AI & automation
AI Readiness Assessment: A Small Business Checklist You Can Score
This AI readiness assessment scores one workflow at a time. Check process, data, systems, review capacity, risk rules and measurement, then pilot, fix the weakest area or keep the work manual.
The short answer
An AI readiness assessment checks whether one specific workflow can support an AI pilot. Score six areas from 0 to 2: process clarity, data access and quality, systems and APIs, people and review capacity, risk and policy, and measurement. A total of 10 or more with no zeros usually means you can run a small, reviewed pilot. A zero in data access or in risk and policy means you fix that first, whatever the total. A lower score tells you what to fix next, and that fix is often a form, a permission or a written rule instead of an AI tool.
- Assess one workflow at a time, using a recent batch of real work.
- A zero in data access or risk and policy blocks a pilot regardless of the total.
- A "not ready yet" result names the next fix, which often isn't an AI tool.
What an AI readiness assessment should tell you
You can assess AI readiness for a whole company, but a small business gets more from a narrower question. Can this one workflow, with the people and systems you have today, support a small AI pilot that a person reviews?
Run the assessment on a single job, such as sorting inbound quote requests, entering supplier invoices or drafting replies to routine support questions. The result should be one of three decisions: run a limited pilot, fix a named gap first, or keep the work manual or rules-based for now. A clear no is a valid result, and it costs far less to reach on paper than in a failed pilot.
This article gives you the scoring sheet. For the wider picture of choosing and running automation projects, read the small business guide. If you already suspect AI is the wrong fit, the stop-decision guide covers that choice in more detail.
Pick one workflow and gather evidence before you score
Block out an afternoon with the person who does the work, the person who approves the result and whoever manages the software involved. Scores given from memory tend to be generous, so put the evidence on the table first.
- Name the workflow in one line with its trigger and its finished output. For example: a quote request arrives by email and ends as a draft quote in the CRM.
- Pull a recent batch of 20 to 50 real items, including messy, incomplete and unusual ones, and confirm you're allowed to use them for testing.
- List every system the work touches, who holds the admin login for each, and whether each one can import, export or connect through an API.
- Write down roughly how many items arrive each week and how many minutes each one takes today, including corrections.
- Note who would review an AI-assisted result and how much time that person actually has for it.
The AI readiness checklist: six areas to score
Score each area 0, 1 or 2 using the descriptions below. If you're unsure between two scores, take the lower one and write down what would raise it.
The six areas loosely follow questions in NIST's AI Risk Management Framework Playbook, which asks organizations to document the business purpose of an AI system, their risk tolerance, how people will oversee its output and who is responsible for decisions. NIST says the framework is intended for voluntary use. The 0 to 2 scale is a simplification for this checklist, not part of the framework.
| Area | 0: not ready | 1: partly ready | 2: ready for a pilot |
|---|---|---|---|
| Process clarity | Steps differ by person and nobody can say what a correct result looks like | Main steps are known, but exceptions live in someone's head | Steps, exceptions and examples of a correct output are written down |
| Data access and quality | Inputs are scattered, not approved for this use or mostly incomplete | Inputs are reachable but need cleanup or manual gathering | Inputs are in known places, you may use them, and most items are complete |
| Systems and APIs | The destination has no import, export or API, or nobody has admin access | Import or export works but needs manual steps | A documented API or supported integration exists, with a test account |
| People and review capacity | No named reviewer, or the reviewer has no spare time | A reviewer exists, but review time isn't planned | A named reviewer has time set aside and knows what to check |
| Risk and policy | No rules on which data may go into AI tools or what output may be sent | Informal rules that people describe differently | Written rules, an approved tool list and a clear line between a draft and an action |
| Measurement | No baseline for volume, time or errors | Rough estimates only | A timed baseline and a labeled sample to test against |
Process clarity: can someone describe the right result?
AI can cope with variable wording, but it can't settle a process your team hasn't agreed on. If two employees would handle the same quote request differently, the model will copy one habit or neither, and your reviewer will spend the pilot debating the standard instead of checking the output.
A score of 2 means you can hand someone a written description of the steps, the common exceptions and three or four examples of a finished, correct result. If you can't, map the process before you look at tools. Mapping often turns up steps you can delete or handle with a fixed rule, which costs less than AI and is easier to check.
Data access and quality: can a system see the right inputs?
Check three things for the inputs in your sample batch. First, where they live: a shared mailbox, a CRM, a folder of PDFs or a spreadsheet on one person's laptop. Second, whether you're permitted to use them this way under your customer agreements, privacy commitments and vendor terms. Third, their completeness: count how many sample items are missing a field the output needs.
For example, if a third of your quote requests need a phone call before anyone can finish them, AI won't fix that, but a better intake form might. The same goes for data spread across personal spreadsheets with different column names. Moving it into one maintained table or database is often the real first project.
Systems and APIs: where would the result go?
An AI output that someone has to retype into another system saves less than it appears to. Look at where the result has to end up, whether that's the accounting system, CRM, help desk or scheduling tool. Check its documentation for an API, a supported import or a built-in automation feature, and find out who holds the admin login.
Also check whether software you already pay for has an AI or automation feature for this exact job. A built-in feature you can test this week is usually cheaper to run than a custom integration you'd have to maintain. If the work spans several systems that don't share data, the integration gap may be the bigger problem to solve first.
