Only about 13% of companies qualify as fully prepared “Pacesetters” in Cisco’s 2025 AI Readiness Index, a survey of more than 8,000 AI leaders across 30 markets. The gap shows up in planning. Of those leaders, 99% had a defined AI roadmap, compared with 58% of all respondents.

An AI readiness assessment is a structured check of whether a company can support an AI project today, scored across six dimensions from strategy to budget. The result shows what to fix before money goes into models. Run one before you hire an AI consultant. Your first paid week then goes on building.

This guide gives you the six dimensions, a 30-point AI readiness checklist, a scoring method, and a short plan for fixing a low score.

What is AI readiness, and what does an assessment actually measure?

AI readiness is the degree to which a company can take an AI use case from idea to daily operation without stalling. An AI readiness assessment measures that capacity across six dimensions, each scored against plain yes-or-no evidence. The output is a score per dimension and a ranked list of gaps.

People ask “what is AI readiness” a lot, and the honest answer is narrow. Tool count is irrelevant. An AI readiness assessment checks whether the basics are in place: an owner, reachable data, a security process and a budget line.

This is a different exercise from a SOC 2 readiness assessment, which checks security controls for an audit. The two meet in the governance dimension, but they answer different questions.

Which 6 dimensions does an AI readiness assessment cover?

A complete AI readiness assessment covers the six dimensions in the table, from strategy through budget. Weakness in any one can stop a project on its own, so the assessment scores each separately. A company with excellent data and no budget owner is still a long way from ready.

The governance row deserves attention. In IBM’s 2025 breach study, 63% of breached organizations had no AI governance policy or were still writing one. IBM’s 2026 study found more than 20% of organizations had a breach targeting AI models or applications.

What goes on a 30-point AI readiness checklist?

The 30-point AI readiness checklist below gives five yes-or-no items per dimension. Score one point for each “yes” you can prove with a document, a system or a named person. A “yes” based on intent scores zero. The full assessment takes a leadership group about an hour.

Strategy

1. One AI use case is written down with a target metric.
2. A named executive owns AI outcomes.
3. The use case links to a goal in this year’s business plan.
4. The current process has a measured baseline.
5. Leadership has agreed what “stop” looks like.

Data

1. The data for the first use case is identified by system and table.
2. Engineers can query it without manual exports.
3. Someone can say how accurate the historical labels are.
4. Contracts and laws such as HIPAA or CCPA allow this use of the data.
5. Personal or regulated fields are tagged.

Infrastructure

1. A cloud account or environment exists for AI workloads.
2. Systems in scope have APIs the model can call.
3. Logs capture every AI request and its cost.
4. Single sign-on covers the tools in scope.
5. A test environment mirrors production closely enough to trust.

Skills

1. A business owner will judge the results.
2. A production owner will support the system after launch.
3. Someone in-house can read and question a model evaluation.
4. Staff who will use the output have had basic AI training.
5. A build partner or internal team is identified.

Governance

1. A written AI use policy exists.
2. An approved AI tools list exists.
3. Security reviews AI projects within an agreed time.
4. A list of AI systems in use is kept current.
5. There is a process for reporting AI errors or harm.

Budget

1. The first project has a funded budget.
2. A production budget is pencilled in for next quarter.
3. Model and cloud running costs have an owner.
4. Finance has agreed a cost-per-task target.
5. The business case shows payback within 18 months.

Want an outside view on your 30 points?

WebOsmotic runs the AI readiness assessment with your team in one working session and returns the six scores with a ranked fix list.

Book a Readiness Session

How do you score an AI readiness assessment?

Add the points for a total out of 30, then look at each dimension’s score out of 5. The weakest dimension matters more than the total. A company scoring 24 overall with a 1 in data is less ready than one scoring 20 with no dimension below 3.

Apply one override to the AI readiness assessment. Any dimension scoring 0 or 1 caps the result at “Partial” whatever the total says, and in our experience data and budget trigger that cap most often.

