AI readiness is the difference between an AI project that pays for itself within a year and one that quietly dies after a three-month pilot. Most UK businesses now feel pressure to “do something with AI”, and vendors are more than happy to sell them something. Far fewer stop to ask the harder question first: is this organisation actually ready to make AI work — with the data, the people, the processes and the controls it has today?
An honest AI readiness assessment answers that question before any money is committed. It is not a technology audit and it is not a vendor demo. It is a structured look at six specific areas of your business, scored bluntly, that tells you whether to start now, start smaller, or fix the foundations first. Get it right and your first project lands on solid ground. Skip it and you join the long list of companies whose AI spend produced a slide deck and nothing else.
This guide walks through the full assessment: what it measures, the six dimensions of AI readiness, a scoring matrix you can apply yourself this week, the red flags that mean “not yet”, and a 90-day plan to close the gaps. It is written for owners and directors of UK small and mid-sized businesses, not for enterprise transformation teams — although the logic scales in both directions.
Table of contents
- What an AI Readiness Assessment Actually Measures
- Why So Many AI Projects Stall
- The Six Dimensions of AI Readiness
- Dimension 1: Data Readiness
- Dimension 2: People and Skills
- Dimension 3: Process Readiness
- Dimension 4: Technology and Infrastructure
- Dimension 5: Governance, Security and Compliance
- Dimension 6: Budget and ROI Discipline
- How to Score Your AI Readiness
- AI Readiness Red Flags: Signs You Are Not Ready Yet
- A 90-Day Plan to Improve Your AI Readiness
- DIY or Consultant-Led AI Readiness Assessment?
- AI Readiness FAQ
- References
What an AI Readiness Assessment Actually Measures
An AI readiness assessment measures whether your organisation can absorb AI, not whether AI is impressive. The models are the mature part of the equation now. The immature part is almost always the buyer: the data the model would need, the people who would use it, the process it would sit inside, and the governance that would keep it out of trouble.
Readiness is about the organisation, not the model
A useful AI readiness assessment therefore spends very little time on model selection. Whether you eventually use Microsoft Copilot, an API-based model or a self-hosted deployment matters far less than whether your customer records are accurate, your team knows what the tool is for, and someone owns the outcome. We covered the short version of this in our earlier nine critical questions post; this article is the full scored framework that grew out of it.
The output is a decision, not a document
The deliverable of an AI readiness assessment is a decision you can defend: proceed, proceed with a narrower scope, or pause and fix specific gaps. Each of the six dimensions below gets a score from 1 to 5, and the shape of those scores — not the average alone — tells you which of the three decisions applies. A business scoring 4 on everything except data should not conclude it is “mostly ready”; it should conclude that data is the project.
Why “actually ready” is the right standard
Optimistic self-assessment is the default failure mode. Teams score themselves on intentions (“we’re planning to clean that up”) rather than on the current state. Every AI readiness score in this framework is anchored to observable evidence — a named owner, a working report, a tested backup — precisely so that AI readiness reflects what exists today, not what is hoped for next quarter.
Why So Many AI Projects Stall
Before the framework, it is worth being clear-eyed about the base rate. Industry surveys have converged on an uncomfortable picture: a large majority of AI pilots never reach production, and a substantial share of generative AI projects are abandoned after proof of concept because costs rise, data quality disappoints or the business case was never real. The UK government’s own research into AI activity found that adoption is heavily concentrated in larger firms, while most smaller businesses are still at the experimentation stage.
The failure causes are boringly consistent
Post-mortems on stalled AI projects rarely blame the model. They blame inaccessible or unreliable data, no named business owner, a use case chosen because it was exciting rather than valuable, staff who were never trained or never consulted, and running costs nobody budgeted for. Every one of those causes is visible in advance — which is exactly what an AI readiness assessment is for.
Stalling has a cost of its own
A failed pilot is not neutral. It consumes budget, it burns the enthusiasm of the early adopters on your team, and it hands sceptics a story they will retell for years. The second attempt at AI in a business that fumbled the first is measurably harder to fund and staff. Assessing AI readiness first is cheaper than rebuilding credibility later.
The Six Dimensions of AI Readiness
Every serious framework — from NIST’s AI Risk Management Framework to the big consultancies’ maturity models — converges on roughly the same territory. We assess AI readiness across six dimensions, because six is the smallest number that separates problems you fix with money from problems you fix with time.
| Dimension | What it measures | Typical failure sign |
|---|---|---|
| 1. Data | Whether the data AI would need exists, is accurate and is reachable | Key records live in spreadsheets on personal drives |
| 2. People and skills | Whether staff can use, question and supervise AI output | No one can say who would own the tool day to day |
| 3. Process | Whether target workflows are defined enough to improve | The process exists only in one employee’s head |
| 4. Technology | Whether systems, identity and security can host AI safely | Shared logins, no MFA, unsupported servers |
| 5. Governance | Whether use, risk and compliance are owned and written down | Staff already paste client data into free chatbots |
| 6. Budget and ROI | Whether funding covers the full lifecycle and success is defined | Budget covers the pilot but not running costs |
How the dimensions interact
The dimensions are not independent. Weak data drags down process scores because nobody trusts the reports; weak governance turns strong technology into a liability because capable tools are used carelessly. That is why the scoring section below reads the profile of the six AI readiness scores, not just the total. The sections that follow take each dimension in turn, with the evidence to look for at each level of AI readiness.
