AI Readiness Assessment: A One-Page Checklist for Small Business

An AI readiness assessment should tell you which task you can safely try next, not award your company a badge. Score 15 questions across five areas, check the stop conditions, and use the result to choose your next 90 days. For a company with 10-200 people, the useful answer is specific: ready for this workflow, with these controls, or waiting on these fixes.

Start With One Workflow, Not a Company-Wide Verdict

Assess the work you want AI to help with before assessing the whole business. A company might be ready to draft internal project updates and unready to let software send client commitments. Those decisions need different evidence, even when the people and tools are identical.

Think of readiness as checking a vehicle for a particular journey. Having the keys does not tell you whether the brakes work or whether the vehicle suits the route. An AI subscription is the keys. Your data, access, reviewers and operating rules determine whether the trip makes sense.

Choose a recurring task with a visible input, an output someone can check, and an owner. “Improve operations” is too broad. “Draft the weekly project update from approved notes, with the project manager checking it before sending” is assessable.

This worksheet is designed for a small, supervised trial of everyday work. Decisions affecting hiring, credit, health, safety or legal rights need a separate assessment by people qualified for that context. A high score here does not authorize those uses.

The owner or COO chooses the outcome and accountable person. The IT lead checks permissions and settings. The person doing the task explains the exceptions and judges whether the output is useful. In a small company, one person may hold several roles, but none of the checks disappears.

AI Readiness Assessment: The Copyable One-Page Version

Score what you can show today. A policy nobody has read, an administrator setting nobody checked, or a reviewer who has not tried checking an output earns partial credit at most.

The rubric below is this article's planning aid. Its weights and thresholds are editorial choices, not validated predictors, industry benchmarks or a certification test. Each question has equal weight to keep the arithmetic usable; the critical gates stop that simplicity from hiding a dangerous omission.

Copy the worksheet from Task through Next action into a document. Keep the supporting screenshots, sample files and notes in a separate evidence folder so the assessment itself stays compact.

AI Readiness Checklist

Task: __________ Owner: __________ Date: __________

Score each answer: 0 = absent or unknown; 1 = partly evidenced; 2 = fully evidenced for this task. Add a short evidence reference beside each score. If a question contains several checks, all must be met for 2. Each area totals 6; overall total is 30.

A. The work worth automating

• A1. Is there a recurring task with a named owner and clear input and output?
• A2. Have you recorded its frequency, current handling time and common errors from recent examples?
• A3. Have you written what a useful output must contain, with acceptable and unacceptable examples?

B. Data and access

• B1. Are representative inputs current, readable and consistent enough for this task?
• B2. GATE: Have you confirmed permission to use these inputs in this tool for this purpose?
• B3. GATE: Have you checked that users and connections can access only the information this task permits?

C. Tools already paid for

• C1. Have you checked existing subscriptions, included features, available seats and who administers them?
• C2. GATE: Has the administrator approved the exact tool/account and checked its data-handling settings and terms?
• C3. Can the proposed workflow take in the required material and return a usable output without unsupported assumptions?

D. People and skills

• D1. Does someone own the trial, with time allocated and a backup person?
• D2. GATE: Can the named reviewer check facts against sources and spot consequential mistakes?
• D3. Have intended users practiced the task, including how to challenge an answer and report a problem?

E. Risk and policy

• E1. GATE: Are permitted inputs, allowed uses and prohibited uses written down and understood by participants?
• E2. Have you identified who could be harmed by an error and which cases require escalation?
• E3. GATE: Have you practiced human approval, stopping the trial, reporting an incident and returning to the manual process?

Totals: A ___/6 + B ___/6 + C ___/6 + D ___/6 + E ___/6 = ___/30.

Decision: 0-11: repair foundations. 12-21: prepare a bounded pilot. 22-30: run a measured pilot if gates clear. Any gate below 2 blocks live company/customer data and operational use; use synthetic examples only in an approved environment. Any area below 3/6 needs repair before expansion.

Next action: __________ Responsible person: __________ Due date: __________

What Counts as Evidence?

A short note that points to something inspectable is enough. For B2, record which data owner approved the use and what limits apply. For B3, show a permission check using an ordinary pilot user's account, not just an administrator's view. For C2, record the account type, relevant retention and training-use terms, enabled connections and the date checked. “The vendor says it is secure” does not answer these questions.

For D2, have the reviewer compare a draft against its source and identify a deliberately planted factual error. Use a clearly labeled exercise with synthetic material. The point is to verify a checking habit before anyone relies on it.