Have three people score on their own, then compare. A gap of more than 5 points on the total usually means the leaders hold different pictures of the same project, and that needs settling before anyone scopes a build. Settle that first.

How do you fix a low AI readiness score?

Fix the lowest-scoring dimension first, with the smallest change that moves it to 3 out of 5. Usually the fix is a document or a decision. A low score rarely calls for new software, so a team can lift its weakest area within 4 to 6 weeks.

Typical fixes by dimension:

• Strategy: write the use case as one sentence with a number, and name the executive owner.
• Data: build one clean, queryable dataset for the first use case only. Skip the company-wide data platform for now.
• Infrastructure: turn on request and cost logging before anything goes live.
• Skills: name the production owner, and book role-specific training for the first user group.
• Governance: publish a two-page AI use policy and an approved tools list. Our post on AI data governance covers the data rules in more detail.
• Budget: get a production line pencilled into next quarter, even at a rough figure.

Then re-run the AI readiness checklist. A move of 4 to 6 points in 6 weeks is normal when one person owns the fixes.

For a wider view of where the company sits over time, the five-stage AI adoption framework tracks progress quarter by quarter.

How does enterprise AI readiness differ for larger companies?

Enterprise AI readiness adds procurement, vendor risk and scale checks on top of the 30 points. Large US companies need AI systems to pass security questionnaires, connect to single sign-on and logging platforms, and fit model inventories that audit teams review. Those steps add weeks, so they belong in the plan from day one.

Four extra checks matter for enterprise AI readiness:

1. Vendor risk review covers AI suppliers and their sub-processors.
2. AI systems appear in the central asset inventory.
3. Model decisions affecting customers can be explained on request.
4. The NIST AI Risk Management Framework or a similar standard is mapped to internal controls.

The governance side of those checks is covered in our guide to building an AI governance framework.

When should you bring in an AI consultant?

Bring in an AI consultant once your AI readiness assessment total sits at 11 or more and every dimension scores at least 2. Below that, you pay outside rates for work your own team can do in a few weeks. Above it, a consultant shortens the path from a scored use case to a working proof of concept.

Choosing a provider for the assessment itself? Ask four questions:

• Will they score against evidence, or run a survey of opinions?
• Do they hand over the scoring sheet so you can repeat it?
• Have they built and run AI systems in production, beyond advising on them?
• Will the output be a ranked fix list with owners and dates?

An AI consulting company that also builds will tie the readiness findings to a delivery plan. That avoids paying twice for discovery.

Scored 11 or more and ready for the next step?

Our AI consultants turn your readiness results into a use-case ranking, an ROI model and a 90-day rollout plan your board can approve.

Talk to Our AI Consultants

Frequently asked questions

What is AI readiness in simple terms?

AI readiness means a company can take an AI idea into daily use without stalling on data, people, rules or money. In practice, that means passing at least 19 of the 30 checks above, with no dimension below 2 out of 5.

How long does an AI readiness assessment take?

The self-assessment takes about 1 hour for a group of three leaders. An outside AI readiness assessment with system reviews usually runs 1 to 2 weeks. That covers interviews with 5 to 10 people and a check of the data behind the first use case.

Who should take part in the assessment?

Include the executive sponsor, the business owner of the first use case, an IT or data lead and someone from security or legal. Four to six people is enough. Larger groups slow the scoring. Keep finance in the loop for the budget questions, since five of the 30 points depend on them.

Is an AI readiness checklist enough on its own?

A checklist shows where the gaps are. Fixing them takes owners. Pair the 30 points with an owner and a date for each “no”, then re-score after 6 weeks. Teams that skip the owners tend to see the same gaps a quarter later, with the budget already spent.

How often should a company repeat the AI readiness assessment?

Repeat it every quarter during the first year, then twice a year. Re-score sooner after a major change, such as a new data platform, a merger or a new regulation that affects 1 or more of your AI use cases.