay in the loop and trying things out.
• Stage 2, build pilots and capabilities (34%): piloting use cases and tracking their value, starting to simplify and automate processes, and sharing data through APIs.
• Stage 3, develop AI ways of working (31%): using AI across the company, building for reuse, widening process automation and working in a test-and-learn way.
• Stage 4, become AI future ready (7%): AI part of how decisions are made and processes run, and AI-based services sold to customers.

In MIT CISR’s data, companies in the first two stages had financial performance below their industry’s average, and those in the last two were well above it. Two cautions apply. MIT CISR says that, given when it ran the survey, the results mainly describe analytical, or traditional, AI. And a model built for enterprises fits an owner-run business loosely. Use AI maturity models to see what the next stage asks of you.

What is an AI audit?

“AI audit” is used for two separate jobs, so check which one a proposal means:

• A readiness or opportunity audit: a look at where AI could help, what the data and systems allow, and what to do first. It’s the checklist above, done with outside help.
• An audit of an AI system in use: a review of a live system for bias, accuracy, security or compliance, often measured against a framework such as NIST’s.

The second kind can be a legal requirement. New York City’s Local Law 144 of 2021 is one example. An employer or employment agency there may use an automated employment decision tool only after it has had a bias audit, no more than a year before its use, with information about the audit made public and the required notices given to employees or job candidates. That notice is due 10 business days before the tool is used, and the city began enforcing the law on July 5, 2023.

AI audit software comes in two broad kinds as well. Some tools watch an AI system once it’s live, logging what it was asked and what it answered, and flagging changes. Others are questionnaires that score a business on areas such as data, skills and strategy. Both have their place, but neither can see the workaround that never made it into a system: for that, someone has to talk to the people who do the work.

What data does AI need, and is yours ready?

The data row deserves a closer look, because an AI step works from what it’s given and nothing else. Four questions:

• Location: is it in a system you can export from, or in inboxes, PDFs and paper?
• Consistency: one spelling per customer, the same fields filled in every time, dates in one format.
• Permission: customer contracts, privacy notices and your vendors’ terms can limit what goes into an outside tool.
• History: past cases with known right answers let you check whether the AI gets them right before it handles new ones.

Often, the first piece of work is getting one task’s data into one place and keeping it clean.

What doesn’t make a business ready for AI?

Some moves feel like progress and don’t settle the question:

• A chat tool on every desk: useful for drafting, though a plan needs a task and an owner.
• A strategy deck that names no process: a roadmap has to say which task changes, at what cost, before anyone can build it.
• A pilot nobody owns: a test with no baseline and no one checking it ends without an answer.
• Waiting for perfect data: the data only needs to be good enough for the one task you start with.
• Copying a competitor: what they built fits their own data and their own process.

How do you get a business ready for AI?

1. Pick three candidate tasks: recurring work that follows rules, where a wrong answer can be caught.
2. Run the checklist on each: mark every row ready, nearly or not yet.
3. Write the rules: what data AI tools may see, who may use them and which decisions stay with a person.
4. Fix the weak rows on the best candidate: usually the process or the data.
5. Measure today: volume, time and errors for that task, written down before anything changes.
6. Run one small test with an owner: compare it against the baseline, then widen it, change it or stop.

The what to automate first guide ranks candidate tasks in more detail, including how to work out what each one costs today.

The free AI readiness worksheet takes about fifteen minutes and scores one task you’d hand to AI, on 20 questions about the work, its data, your systems, the people involved and the economics. If you’d like help with the checklist itself, our AI readiness assessment looks at how your business runs and where AI fits: we talk with the people who do the work, map the steps as they really run, and rank the places AI could help by weighing each one’s saving against its cost. We don’t train models, and we don’t build AI to screen job applicants or to make significant decisions about people. Every engagement starts with a 15-minute call.