An AI readiness assessment should give you, within about two weeks, a ranked shortlist of AI use cases with an owner and a baseline for each, the data, system and access gaps that stand in their way, the risks you would need to control, and a costed plan for the first use case. If it ends with only a maturity score, it hasn't done its job.

Picture a managing director at a 200-person distribution company. The board has asked, "What is our AI plan?" Three teams have already tried tools on their own: sales uses an assistant for emails, finance tested invoice extraction, and support has a chatbot demo nobody has switched on. Each team has a story, none of them has a number, and nobody knows whether customer data is in good enough shape for any of it. What the director needs is not another workshop. It's two weeks of looking at the actual work, the actual data and the actual systems, and a decision at the end.

What is an AI readiness assessment?

An AI readiness assessment is a short, structured review of where AI could do useful work in a company, and of whether the data, systems, people and controls are in place to make that work reliable. Its output is a decision about what to build first, and what to fix before you do.

It differs from two things it is often confused with:

• An AI strategy: a strategy sets direction for several years. An assessment looks at the next one or two projects and what they depend on.

• A maturity score: a score rates the company on a scale. An assessment names specific use cases, specific gaps and specific owners. A score can be part of it, but it can't be the result.

Two weeks is a sensible length because it is long enough to talk to the people doing the work and look at real data, and short enough that the answer arrives while the question still matters.

What should an AI readiness assessment include?

It should cover seven areas, each tied to the use cases being considered rather than reviewed in the abstract. An assessment that audits "the data" in general will run long and conclude little; one that asks "what does this use case need from the data?" will finish.

The checklist

• Use cases and baseline: the jobs AI could take on, collected from the teams doing them, with today's time, cost, volume and error rate for each.

• Data: where the data each use case needs lives, who owns it, whether key terms are defined the same way everywhere, and how many duplicates and gaps it has.

• Systems and integrations: which systems an AI would need to read from or write to, and whether they have usable APIs and test environments.

• Security and access: who may see which data, how an AI system would get its access, and what it must never be able to do on its own.

• Governance and risk: who approves AI use, how errors are caught, and what happens if the output is wrong. Public frameworks help here: the NIST AI Risk Management Framework (AI RMF), released on 26 January 2023, organises the work into four functions (Govern, Map, Measure and Manage), and ISO/IEC 42001:2023 sets out requirements for an AI management system.

• People and skills: who will own each use case, who will review its output, and what training they need.

• Costs: licences, model usage at real volume, build effort, and the time people will spend reviewing results.

The data area is usually where the surprises are. Our post on cleaning CRM data before you add AI shows what that review looks like for customer data.

What should you have in hand at the end of two weeks?

You should have a small set of documents you can act on the following Monday: a ranked use-case list, a gap list for the top choices, a risk register and a plan for the first build. Anything you can't act on is background reading.

1. A ranked use-case list. Every candidate, scored on value, data readiness, integration effort and risk if the output is wrong, with the reason for each score written down.

2. One page per top use case. The owner, the baseline, the success measure, the data and systems it needs, and what is missing.

3. A gap list. Shared gaps grouped once, so one customer-data cleanup that serves three use cases appears as one item, not three.

4. A risk register. For each top use case, what could go wrong, how likely it is, how you would detect it, and which step needs a person's approval.

5. A costed plan for the first use case. Scope, effort, running costs at production volume, and a review date with the result it must show to continue.

6. A "not now" list. Ideas that were considered and parked, with the reason, so they don't come back next quarter as if they were new.

The costing step feeds straight into next year's plan. Sizing an AI Budget for 2027 explains how to turn these documents into budget lines.

How does a two-week AI readiness assessment run?

It runs as one week of looking and one week of deciding. The first week gathers evidence from people, data and systems; the second turns that evidence into a ranked choice and a plan.

Week one: evidence

1. Kick-off with the sponsor. Agree on the business goals, the teams in scope, who decides, and what is off limits.

2. Interviews with the teams doing the work. Short sessions with the people who run each process, not only their managers, to collect candidate use cases and how the work is done today.

3. Baselines. Record time, volume, cost and error rate for each candidate, using real figures from the systems where possible.

4. Data and system walkthroughs. Look at sample records, field definitions, integrations and access rights for the systems each candidate depends on.

Week two: decisions

1. Score and rank. Apply the same criteria to every candidate and share the draft ranking with the teams for corrections.

2. Map gaps and risks. For the top choices, list what is missing and what could go wrong, and group the shared gaps.

3. Cost the first use case. Estimate the build, the running costs and the review effort.

4. Readout and decision. Present the ranking, the plan and the "not now" list to the sponsor, and leave with a decision on the first build.

How do you tell a useful assessment from a sales exercise?

A useful assessment can end with "don't build this yet", and it says why. A sales exercise always ends with a project for the people who ran it, usually the biggest one on the list.

Watch for these signs:

• No baseline. Benefits are described without measuring how the work is done today, so nothing can be checked later.

• Generic findings. The report could be about any company in your industry; it doesn't name your systems, fields or teams.

• Tool first. The recommendation is a product or platform before the use cases are clear.

• Only leadership interviewed. The people who do the work every day weren't asked.

• No stop criteria. The plan says what success looks like but not what result would mean stopping.

• Risk as an appendix. Access, review and error handling are mentioned in passing instead of designed per use case. Our checklist for testing an AI agent before it goes live shows how much of that work belongs in the plan.

How we approach it at Vizio AI

We treat an AI readiness assessment as the Diagnose step of our DX Studio work, which runs from Diagnose to Design, Build, Launch and Optimize. We start from the work: we talk to the people who run each process, measure how it is done today, and only then look at which parts AI could take on.

For every candidate we open the systems and look at real records, because data that looks fine in a meeting often doesn't in a sample. We rank use cases on value, data readiness, integration effort and risk, group shared gaps into one foundation project, and design the access and review steps before any build is planned. The readout ends with a decision on the first use case, its owner, its success measure and the date we will check it, plus the list of ideas we recommend parking and why.

Sources

• NIST, AI Risk Management Framework (retrieved 25 Oct 2026): https://www.nist.gov/itl/ai-risk-management-framework

• NIST AI Resource Center, AI RMF Core (retrieved 25 Oct 2026): https://airc.nist.gov/airmf-resources/airmf/5-sec-core/

• IEC Webstore, ISO/IEC 42001:2023 Information technology – Artificial intelligence – Management system (18 Dec 2023): https://webstore.iec.ch/publication/90574

• Vizio AI, DX Studio (retrieved 25 Oct 2026): https://www.vizio.ai/studios/dx-studio