AI readiness assessment: how to run your own in two weeks

An AI readiness assessment is a short check of whether your company can put AI to work on a specific job now, and what has to change first. A useful one scores six areas, keeps the evidence behind each score and ends in a decision: start a pilot, fix something first, or use plain automation instead.

This guide is for operations, IT and finance leaders at mid-size and large companies who want to run that check themselves, in about two weeks, with evidence instead of a quiz score. For where AI tends to pay off first, see our guide to AI solutions.

Why run an AI readiness assessment at all?

Because AI may already be in use. In a May 2026 review of its Business Trends and Outlook Survey data from December 2025 to May 2026, the U.S. Census Bureau reported that 37% of firms with at least 250 employees used AI in their business operations. In the period ending May 3, 2026, 32% of firms with 100 to 249 employees did.

So the useful question is which job is ready, what is missing for the rest and what is already running.

Readiness belongs to a job, not to the whole company. The same company can be ready to answer staff questions from its policy documents and not ready to read supplier invoices, because the invoices arrive in three formats and nobody owns the supplier records. A single score from an online quiz can't tell you which.

The National Institute of Standards and Technology (NIST) frames the same decision. Its AI Risk Management Framework (AI RMF 1.0, January 2023) is voluntary and built on four functions: Govern, Map, Measure and Manage. Once the Map work is done, it says, an organization should know enough "to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system." That go/no-go is what this assessment produces.

What does an AI readiness assessment include?

Six areas. Each one gets a few questions, the evidence that answers them and a plain "ready" or "not yet." Score one candidate job at a time, up to three in one round.

Area	Questions to answer	Evidence to collect	"Ready" looks like
The work and its volume	Which job, how often, and what does a mistake cost?	Monthly volume, time per item, error and rework counts	One named job, a steady flow and a measured baseline
Data	Where does the input live, how complete is it, and who owns it?	Real samples, including awkward cases; each source and its owner	Samples pulled in days, with an owner who vouches for them
Systems and access	Which systems must it read or update, and how?	Each system's way in (published interface, export or none) and its admin	A way into every system, through its own account with limited access
Security and privacy	Which kinds of data are involved, and where would they go?	Data classes, provider terms on training and retention, outside parties with access	Security and legal approve that data for that tool, in writing
People and ownership	Who owns the result, who checks it, and who needs training?	A named owner, reviewer and sponsor; reviewer time set aside	An owner, a reviewer with time and a sponsor who signs off
Governance and measurement	Which policy applies, what is already in use, and how is success measured?	Use policy, inventory of AI tools, success measure, who can switch it off	A written measure, a review date and a named person who can stop it

How do you run the assessment in two weeks?

An example schedule for one to three candidate jobs:

1. Days 1 and 2: set it up. Name a sponsor from the leadership team and one person to run the assessment. List the candidate jobs and pick up to three.
2. Days 3 to 7: collect evidence. Sit with the people who do each job. Pull volumes and samples, list the systems, and ask security and legal for the data rules and provider terms.
3. Days 8 and 9: score. Mark each area ready or not yet, with the evidence attached and an owner for each gap.
4. Day 10: decide. The sponsor, the job owner, security and legal agree what happens next for each job.

Keep everything in one shared folder. The evidence is the point: a "ready" with nothing behind it is a guess.

How do you score each area?

The work and its volume

Name the job precisely: "read supplier invoices and code them," not "AI for finance." NIST's framework expects the business value or context of use to be clearly defined. Count a few months of volume and time the work now; without a baseline, nobody can say after a pilot whether it helped. If every step can be written as a rule, it is a job for plain automation. Our guide to AI vs automation shows how to sort the steps.

Not yet: no named job, or no count of how often it happens.

Data

Pull real examples, not the clean ones: the scanned form, the email with three attachments, the record with a missing field. NIST lists data availability, representativeness and suitability among the things to identify and document. You don't need perfect data, but you need to know where it lives and who answers for it.

