Many businesses come to AI from the wrong end. Someone sees a tool, buys licences, and three months later usage has faded. The tool did not fit a real process, the data it needed was scattered across spreadsheets, or nobody owned the outcome. Spending followed excitement instead of a business case.
An AI readiness assessment reverses the order. Before you choose any model or vendor, you check whether your processes, data, systems, people and governance can support AI, and you pick the one use case most likely to pay back. This guide gives you a self-check you can run with your leadership team in an afternoon, a scoring table and the warning signs that tell you to fix the basics first.
Quick answer: An AI readiness assessment checks five areas: a clearly defined business problem, data that is available and usable, systems that can be connected, people who will own and use the solution, and rules for privacy and human review. Score each area honestly, fix the weakest one first, and start with a single measurable pilot rather than a company-wide rollout.
Area 1: A business problem worth solving
Readiness starts with a problem, not a technology. Write down the process, the people involved, how often it happens and what it costs today in hours, delays or errors. Good candidates are repetitive and high-volume: answering the same customer questions, entering data from documents, preparing routine reports, triaging tickets or following up on leads.
If you cannot name the metric that would improve, such as response time, hours of data entry or error rate, you are not yet ready to evaluate an AI proposal. Every vendor demo will look good because you have nothing to measure it against.
Area 2: Data you can actually use
- Availability: does the data for this use case exist in digital form, or does it live in registers, WhatsApp chats and people's heads?
- Access: can you export it, or is it locked in a system with no API or export option?
- Quality: are customer names, item codes and categories consistent, or does the same customer appear five different ways?
- History: for prediction tasks, do you have enough past records with known outcomes?
- Sensitivity: does it include personal data covered by the Digital Personal Data Protection Act, 2023, or confidential pricing and contracts?
Data problems are a common reason AI pilots stall. They are also fixable, but the fix should be planned and budgeted before any model work begins.
Areas 3 to 5: systems, people and governance
Systems
List the software the use case touches: CRM, ERP, Tally, helpdesk, website, WhatsApp Business account and email. Check whether each one has an API or integration option. AI that cannot read from and write to your systems becomes another browser tab your team ignores.
People
Name an owner for the outcome, usually the head of the department that benefits, not IT alone. Identify who will review AI output in the early weeks and who will maintain prompts, documents or rules. Ask frankly whether staff see the tool as help or as a threat, because adoption depends on it.
Governance
Decide what data may be sent to external AI providers, where human approval is mandatory, how long logs are kept and who can see them. A short acceptable-use policy for staff who use public AI tools is worth writing early. The NIST AI Risk Management Framework is a useful free reference for structuring these questions.
Score your readiness
Give each area a score from 1 to 5 using the descriptions below. Be honest; the point is to find the weak spot, not to pass.
| Area | Score 1: not ready | Score 3: partly ready | Score 5: ready |
|---|---|---|---|
| Problem | We want to use AI, but no process is named | Process named, cost estimated roughly | Process, volume, owner and target metric written down |
| Data | Mostly paper or scattered chats | Digital but inconsistent, exports possible | Clean, accessible and classified by sensitivity |
| Systems | No APIs, manual exports only | Some systems can be connected | Key systems have APIs or integration options |
| People | No owner, staff unaware | Owner named but with little time | Owner, reviewers and maintainer committed |
| Governance | No policy on AI or data | Informal rules | Written rules for data, review and retention |
As a rough guide, if any single area scores 1, fix it before you build. If everything is at 3 or above, a narrow pilot that avoids your weakest area is reasonable. If most areas score 4 or 5, you can plan a pilot and a wider roadmap together.
Picking the first use case
Once you know your weak areas, list candidate use cases and score each on three things: value (hours or revenue affected), feasibility (data and systems ready) and risk (cost of a wrong answer and exposure of personal data). Choose one that is high on value and feasibility and low on risk for the first pilot, even if a more exciting idea exists. An internal knowledge assistant or a document extraction pilot often fits this profile better than a customer-facing bot that can embarrass you in public.
Define success before anything is built: the metric, the target, the test period and who decides. A pilot with an agreed accuracy target on your own data gives you evidence for the next budget conversation.
Warning signs that you should pause
- The main driver is that competitors are doing AI, with no named process.
- The data owner will not share samples for testing.
- Nobody can say who will review AI output after launch.
- The plan assumes AI will be right every time from day one, with no exception handling.
- Personal data would be sent to third-party tools without anyone checking the terms.
None of these is a reason to give up on AI. Each one is a reason to fix one thing before you spend on a build.
How EthicsComputer can help
Our AI consulting and strategy engagement runs this assessment with your leadership and department heads, scores use cases on value, feasibility and risk, and delivers a costed roadmap. Assessment and roadmap typically take two to four weeks, with first pilot results within six to eight weeks. Where personal data is involved, we align the plan with DPDP Act compliance work, and our AI training workshops help your teams adopt what gets built.
Do you know which process should get AI first?
Tell us about your business, your main systems and the processes that take the most time, and we will suggest how to assess them.
About the author
Vinay Grover founded EthicsComputer in Rohtak, Haryana in 2018 and leads its cybersecurity, software and AI work for clients across India and abroad. EthicsComputer is ISO 9001, ISO/IEC 27001 and ISO 20000-1 certified.
