Is your business ready for AI? Score it in 20 questions

The short answer

An AI readiness assessment checks whether your business can use AI safely and get value from it. For a small or midsize company it comes down to five areas: clear use cases, usable data, documented processes, security and permissions, and people and policy. Score each honestly and the weakest area tells you what to fix before buying tools.

Most businesses with 25 to 100 employees are readier than they think on tools and less ready than they think on data and permissions. AI assistants can surface any file a user can open, so messy sharing becomes visible fast. Use the 20-question checklist below to score yourself.

Why readiness matters more than the tool

AI tools are easy to buy. The expensive failures come from what surrounds them: a chatbot answering from outdated documents, an assistant that shows an employee salary files because sharing was never cleaned up, or a pilot nobody measured. NIST’s AI Risk Management Framework organizes this work into four functions: govern, map, measure and manage. You do not need the full framework at small-business scale, but its logic holds. Decide who owns AI, understand where it will be used, measure whether it works, and manage the risks you find.

Microsoft makes the permissions point directly: its Copilot tools respect your existing identity model and permissions. That is good news if permissions are tidy, and a problem if a shared drive has been open to everyone for years.

The 20-question checklist

Score each question: 0 = no, 1 = partly, 2 = yes. Be strict. If you are not sure, score it 0.

1. Use cases and value

1. We have named two or three specific tasks where AI could save time or improve quality.
2. Each task has a current measure, such as hours per week, response time or error rate.
3. Someone owns each use case and has time to run a pilot.
4. We know which tasks must stay with a person for judgment or legal reasons.

2. Data

1. Key information lives in a few known systems, not scattered across personal drives and inboxes.
2. Documents staff rely on are current, with old versions archived or deleted.
3. Customer and financial data are consistent between systems such as CRM and accounting.
4. We know which data is confidential, regulated or under client contract.

3. Processes

1. Our most repeated workflows are written down, even briefly.
2. Handoffs between people and systems are clear, not handled by memory.
3. Core systems connect through integrations rather than retyping.
4. We can describe what a good outcome looks like for each workflow we want to automate.

4. Security and permissions

1. Every user signs in with multi-factor authentication.
2. File and folder sharing has been reviewed in the past year, and nothing sensitive is open to everyone.
3. Leavers lose access the same day, including to AI and SaaS tools.
4. Backups are monitored and restores have been tested.

5. People and policy

1. We have a written AI use policy that says which tools are approved and what data can go in.
2. We know which AI tools staff already use, including free accounts.
3. Staff have had basic training on checking AI output.
4. Leadership has agreed a budget and a decision rule for continuing or stopping pilots.

Reading your score

Also look at the spread. A business that scores 8 out of 8 on use cases and 2 out of 8 on security should not run a pilot yet, however eager the team is.

Want an outside view instead of scoring yourself? Our assessment includes AI opportunities alongside security, data and continuity. Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, automation and AI opportunities, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

Who should take part

Do not score this alone. Readiness spans the whole business, and each person sees different gaps. A useful group for a 25 to 100 person company is small:

• An owner or senior leader, who sets the budget and decides what success means.
• Whoever runs IT, in-house or outsourced, for security, permissions and integrations.
• One or two managers from busy teams, who know where hours are actually lost.
• Someone who handles compliance or contracts, if you work with health, legal or financial data.

Score separately, then compare. Big differences between answers are themselves a finding: they usually mean a process lives in one person’s head.

The fixes that move the score fastest

1. Turn on multi-factor authentication everywhere. It is the single most effective control and a prerequisite for any AI tool.
2. Clean up sharing. Find folders shared with everyone or with external links, and close them. In Microsoft 365 and Google Workspace, admin reports show this.
3. Pick a home for documents. Move key files from personal drives into shared, permissioned libraries with retention rules.
4. Write a one-page AI policy. Approved tools, data tiers, review rules and who to ask.
5. Inventory shadow AI. Ask staff, check sign-in logs and browser extensions, then approve one tool rather than banning everything.
6. Document one workflow end to end. The one you most want to automate. Writing it down often reveals the fix is integration, not AI.

What a good pilot looks like

Scope one task, one team and 60 to 90 days. Measure the baseline first. Use a tool with admin controls and a clear data policy. Check output quality weekly with a simple sample. At the end, decide using the measure you set: continue, adjust or stop. A pilot that ends with a clear stop is a success, because it cost little and taught you something.

Where to go from here

A self-score is a good start. An outside review catches what insiders are used to, especially permissions and backups. Our free Technology Health Assessment rates AI opportunities alongside cybersecurity, integration, automation and continuity. When you are ready to build, our automation and practical AI team helps put the first use cases into practice. For everyday ideas, see practical AI uses for small business owners.

Keep reading

• How to choose a document management system for a small business
• E-signature vs digital signature: the difference, legal validity and which to use
• Automated appointment reminders: how to set them up by text and email
• AI for small business owners: practical, safe uses that save time

Related services

• Free Technology Health Assessment
• Automation and practical AI
• Cybersecurity services
• Systems integration