Dimension 1: Data Readiness
Data is the AI readiness dimension most likely to be overestimated, because every business believes its data is better than it is. The test is not whether data exists — it always exists — but whether it is accurate, complete, reachable by an application, and legally usable for the purpose you have in mind.
The questions to score against
Where does the data that matters actually live — a database with an API, or export files and inboxes? Could you produce a clean, current list of customers, products or jobs today without manual stitching? Who fixes an error when one is found, and how long does that take? Is any of the data personal data under UK GDPR, and has anyone checked the lawful basis for using it in an automated tool? Honest answers here do more to predict AI readiness than any technology question.
What good looks like
A business at level 4 or 5 has its core records in systems of record with named owners, routine data management and analytics practices, and at least one report that decision-makers genuinely trust. If that sounds distant, start with our guide on how to prepare business data for AI — data preparation is the single most common first project to fall out of an assessment, and the one with the best knock-on benefits even if AI never happens.
The shortcut that fails
Buying a tool that promises to “work with messy data” does not raise an AI readiness score. It hides the mess for a demo and reintroduces it in production, usually as confidently wrong answers. Score the data as it is; fix it before, not during, the first project.
Dimension 2: People and Skills
AI adoption is a people change wearing a technology costume. The tools are genuinely easy to use; the judgement about when to trust them is not. This dimension scores whether your team can get value from AI output, challenge it when it is wrong, and absorb the workflow changes it brings.
Skills to look for at each level
At the low end, staff have never used AI tools at work, or use them privately without guidance. In the middle, a few enthusiasts experiment while everyone else watches. At the high end of AI readiness, there is a named business owner for the first use case, a handful of trained “champions” across departments, and — critically — managers who understand that reviewing AI output is a skill that must be taught, not assumed.
Leadership matters more than headcount
Small firms often assume they lack the people for AI. In practice a 20-person business with an engaged managing director outperforms a 200-person business with a delegated-and-forgotten project, because adoption decisions get made in days rather than quarters. What kills the people score is not size; it is the absence of anyone senior who owns the outcome.
The training budget test
A quick diagnostic: if your AI plan contains no line for training — money or scheduled hours — the people side of your AI readiness scores 2 at best. Every successful rollout we have seen spends at least as much effort on training and workflow redesign as on licences.
Dimension 3: Process Readiness
AI applied to a vague process automates the vagueness. This dimension scores whether the workflows you want to improve are defined, measured and stable enough to be improved by software at all.
Pick processes that are documented, frequent and measurable
The ideal first target is a process that happens many times a week, follows rules a person can write down, and has an error rate or cycle time you can measure. Invoice handling, quote generation, inbound enquiry triage and report assembly are classic candidates — a workflow that uses natural language processing to read inbound documents and route them correctly is often the first genuinely valuable win. Processes that are rare, judgement-heavy or politically contested make terrible first projects regardless of the technology.
Document before you automate
If a process lives only in one employee’s head, the AI project silently becomes a process-discovery project with a deadline. Write the process down first — even one page helps. Our business process automation work almost always starts there, and firms that pair AI with existing intelligent automation foundations score a full level higher on this AI readiness dimension than those starting cold.
Baselines make ROI provable
Whatever you plan to improve, measure it now: hours per week, cost per transaction, error rate, response time. Without a baseline, the post-project ROI argument becomes a matter of opinion — and opinion always favours whoever controls next year’s budget.
Dimension 4: Technology and Infrastructure
The technology dimension is usually the easiest to fix with money, which is exactly why it should not dominate the assessment. It scores whether your current systems can feed and host AI tools securely — not whether you own anything exotic.
The baseline that matters
For most UK SMEs the honest checklist is mundane: identity in one place (typically Microsoft 365 or Google Workspace) with multi-factor authentication enforced; core applications that expose data through APIs rather than exports; no business-critical workload on unsupported operating systems; and joiner-leaver processes that actually remove access. If that list is shaky, an AI tool simply gives faster access to insecure systems.
Integration beats horsepower
You almost certainly do not need GPUs, and you may not need any new infrastructure at all. What you need is for the AI tool to reach the systems where work happens — the CRM, the finance system, the document store. Score this part of AI readiness by integration reachability, not compute. Where data sensitivity rules out cloud tools, weigh the private AI deployment options before concluding you cannot proceed at all.
