AI readiness assessment: what to check before you invest

An AI readiness assessment should answer a simple question: is this business ready to improve a specific piece of work with AI?

It is not a test of how modern the company looks. A small business with one well-understood workflow can be more ready than a larger organisation with scattered data, unclear ownership and no way to measure success.

Use the assessment below before buying licences or commissioning a build. Score each statement from 0 to 2:

• 0 means no or unknown
• 1 means partly
• 2 means yes, with evidence

1. Business problem

1. We can name the workflow or task we want to improve.
2. The people doing the work agree on the main problem.
3. We know what a good outcome looks like.
4. The task happens often enough to justify change.

If the business problem is vague, pause. “We need AI” is not a usable brief.

2. Workflow

5. The current process has a named owner.
6. We know the trigger, steps, handoffs and exceptions.
7. We can separate routine admin from human judgement.
8. We know where delays, errors or repeated work occur.

Map the current process before designing the future one. Automating an unclear process usually creates faster confusion.

3. Data

9. We know which documents, records or messages the system needs.
10. The information is accurate enough for the task.
11. Access permissions reflect who should see it.
12. We know whether personal, confidential or regulated information is involved.

Data readiness is about quality, ownership and access. It is not about collecting everything.

4. Technology

13. We know which current systems the workflow must connect to.
14. Those systems have a reliable way to exchange information.
15. We can test without risking live customer or financial records.
16. We have a person who can own the system after launch.

Use the simplest suitable approach. Some problems need a better form or rule-based automation, not a language model.

5. Security and governance

17. The proposed tool and account type are approved.
18. We have decided what information may be entered.
19. We know what a person must review or approve.
20. We have a way to report and respond to problems.

Read our enterprise AI security guide and AI policy template if these controls are missing.

6. People and adoption

21. The people affected have been involved in the design.
22. Training will use their real tasks, not generic demonstrations.
23. Staff know what the system can and cannot do.
24. Feedback and improvement have an owner.

Adoption is part of implementation. A technically sound tool that staff avoid is not a successful project.

7. Measurement and delivery

25. We have a baseline for the current workflow.
26. We have chosen one or two measures for the pilot.
27. The first version has a clear scope and end date.
28. We have criteria to expand, change or stop it.

Useful measures may include turnaround time, rework, missed handoffs, adoption or the number of cases needing correction. Choose measures that reflect the task, not vanity metrics.

Interpret the score

The maximum score is 56.

• 0 to 20: define the problem and ownership before selecting a tool.
• 21 to 38: a small discovery exercise should close the main gaps.
• 39 to 48: prepare a controlled pilot with clear review gates.
• 49 to 56: the workflow appears ready for a pilot, subject to technical and specialist checks.

The score is a prompt for discussion, not a certification. A single high-risk gap can matter more than the total. For example, unclear access to confidential data should not be cancelled out by strong scores elsewhere.

Microsoft Copilot readiness assessment

Microsoft 365 Copilot needs a more specific review because it works with Microsoft 365 content the signed-in user can already access.

Before rollout, check:

• eligible subscriptions, Exchange Online mailboxes, Entra ID accounts and supported apps
• SharePoint and OneDrive ownership and sharing
• old organisation-wide links and broad groups
• sensitivity labels and retention settings where appropriate
• pilot users and role-based use cases
• training, feedback and adoption reporting

Microsoft lists minimum deployment requirements and recommends SharePoint governance, Purview labelling and a phased rollout. Its secure and governed data foundation guidance focuses on oversharing, guardrails and regulatory requirements.

For local rollout and training support, see Microsoft Copilot training in Northern Ireland.

Turn the assessment into a pilot brief

At the end of the assessment, write one page containing:

• the problem
• the current baseline
• the proposed workflow
• included and excluded data
• the system owner
• the human review point
• the pilot users
• the measures
• the review date

That page is more valuable than a long list of possible AI ideas. It gives the business something specific to build, test and improve.

Blue Canvas helps SMEs assess readiness, map workflows and deploy practical AI across Microsoft Copilot, ChatGPT and custom systems.

Sources

• Microsoft 365 Copilot minimum requirements
• Microsoft secure and governed Copilot foundation
• ICO AI and data protection risk toolkit

Book a free 15-minute call