Unknown means 0, not “probably fine.” If colleagues disagree, use the lower score until evidence resolves the disagreement. Do not award points for plans to fix something next month.

What Your Score Means for the Next 90 Days

Use the band to prioritize work, then apply the gates to decide whether a live trial can begin. These are planning windows, not deadlines that grant permission. If a required fix takes longer, the pilot waits.

0-11: Repair the Foundations

Do first: choose one task and name its owner. If you cannot describe the input, output and person accountable for the result, buying another tool will not resolve the uncertainty.

In days 1-30, gather examples, establish the current process and identify where the data lives. Check existing software and write the basic rules. Choose a lower-risk task if the original one depends on data you cannot use.

In days 31-60, clean a small representative sample, check access and practice with synthetic examples in an approved environment. Give participants a working manual process to return to. The goal is evidence for the unanswered questions, not an impressive demonstration.

In days 61-90, score the same task again. Start a bounded live pilot only after reaching at least the middle band and clearing every gate. Ending the quarter with a documented decision to wait is a useful result if the task is still unsuitable.

12-21: Prepare a Bounded Pilot

Do first: assign an owner and due date to each failed gate. Then fix the weakest area rather than polishing the strongest one.

In days 1-30, finish those safeguards, define acceptable output and record the manual baseline. “Baseline” means how the work performs before the trial, including checking and correction time. An AI acceptable use policy can supply the written rules; adapt it to the actual task and inputs.

In days 31-60, if every gate clears, run the task with two designated users and a reviewer. Keep outputs as drafts until approved. Track total handling time, corrections and exceptions alongside the manual process. If users have not practiced the workflow, train them before starting even if the total is high enough.

In days 61-90, decide whether to keep, change or stop the trial. Repeat the assessment when you change the task, data source, tool or permission scope. Progress means fewer unresolved gaps and better evidence, not merely more users.

22-30: Run a Measured Pilot

Do first: inspect the gates and the lowest area score. A strong total supports a controlled trial; it does not justify automatic sending, unrestricted access or a company-wide rollout.

In days 1-30, agree the acceptance criteria and start a small trial if the gates are clear and participants can perform the task. Keep the reviewer accountable for every operational output. At this stage, test whether the complete workflow is useful, including the human effort around the AI.

In days 31-60, review results weekly. Expand the range of examples before expanding the number of users. A system that handles routine notes may still fail on an ambiguous update, missing source material or a changed client instruction.

In days 61-90, expand only if the workflow meets its written criteria across two consecutive review periods, no unresolved gate remains and every area scores at least 3/6. That is a proposed operating rule for this small trial, not statistical proof of reliability. If checking takes as long as doing the job manually, simplify the task or stop.

A 40-Person Services Firm, Scored End to End

A fictional 40-person services firm scores 18/30, so its first move is to repair the conditions for a pilot. It is not ready to use live project information yet.

The proposed task is an internal project-update draft made from approved project notes. A project manager would verify every factual statement and send the final message. The trial would not send messages automatically, change records or make commitments to clients.

The following evidence and scores are illustrative. They are not client results, a product test or a claim that any particular assistant can complete the task.

The subtotals are work 4/6, data 4/6, tools 4/6, people 3/6 and risk 3/6. The arithmetic is 4 + 4 + 4 + 3 + 3 = 18/30. B2 is the only critical gate already clear.

The COO's decision is: prepare the trial; keep live project data out until the remaining gates clear. The administrator checks B3 and C2. The project manager demonstrates D2. The COO explains the written boundaries for E1 and rehearses approval, incident reporting, stopping and the manual fallback for E3 with the participants.

If those five items each move from 1 to 2, the new score is 23/30. That arithmetic does not erase D3: the users still need practice. Once they complete it and D3 moves from 0 to 2, the total becomes 25/30, with area scores of 4, 5, 5, 6 and 5. All gates are now clear in this hypothetical sequence.

Before its first live draft, the firm must finish the baseline, acceptance examples and C3 input-to-output check, updating those scores only when evidence warrants it. If the tool cannot support the proposed workflow, choose a different task. The firm still has no evidence of hours saved; it must measure that, including the time spent verifying and correcting the draft.

Run the Assessment in One Working Week

Use the week to reach a documented decision, not to promise a completed implementation. The work is collecting evidence from people who already understand the task.

1. 1

   Monday: Choose the task and collect examples

   The owner or COO names the task, its owner and the decision due Friday. Ask the person doing the work for ten recent examples, including awkward cases. Record frequency, time spent and common corrections. This is a practical starting sample, not proof that every exception has been covered.

