AI readiness checklist: 24 questions across six dimensions.
Every serious AI readiness framework — NIST’s risk management framework, ISO/IEC 42001, Cisco’s readiness index, the academic literature — converges on the same handful of dimensions: strategy and use cases, data, infrastructure, governance, skills and culture, operations. This checklist turns them into 24 yes/no questions an owner can answer honestly in twenty minutes, plus a quick interactive version and a free PDF. No email required.
- Free PDF download
- Six dimensions · 24 questions
- Based on NIST AI RMF, ISO/IEC 42001, Jöhnk et al.
- Self-assessment, not a verdict
Framework and statistics verified against primary sources: October 2026.
of US firms used AI in a business function in late 2025 — 31% of firms with 250+ staff, 18% of micro-firms (US Census Bureau).
of organisations have counted as fully AI-ready for three years running in Cisco’s index. Readiness has stalled, not grown.
of organisations either lack or are unsure they have adequate data management practices for AI (Gartner, 2025).
of companies abandoned most of their AI initiatives in 2025, up from 17% a year earlier (S&P Global Market Intelligence).
Download the AI readiness checklist
Two pages: the 24 questions grouped by dimension, a scoring grid, and the four maturity levels each dimension lands on. Print it, tick it in a leadership meeting, argue about the ticks — the argument is the point.
Download the checklist (PDF) ↓PDF · 2 pages · version 1.0, October 2026 · free, no email required
Want us to score it with you? Start the free AI readiness assessment
Six dimensions, four questions each
Answer each question yes or no for one concrete use case you have in mind — readiness is always readiness for something. Four yeses in a dimension is “Scaling”; zero or one is “Exploring”.
Strategy and use cases
The academic readiness literature puts “AI-business potentials” and “AI-process fit” first for a reason: RAND’s 2024 study of failed AI projects found the leading cause was stakeholders misunderstanding or miscommunicating what problem AI was meant to solve.
- We can name one process where AI would save measurable hours or money — not “AI” in general.
- That process has a number attached: current cost, time or error rate, and the target.
- A named executive sponsors it and will defend the budget.
- We have written down at least one use case we decided NOT to pursue, and why.
Data readiness for AI
The weakest pillar in every benchmark. Gartner expects organisations to abandon 60% of AI projects unsupported by AI-ready data through 2026; only 12% of data leaders told Precisely their data was of sufficient quality and accessibility for AI.
- The data the use case needs exists in a system, not in people’s heads or scattered spreadsheets.
- Someone owns that data and can say how complete and current it is.
- An engineer could get read access to it this week without a committee.
- We know which of it is personal or confidential, and what we are allowed to do with it.
Infrastructure and integrations
Jöhnk et al. list IT infrastructure under resources; Cisco weights infrastructure at 25% of its index and found only 15% of organisations have networks fully ready for AI. For an SMB the practical question is simpler: can anything plug in?
- Our core systems (CRM, CMS, ERP, store) have APIs or clean exports.
- Our website is server-rendered and its content is accessible to crawlers and agents.
- We can deploy a small new service in days, with logging, without a six-month procurement.
- We have a cloud or vendor budget line for AI usage, even a small one.
Governance and risk
NIST’s Govern function asks for policies, named roles, an inventory and incident channels. ISACA found only 38% of organisations had a comprehensive AI policy in 2026, and IBM found one in five had a breach caused by shadow AI.
- We have a written AI-use policy and a named owner for AI decisions.
- We keep a list of every AI tool in use, including the ones adopted without asking.
- New AI use cases get a short written risk check before they go live.
- If we serve EU users, we know which EU AI Act duties touch us — chatbot disclosure, content marking, literacy.
Skills and culture
Deloitte’s 2026 survey names insufficient worker skills the biggest barrier to integrating AI into existing work; 75% of knowledge workers already use AI, mostly with their own tools (Microsoft). The gap is not usage, it is competence and permission.