Not yet: the input sits in personal mailboxes and drives, or nobody will vouch for it.

Systems and access

List every system the job touches and how each can be reached: a published interface, a scheduled export, or nothing. Each connection should run on its own account with only the access its step needs, never a person's login.

Not yet: the only way in is someone's password, or nobody can name a system's admin.

Security and privacy

Classify the data the job would touch, then check where it would go. NIST's Generative AI Profile (NIST AI 600-1, July 2024) names data privacy as a risk: leakage and unauthorized use or disclosure of personal or sensitive data. It also suggests an inventory of outside parties with access to company content, and approved lists of AI tools and providers. For what "private" should mean in practice, see our guide to a private AI system.

Not yet: nobody can say, from the contract, whether the provider may train on your data or how long it keeps it.

People and ownership

NIST asks that roles be documented and clear, and that executive leadership take responsibility for decisions about AI risks. Name a business owner for the result, not only IT. Name the reviewer and give them time: NIST's profile notes that generative AI may warrant "additional human review, tracking and documentation, and greater management oversight." Plan training for the people who will check the output.

Not yet: "IT will own it," or reviewers with no time set aside.

Governance and measurement

Start with what is already running. NIST's framework calls for a way to inventory AI systems, and its profile suggests deciding, in policy, how to treat generative features built into software you already use. Write the success measure against the baseline, set a review date and name who can switch it off. NIST expects mechanisms to "supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use."

Not yet: no use policy, no inventory, or no agreed measure of success.

What do you do with each result?

• Ready in all six areas: run a pilot on that one job, with a person reviewing every output, and compare it with the baseline.
• Not yet in one or two areas: fix those first, with an owner and a date for each gap, then re-score only those areas.
• Not yet on the work or the data: pick a different job rather than forcing this one.
• The job runs on rules: automate it without AI. NIST's framework asks organizations to weigh "viable non-AI alternative systems, approaches, or methods."
• Not yet on security or governance across the board: stop and write the policy, the data rules and the inventory. These gaps block every job, not just one.

Repeat the assessment when something changes: a new provider, a new system or a new kind of data.

How does Raileon help with AI readiness?

Most automation consulting ends with a report. Ours ends in working systems. Through automation consulting, we map how work really moves, score each step by the hours it takes and the risk if it goes wrong, and use AI only where a step needs judgment.

We check what data exists and tell you if a gap would block the use case, and you get a yes, no or "needs work" for each system. A written proposal sets out what to automate first, what it connects to and the approval rules, with the exact price in writing. The same team builds it, tests it on real cases from your business and runs it. By default, anything a client will see waits for your approval.

Every client's data is kept separate, encrypted in transit and at rest, and backed up daily. We never use your data to train AI models, unless you hire us to train your own model. Monthly care starts from $1,999 a month. Cancel any time. Your plan runs to the end of the month you've paid for. No exit fee.

FAQ

What is an AI readiness assessment?

It is a check of whether a company can use AI for a specific job now, scored across the work, data, systems, security, people and governance. Each score rests on evidence, and the result is a decision: pilot, fix first or automate without AI.

Is there a standard AI readiness assessment framework?

There is no single required one. A free, public base is NIST's voluntary AI Risk Management Framework, with four functions (Govern, Map, Measure and Manage), and NIST says its actions are not a checklist, so you pick what fits.

How long does an AI readiness assessment take?

For one to three candidate jobs at a mid-size company, about two weeks: one to collect evidence and one to score and decide. A review of every department at once takes longer.

Who should run an AI readiness assessment?

One person from operations or IT, with a sponsor from the leadership team who makes the final call. Security, legal and the people who do the work each supply the evidence for their areas.

Not sure which job is ready for AI?

Bring one job your team repeats every week. On a free 20-minute call, we'll check what exists and tell you if a gap would block it.

Book a free 20-minute call