AI Readiness Assessment: What It Covers and a Scorecard You Can Use

An AI readiness assessment checks whether a specific business process can be automated with AI now, and what is missing if it cannot. It looks at six things: whether the process is clearly defined, whether the data is reachable and usable, whether the systems can be connected, whether the right people have time to help, whether the risks are understood, and whether success can be measured. The output is a decision, not a report.

This post gives you a scorecard for doing that yourself, one process at a time, before you talk to an agency. For the full buying process, see our guide to choosing an AI automation agency.

Why assess one process, not the whole company

Many readiness surveys rate an entire organization on strategy, culture and skills. Those ratings can be useful for leadership, but they rarely tell you what to build first. A company with a low overall score can still have one process that is ready today, and a high-scoring company can pick a process that is not.

So assess candidate processes, not the company. This matches how risk frameworks approach AI. The NIST AI Risk Management Framework organizes AI risk work into four functions: govern, map, measure and manage. It is voluntary and written for whole organizations, but a readiness assessment is a lightweight way to start that work on one concrete process.

The six dimensions

1. Process

Is there a clear start, end and owner? Can someone write down the steps, the rules and the common exceptions? OpenAI's practical guide to building agents suggests looking for work that involves complex decisions, rules that are hard to maintain, or heavy reliance on unstructured data, and notes that otherwise "a deterministic solution may suffice." Part of readiness is confirming that AI is the right tool at all.

2. Data

Can you get real examples of the inputs and the correct outcomes? Fifty to a hundred past cases with known results are enough to test most first ideas. The UK government's Guidelines for AI procurement put it plainly: "Data is currently the basis of the majority of AI-powered solutions," and they advise assessing data before going to market.

3. Systems

Do the systems involved have APIs, exports or integrations? Can you create test accounts and credentials? A process that depends on a legacy screen with no way in is not unready, but it is slower and more expensive.

4. People

Is there a process owner who can make decisions every week? Is IT able to grant access? Who will review exceptions once the system is live? Readiness is often limited by time, not technology.

5. Risk and compliance

What happens if the system gets something wrong? Does it handle personal data, money or decisions about people? In the UK, the ICO's guidance on when a DPIA is needed lists innovative technology, including "the novel application of existing technologies (including AI)," among the criteria that can make a data protection impact assessment necessary, and recommends doing one if in doubt. The ICO notes that this guidance is under review following the Data (Use and Access) Act, so check the current version.

6. Measurement

Do you know today's volume, time per item, error rate and cycle time, even roughly? Without a baseline, nobody can say whether the AI system helped.

The scorecard

Score each dimension from 1 to 3 for the process you are considering.

	Score 1: not ready	Score 3: ready
Process	No owner; steps differ by person; no agreed outcome	Named owner; written steps, rules and exceptions; clear definition of done
Data	Examples scattered or unavailable; outcomes unknown	50 to 100 real cases with correct outcomes can be shared under NDA
Systems	No APIs or exports; access takes months	APIs or integrations exist; test credentials available in days
People	Owner and IT have no time this quarter	Owner available weekly; IT and reviewers identified
Risk	High-stakes, irreversible actions with no review step	Mistakes reversible or caught by checks; DPIA question answered
Measurement	No idea of volume, time or error rate	Baseline numbers recorded for the current process

Source: BufferSol readiness scorecard; score 2 sits between the two descriptions

BufferSol Technologies · buffersoltech.com

Add up the six scores (6 to 18) and use the total to decide the next step:

One rule overrides the total. If risk scores 1, do not start until there is a clear review step or a safer scope, however high the other scores are.

How to run it in three sessions

You do not need a consultant to do a first pass. Three focused working sessions are usually enough for one process.

1. Process session, with the process owner and one or two people who do the work. Walk through ten recent cases from start to finish. Write down the steps, the systems touched, the rules applied and where cases get stuck. Score process and measurement.
2. Data and systems session, with IT. List every system involved, how each one can be accessed, and how long credentials would take. Check whether past cases and their outcomes can be exported. Score data and systems.
3. Risk session, with whoever owns data protection and the process owner. Ask what happens when the system is wrong, which actions are reversible and whether personal data is involved. Decide whether a DPIA is needed. Score people and risk.

Record the scores, the evidence behind each one and the open questions on a single page. That page is what you bring to an agency.

Common readiness gaps and how to fix them

Most of these gaps are organizational rather than technical. Fixing them is cheap compared with the cost of starting a build on a process that is not ready.

Two examples

Take an accounts payable team processing supplier invoices. The process has an owner and clear rules, past invoices and their posted values are easy to collect, the accounting system has an API, and mistakes are caught by approval before payment. That profile scores high on most dimensions, which is why invoice processing often makes a good first project. It is the shape of our intelligent invoice processing build.

Now take an internal knowledge assistant over company documents. The process (answering staff questions) is clear and valuable, but readiness often depends on the data dimension: are the documents current, and do access permissions exist that the assistant can respect? In our enterprise knowledge assistant, answers use only documents each user is allowed to see, through single sign-on. Getting sources and permissions in order is part of being ready.

After the assessment

A readiness assessment should end with one of three decisions: start, fix first, or pick another process. If the answer is start, bring the scored process, the sample data and the named owner to your first agency conversation. It makes every proposal more accurate and easier to compare.

If you want help scoring your candidate processes, our autonomous workflows, AI agents and generative AI teams can work through the scorecard with you, or you can talk to an engineer.