- At least one person uses AI tools weekly for real work and could teach the others.
- Staff know what they may and may not paste into an AI tool, and have been told so in a session, not a memo.
- Leadership has used the tools themselves, beyond a demo.
- People can say “the AI got this wrong” without it being career-limiting.
Operations
IBM’s 2025 CEO study: only 25% of AI initiatives delivered expected ROI and 16% scaled enterprise-wide. The difference between a pilot and an operation is whether anyone is accountable for it on a Tuesday afternoon.
- Someone would own the AI system after launch: monitoring, fixing, answering for it.
- We have a way to measure whether it is working, decided before it launches.
- We know what happens when it fails: fallback, human handoff, rollback.
- We have budget and attention for month two, not just for the launch.
Twelve-question AI readiness self-check
Two questions per dimension. Tick what is true today for the use case you have in mind. The tally maps to the same four maturity levels the full assessment uses.
0 of 12 — Exploring
Foundations first: one data cleanup, one page of policy, one sponsor. A pilot now would most likely join the 42% abandoned.
Self-assessments flatter. Cisco’s index has found 13–14% of organisations fully ready three years running while 58% claim a well-defined AI strategy. The full assessment scores each dimension from evidence, not ticks.
Where the six dimensions come from
The same dimensions appear, under different names, in the standards and studies below. We did not invent a framework; we merged four.
| Dimension | NIST AI RMF 1.0 (2023) | Jöhnk et al., BISE (2021) | Cisco AI Readiness Index (2025) |
|---|---|---|---|
| Strategy and use cases | Map: context, intended purpose, benefits and risks | Strategic alignment: AI-business potentials, process fit, top-management support | Strategy |
| Data | Map and Measure: data provenance, quality, representativeness | Data: availability, quality, accessibility, flow | Data |
| Infrastructure | Manage: resources to deploy, monitor and respond | Resources: IT infrastructure, budget, personnel | Infrastructure |
| Governance and risk | Govern: policies, roles, inventory, incident channels | Knowledge: AI ethics | Governance |
| Skills and culture | Govern: training; workforce diversity and culture | Knowledge: awareness, upskilling · Culture: innovativeness, change management | Talent · Culture |
| Operations | Manage and Measure: monitoring, response, continual improvement | Culture: collaborative work · Data: data flow | Strategy (scale and speed to ROI) |
Mapping is ours. Jöhnk, Weißert and Wyrtki name five categories and 18 factors; Cisco uses six pillars; NIST uses four functions. ISO/IEC 42001 covers the same ground as a certifiable management system.
What a checklist cannot tell you
Readiness is purpose-specific.
Jöhnk et al. are explicit: readiness “must follow the specific AI adoption purpose at hand”. You can be ready for an invoice-matching bot and nowhere near ready for a customer-facing agent. Answer the questions for one use case at a time.
It is a snapshot.
The 2026 literature reviews describe readiness as “a multidimensional and interdependent construct rather than a static pre-adoption condition”. Re-run it when the use case changes, when a key person leaves, or every six months — whichever comes first.
Ticks are not evidence.
Self-assessment inflates: 58% of organisations tell Cisco they have a well-defined AI strategy; 13% are measured as ready. The assessment version of this checklist asks for the policy document, the data sample and the API, not the tick.
It ignores the website.
This checklist covers the business side. Whether AI search engines can find and cite your site, and whether AI agents can use it, is a separate set of questions — covered by our AI visibility audit and the WebMCP guide.
Five steps from checklist to decision
- 01
Pick one use case
Not “AI”. One process, one owner, one number you want to move. If you cannot pick, that is your first finding: start with the strategy dimension and the use-case questions.
- 02
Score each dimension separately
Count yeses per dimension: 0–1 Exploring, 2 Foundations, 3 Pilot-ready, 4 Scaling. Do not average. The use case will be stopped by its weakest dimension, not helped by its strongest.