Shadow AI is a technology signal too
If staff are already using personal ChatGPT accounts for work, your technology dimension has a finding: demand exists and controls do not. Blocking is rarely the answer; providing a sanctioned, secured alternative usually is.
Dimension 5: Governance, Security and Compliance
Governance is the dimension UK businesses most often score zero on without realising it, because nothing has gone wrong yet. It measures whether AI use is owned, written down and legally defensible — before an incident, a customer question or an ICO enquiry forces the issue.
The minimum viable governance set
Four artefacts constitute the floor: an acceptable-use policy telling staff what may and may not go into AI tools; a record of what data each tool can see; a human-review rule for any AI output that reaches customers or decisions; and an incident route when something goes wrong. None of these needs to exceed two pages. The ICO’s guidance on AI and data protection and the NCSC’s secure AI development guidelines give you the skeleton for free.
Risk assessment is part of AI readiness
If the use case touches personal data, a Data Protection Impact Assessment may be legally required, and is good practice regardless. Structure the exercise once and reuse it — our AI risk assessment template maps the common risk categories to the NIST AI RMF so you are not inventing a methodology from scratch. Cybersecurity fundamentals belong in this score too: an organisation that cannot pass Cyber Essentials is not ready to wire an AI tool into its data.
Regulation is arriving on a schedule
The UK’s pro-innovation approach keeps AI regulation principles-based for now, but the EU AI Act applies in phases to anyone selling into Europe, and sector regulators are publishing expectations. Scoring this corner of AI readiness honestly today is dramatically cheaper than retrofitting it under regulatory attention later.
Dimension 6: Budget and ROI Discipline
The final dimension scores whether the money is real: full-lifecycle funding, a defined success measure, and a named person accountable for the return. AI projects do not fail for lack of enthusiasm at sign-off; they fail eleven months later when the invoices keep arriving and nobody can say what changed.
Budget the lifecycle, not the pilot
A credible first-project budget covers discovery, the pilot build, integration, training, governance setup and — the piece most often missing — running costs: licences, API usage, monitoring and periodic review. Our breakdown of AI consulting cost UK rates puts realistic numbers on each phase; the worked example later in this article shows the shape in miniature.
Define success before you start
“Save time” is not a success measure. “Cut invoice-processing time from four days to one, measured over eight weeks, against the baseline recorded in March” is. A business that cannot write the second kind of sentence scores 2 on this dimension, whatever its bank balance, because it has no way to know whether to scale, adjust or stop.
Small budgets are fine; open-ended ones are not
AI readiness does not require a big budget. A tightly-scoped £10,000 pilot with a defined metric is a level-4 answer; a £100,000 “AI transformation programme” with no metric is a level-1 answer wearing a nicer suit.
How to Score Your AI Readiness
Scoring your AI readiness converts opinions into a picture you can act on. Rate each of the six dimensions from 1 to 5 using the matrix below, insisting on observable evidence for anything above a 2. Do it with at least three people — an owner or director, someone technical, and someone who does the target work daily — and score separately before comparing, because the gaps between scorers are themselves findings.
| Score | Level | What the evidence looks like |
|---|---|---|
| 1 | Absent | Nothing exists; the question has never been asked |
| 2 | Ad hoc | Individuals improvise; nothing is written down or owned |
| 3 | Defined | Documented and owned, but inconsistently followed |
| 4 | Managed | Consistently practised and measured; gaps are known |
| 5 | Optimised | Routinely reviewed and improved; evidence on demand |
A worked example
Take a 45-person wholesale distributor that wants AI on customer emails and stock queries. Scoring honestly, it lands: data 2 out of 5 (40%), people and skills 1 out of 5 (20%), process 3 out of 5 (60%), technology 3 out of 5 (60%), governance 2 out of 5 (40%), budget 2 out of 5 (40%). The profile below makes the diagnosis obvious at a glance — the weakest bars, not the average, set the agenda.
Reading the profile
Three patterns cover most businesses. Balanced-low (mostly 1s and 2s): do not start an AI project; run the 90-day foundation plan below first. Spiky (like the example — one or two dimensions far below the rest): proceed, but make the weak dimension the first project; here, a people-and-data programme wrapped around one narrow use case. Balanced-mid (3s across the board): pick the highest-value documented process and go, with governance formalised in parallel. A total of 18 out of 30, with no dimension below 2, is a sensible “ready to pilot” bar.
AI Readiness Red Flags: Signs You Are Not Ready Yet
Some findings override any total AI readiness score. Treat each of these as a stop sign, because each one has sunk projects that looked healthy on paper.