2. 2

   Tuesday: Check data and actual access

   The IT lead and data owner inspect five representative source documents. Confirm permission for the proposed use and check access as an ordinary pilot user. Look for outdated versions, mixed client folders, personal information and material whose use is restricted. A folder existing does not mean it is suitable to connect.

3. 3

   Wednesday: Inventory tools and current use

   Check the subscriptions the company already holds, the exact account types and who can administer them. Ask staff which assistants, browser extensions or meeting tools they already use for work. Treat that as fact-finding: hidden use cannot be assessed from an invoice list alone. The guide to shadow AI, meaning work use outside approved oversight, helps structure that conversation.

4. 4

   Thursday: Rehearse the people and policy checks

   Set aside an hour for the proposed users and reviewer to practice on synthetic material in an approved environment. Compare a draft with its source, reject an unsupported statement, report a problem and return to the manual process. Score the demonstrated behavior; attendance by itself earns no points.

5. 5

   Friday: Score, decide and assign repairs

   The owner or COO, IT lead and task owner compare evidence, resolve disagreements and total the worksheet. Record the band, failed gates, first action, responsible person and due date. Agree a review date and retain this version so later scores show what changed.

AI Readiness Assessment Tool

A document and spreadsheet are sufficient for this first decision. Keep the question ID, score, evidence reference and next action together. You need a traceable explanation for each answer more than an elaborate dashboard.

For “tools already paid for,” count verified suitability, not the number of subscriptions. An included feature may be unavailable to the intended users, disabled by the administrator or unsuitable for the data involved. Check the actual account and workflow before adding another purchase to the plan.

Use AI tools for small business after the task and constraints are clear. If your shortlist includes Anthropic's Claude, the Claude for small business workflow guide provides ideas to assess. Neither link substitutes for checking your own account, permissions and required outcome.

Where an AI Readiness Assessment Framework Fits

Public frameworks help you deepen the controls after identifying the gaps. The National Institute of Standards and Technology's AI Risk Management Framework, or NIST AI RMF, provides voluntary guidance for managing AI risk; its Playbook groups suggested actions under Govern, Map, Measure and Manage, and explicitly is not a checklist to complete in full. Use it to examine ownership, context, evaluation and responses more carefully. ISO/IEC 42001 specifies requirements for establishing and continually improving an AI management system, meaning the organization's policies, responsibilities and processes for AI. It is relevant when you need that formal organizational structure. These public pages were verified on 23 October 2026. This worksheet is an original planning aid, not a NIST assessment, an ISO conformity assessment or evidence of certification; use the small-company AI governance framework to turn its findings into named responsibilities and decision rules.

What's Overhyped About AI Readiness?

A precise-looking score can conceal a vague answer. An 18/30 grounded in evidence is more useful than a confident 28/30 based on guesses. The bands help organize work; they do not measure a universal property of your company. Do not convert the total into a percentage and describe the business as “that percent ready.”

More tools do not fix unclear work. A task with no agreed definition of a good result remains hard to assess after a new subscription arrives. The same applies to source material that contradicts itself. Sometimes the first improvement is a standard intake form or a clearer approval process.

Passing the assessment does not establish the benefit. Readiness asks whether the conditions for a sensible trial exist. The trial asks whether the workflow improves the job. Measure preparation, review, correction and exception handling alongside generation time. A fast draft that takes longer to verify can still be a poor choice.

The score does not authorize autonomy. Moving from “draft for a person” to “send without approval” changes the workflow and its consequences. Reassess it. So does giving the same assistant access to another department's files. Even 30/30 cannot make a new permission or a new use case inherit evidence it never had.

Frequently Asked Questions

What is a readiness assessment?

A readiness assessment compares current evidence with the conditions needed for a specific next step. For AI, that means checking the work, data, tools, people and operating rules, then recording what can proceed and what must be fixed. The useful output is a decision with owners, not just a score.

AI readiness assessment PDF

Copy the one-page worksheet into your document editor and export or print it as a PDF. Keep the evidence notes separately and retain an editable copy for rescoring. The full questions and scoring rules are on this page; no assessment form or email submission is required.

The Monday Move

Book the assessment with the person who owns one recurring task and whoever administers its data and tools. Ask for recent examples before the meeting. By Friday, complete this sentence: “We can trial this workflow under these limits, after these named gaps are closed.” If you cannot finish it, make the missing evidence the next action.

For practical guides to choosing and running AI workflows, subscribe to the newsletter.