- 03
Argue about two ticks
Get two people to score independently and compare. The questions where they disagree are where the organisation does not actually know its own state — usually data ownership and tool inventory.
- 04
Fix the lowest dimension first
The cheapest fixes are almost always a data cleanup, a one-page policy, or a named owner. Gartner’s abandonment prediction is specifically about projects unsupported by AI-ready data — that is the dimension to never skip.
- 05
Re-run in six months, or get it scored
The free assessment scores the same dimensions from evidence, adds the website side and the EU AI Act check, and returns a 90-day roadmap. Bring your filled-in checklist; it shortens the intake.
Ticked the boxes? Get them checked.
The free AI readiness assessment scores the same six dimensions from evidence, adds your website’s readiness for AI search and agents, flags EU AI Act duties, and returns a 90-day roadmap.
Get the free AI readiness assessmentAI maturity model explained·AI use policy template·EU AI Act Article 50 guide
Fair questions
- What is an AI readiness checklist?
- A structured set of yes/no questions that tests whether an organisation has the preconditions to adopt AI for a specific purpose: a use case worth doing, data that supports it, infrastructure it can plug into, governance to control it, people who can use it, and operations to keep it running. The academic definition of AI readiness it rests on is “the preparedness of organizations to implement change involving applications and technology related to AI”.
- Checklist, framework, assessment — what is the difference?
- The framework is the set of dimensions and why they matter; ours merges NIST AI RMF, ISO/IEC 42001, the Jöhnk et al. readiness factors and Cisco’s pillars. The checklist is the framework turned into questions you answer yourself. The assessment is the same framework scored by someone else from evidence — documents, data samples, system access — with a maturity level per dimension and a roadmap. Use them in that order.
- Is this an AI readiness assessment framework for small businesses?
- It is written for companies of roughly 5 to 500 people, where the person reading it can also act on it. Enterprise frameworks assume committees, data offices and multi-year programmes; most of the published readiness statistics come from that world. The questions here are the same dimensions at a depth an SMB can answer on a Tuesday.
- What score counts as “ready”?
- There is no total score, deliberately. Each dimension gets a level — Exploring, Foundations, Pilot-ready, Scaling — and the use case is as ready as its weakest dimension that it depends on. A company at Scaling in skills and Exploring in data is not “Pilot-ready on average”; it is a data project waiting to happen.
- Does the checklist cover the EU AI Act?
- One question in the governance dimension asks whether you know which duties touch you. The full assessment goes further: it maps your AI systems to provider or deployer roles and lists the Article 50 transparency duties and the Article 4 literacy duty that apply. Our Article 50 guide covers the law itself.
- Why are readiness rates so low when everyone uses AI?
- Because usage and readiness measure different things. 75% of knowledge workers use AI tools; 18% of US firms use AI in a business function; 13% of organisations are measured as fully ready to run it at scale. The gap between the first and last number is exactly what the data, governance and operations dimensions test.
Sources: NIST AI Risk Management Framework 1.0 (Jan 2023) · ISO/IEC 42001:2023 — AI management systems · Jöhnk, Weißert & Wyrtki: Ready or Not, AI Comes (BISE, 2021) · Cisco AI Readiness Index 2025 · Gartner: 60% of AI projects unsupported by AI-ready data will be abandoned (Feb 2025) · S&P Global: AI abandonment rate (via CIO Dive, Mar 2025) · RAND: root causes of failure for AI projects (Aug 2024) · Precisely / Drexel LeBow: 2025 data integrity trends · IBM Institute for Business Value: 2025 CEO Study · Deloitte: State of AI in the Enterprise 2026 · Microsoft & LinkedIn Work Trend Index 2024 · ISACA AI Pulse Poll 2026 · IBM Cost of a Data Breach 2025 · US Census Bureau: AI use in business functions (CES working paper, Apr 2026) · Eurostat: use of artificial intelligence in enterprises (2025) · Hirtranusi et al.: systematic review of organisational AI readiness (IJACSA, 2026)