Stop signs in the data and systems
Customer or job records that two systems disagree about, with no process to reconcile them. Business-critical workloads on unsupported software. No tested backup — if you cannot survive losing a system, you have no business wiring new tools into it. Any of these caps your effective AI readiness at “fix this first”, whatever else scores well.
Stop signs in the people and politics
No named owner who wants the project to succeed. A use case chosen by seniority rather than by value. Staff hearing about the project through rumour — AI plus secrecy equals a quiet internal resistance movement. And the classic: “the AI project” is actually a cost-cutting project that nobody will say out loud, which staff detect immediately and sabotage rationally.
Stop signs in the plan itself
No success metric. No baseline measurement. No budget line for training or running costs. A timeline that assumes the first attempt works. A vendor contract signed before the use case was chosen. Each of these is cheap to fix now and expensive to discover in month nine.
A 90-Day Plan to Improve Your AI Readiness
An AI readiness assessment without a plan is just a mood. The plan below takes a business from “spiky or balanced-low” to genuinely pilot-ready in one quarter, and every step pays for itself even if the AI project never follows.
| Days | Focus | Output |
|---|---|---|
| 1–30 | Score, decide, own | Six-dimension scores, one chosen use case, a named owner, baseline measurements |
| 31–60 | Fix the floor | Acceptable-use policy, MFA everywhere, target data cleaned and reachable, process documented |
| 61–90 | Prove it small | A scoped pilot with 3–5 users, weekly review against the baseline, go/no-go decision recorded |
What the first quarter costs
For a typical SME running this with outside help, the shape of a £34,000 first quarter looks like this: discovery and data audit £6,000, pilot build £14,000, integration and testing £7,000, training and rollout £4,000, governance setup £3,000. Run it in-house with a consultant only at the review points and the cash cost falls sharply, at the price of elapsed time.
Keep the scope insultingly small
The pilot should feel too small to matter: one process, a handful of users, eight weeks. Small pilots produce clean evidence and cheap failures; broad pilots produce ambiguous evidence and expensive ones. Scaling a proven small win is easy — rescuing a sprawling unproven one is not.
DIY or Consultant-Led AI Readiness Assessment?
You can run this entire AI readiness framework yourself with the tables above, and for many businesses that is the right call. The honest trade-off is objectivity and speed against cash.
| Factor | DIY assessment | Consultant-led |
|---|---|---|
| Cash cost | Internal time only | Roughly £3,000–£10,000 at UK SME rates |
| Objectivity | Vulnerable to optimism and politics | Scores anchored to evidence seen elsewhere |
| Speed | 2–6 weeks around day jobs | Typically 1–2 weeks elapsed |
| Benchmarks | None beyond this article | Comparison against similar firms |
| Best when | Scores are likely low; budget is tight | Board sign-off or investment depends on it |
A sensible hybrid
Score yourselves first with the matrix in this article, then buy a day of external challenge on the two dimensions where your scorers disagreed most. That preserves most of the objectivity benefit at a fraction of the cost, and it makes the eventual AI strategy conversation dramatically more productive because it starts from evidence rather than aspiration.
What to demand from any assessor
Whoever runs the assessment, insist on the same outputs: six evidence-anchored scores, the three decisions (proceed, narrow, pause) argued explicitly, a costed 90-day plan, and no product recommendation in the same document. An assessment that ends in a licence quote was a sales call.
AI Readiness FAQ
How long does an AI readiness assessment take?
Self-run with the matrix above: two to six weeks of part-time effort, mostly spent gathering evidence rather than debating scores. Consultant-led: one to two weeks elapsed. If the exercise is taking a quarter, it has become the very kind of unscoped project it exists to prevent.
What does it cost?
DIY costs internal time. UK consultant-led assessments for SMEs typically run £3,000–£10,000 depending on size and scope — a small fraction of the pilot budget it protects, and roughly the cost of one month of a stalled project.
What score means we are ready?
As a rule of thumb: 18 or more out of 30, with no dimension below 2 and none of the red flags present. But the profile matters more than the total — a spiky profile with excellent technology and absent governance is less ready than a flat profile of 3s.
We are a 10-person business. Is this overkill?
Scale it down, not away. A micro-business can score the six dimensions in an afternoon and fix the floor in a fortnight. The failure causes are identical at every size; only the number of meetings changes.
How often should we reassess?
Re-score after every completed project and at least annually. AI readiness decays: staff leave, data drifts, tools change and regulation tightens. The second assessment is faster — you already have the evidence habit — and the trend line between the two is management information in its own right.
References
NIST AI Risk Management Framework
NIST AI 100-2: Adversarial Machine Learning Taxonomy
NIST SP 800-30: Guide for Conducting Risk Assessments
ICO Guidance on AI and Data Protection
ICO Data Protection Impact Assessments
NCSC Guidelines for Secure AI System Development
UK Government: AI Regulation — A Pro-Innovation Approach
UK Government: AI Activity in UK Businesses
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.