People and review capacity: who checks the output?
An AI-assisted workflow needs a person who reviews results, a person who decides whether the workflow keeps running, and someone who fixes it when a connection breaks. In a small team these may be the same person, which works as long as their time is planned.
Review capacity is easy to skip on a checklist. If your bookkeeper is already behind, a new queue of AI-drafted bills to check can make the backlog worse during the pilot. The NIST Playbook's Map function includes defining processes for human oversight and for operator proficiency. In practice, the reviewer needs time on the calendar and some training on which errors to look for.
Risk and policy: what may AI see, say or change?
Before a pilot, write down which tools are approved, what kinds of data may go into them, and which outputs are drafts and which are actions. A drafted email carries less risk than a sent one, and a proposed bill carries less risk than a payment. The SBA's guidance for small businesses suggests having another person review output from free AI tools, and trying not to feed sensitive data or proprietary information into AI tools at all.
NIST's Generative AI Profile describes confabulation, where a model produces confidently stated but false content, and risks from over-reliance and automation bias. Your rules should say how a reviewer verifies facts against the source and what happens when they can't. NIST's playbook also asks organizations to keep an inventory of AI systems. For a small business, a short list of tools, owners and permitted data is a reasonable start.
Measurement: can you tell whether a pilot worked?
Without a baseline, you can't tell whether a pilot saved time or moved the work to a reviewer. A score of 2 needs a timed sample of the current process and a small labeled set: real items where someone who knows the work has recorded the correct answer. That set lets you check AI output against something firmer than impressions.
Decide in advance which errors matter most. In a triage step, missing an urgent request may cost far more than flagging a routine one by mistake. Precision and recall give you a way to measure that tradeoff, and review-time tracking tells you whether the workflow saves effort once checking and corrections are counted.
How to read your score, and what a "not ready yet" result should lead to
Add the six scores for a total out of 12, then check the pattern, because a good total can hide a blocker. A zero in data access or in risk and policy stops the pilot whatever the total, since you'd be testing with data you can't use or without rules for what the output may do. Treat the bands below as a starting point for your own judgment.
A "not ready yet" result still gives you a next step. It usually points to a fix that pays off on its own, such as a required field on a web form, and it keeps you from paying for a pilot that couldn't have succeeded. Match the fix to your lowest-scoring area.
| Result | What it usually means | Next step |
|---|---|---|
| 10 to 12 with no zeros | The workflow is defined, reachable and reviewable | Run a small pilot on the labeled sample with every output reviewed |
| 7 to 9 with no zeros | One or two areas need work, but nothing blocks a test | Fix the lowest area, rescore, then pilot |
| 6 or less, or any zero | Not ready yet | Fix the weakest area first; it may not need AI at all |
| Zero in data access or risk and policy | A blocker regardless of the total | Settle permissions and written rules before any testing |
- Process clarity is low: map the process, agree on a correct output and remove steps nobody needs.
- Data is low: fix the intake form, consolidate the spreadsheets or get written permission to use the data.
- Systems are low: test the feature you already own or close the integration gap before adding AI.
- Review capacity is low: free up reviewer time or choose a lower-volume workflow.
- Risk and policy is low: write an approved tool list and data rules, and train people on them.
- Measurement is low: time the current process for two weeks and label a sample of real items.
Questions before you start
What is an AI readiness assessment?
An AI readiness assessment is a structured check of whether a business, or one of its workflows, has the inputs, systems, reviewers and rules an AI tool needs. It looks at six areas: a defined process, usable data, systems that can receive the output, people who can review it, rules for data and risk, and a way to measure results. For a small business, assessing one workflow at a time gives answers you can act on sooner than a company-wide survey.
Do I need a consultant to run an AI readiness assessment?
No. The people who do the work and approve the result can score this checklist in an afternoon with a recent batch of real items. Outside help is most useful when the score points to an integration, data or custom software gap your team can't close, or when you want someone without a stake in the outcome to question optimistic scores. GLCO can review a scored workflow with you and say whether a pilot, a smaller fix or no project makes sense.
Sources and further reading
- NIST AI Risk Management Framework: overview, intended for voluntary use
- NIST AI RMF Playbook, Map: business purpose, risk tolerance, human oversight and operator proficiency
- NIST AI RMF Playbook, Govern: roles, responsibilities and an inventory of AI systems
- NIST AI 600-1 Generative AI Profile: confabulation, data privacy and over-reliance risks
- U.S. Small Business Administration: AI for small businesses, benefits and risks
Make this useful for my team.
Bring us a task you spend too much time on. We can look at where the time goes, what AI could handle, and whether the benefit would cover the cost. We reply within one business day.
Keep reading
AI & automation
AI Automation for Small Businesses: A Practical 2026 Guide
Pick one recurring task that eats your team's time. Use plain rules where they do the job. Test whether AI cuts the work that's left after review, corrections and upkeep.
AI & automation
When Not to Use AI for a Business Workflow
If AI adds more checking than it removes, a simpler form, a rule or the manual process you already have may serve your team better. Compare the whole job before you buy.
AI & automation
AI Training for Employees: A Practical Plan for Small Teams
Train employees on the AI tools and data rules you've approved, using their own work. Teach by role, practice verification, measure checked results and update the training when tools or rules change.