AI adoption · free checklist · updated October 2026
AI Readiness Assessment Checklist: 36 Questions to Score Your Company
Before you start
What an AI readiness assessment measures, and what it does not
Most companies already have people using AI. Some have bought licences; a few have run pilots. What is usually missing is an honest, shared picture of whether the organisation is ready to move from scattered experiments to everyday use. That is the job of a readiness assessment: one score, six sub-scores and a short list of blockers that leadership can act on.
It is not a technology audit, and it is not a training-needs survey. It looks at the whole system: whether there is a clear reason to use AI, rules people trust, data that can be used, tools that are secure, people who know how to use them, and processes that can absorb change. Two related guides go deeper on single pillars: our AI skills gap analysis covers people and roles, and how to identify AI use cases covers where to start.
- Strategy and use cases: is there a business reason and a shortlist?
- Leadership and governance: are there rules, owners and approvals?
- Data: can AI reach the right information, and only that?
- Technology and security: are the tools approved, connected and controlled?
- People and skills: can employees and managers use AI well?
- Process, change and measurement: will new ways of working stick?
Scoring
How to score each question, and what your total means
Use the same three-point scale for every question. Ask for evidence before giving a 2: a document, a screen, a record or a named owner. Scores without evidence drift upwards.
| Score | Meaning | Typical evidence |
|---|---|---|
| 0 | No, or not started | Nothing written down; nobody owns it |
| 1 | Partly: in some teams, or planned | A draft, a pilot, or one team doing it well |
| 2 | Yes: documented and in use across the company | A live document, system or record that others can check |
Six pillars of six questions give a maximum of 72. Place your total in a stage:
| Total (of 72) | Stage | What it usually looks like |
|---|---|---|
| 0–14 | 1. Exploring | Individuals try AI on personal accounts; no shared view, rules or tools |
| 15–29 | 2. Experimenting | Some approved tools and enthusiasm, but scattered use and no measures |
| 30–44 | 3. Piloting | Policy and tools in place; a few owned pilots with success measures |
| 45–59 | 4. Scaling | A repeatable path from pilot to team-wide use; training by role |
| 60–72 | 5. Embedded | AI is part of how work is designed, measured and governed |
One rule overrides the total: any pillar scoring 4 or less out of 12 is a blocker. Fix it before you scale, even if the overall score looks healthy.
The checklist
The 36-question AI readiness checklist
Each pillar has six questions, the evidence to ask for, what a full score looks like and the quickest ways to improve. Score honestly; the aim is a useful plan, not a high number.
Pillar 1. Strategy and use cases
AI without a business reason becomes a licence bill. Readiness starts with a small number of outcomes leadership cares about and a ranked list of places where AI could move them.
- Leadership has named three to five business outcomes AI should improve in the next 12 months. [ 0 / 1 / 2 ]Evidence: a leadership note or plan with the outcomes written down
- There is a written list of candidate AI use cases, each with an owner and a rough value estimate. [ 0 / 1 / 2 ]Evidence: a use-case register or backlog
- Use cases are ranked by value and feasibility, not by which tool a vendor is promoting. [ 0 / 1 / 2 ]Evidence: the scoring method and the ranked list
- An executive sponsor is accountable for AI adoption and has time set aside for it. [ 0 / 1 / 2 ]Evidence: a named sponsor in a role description or steering note
- There is budget for AI tools, training and change work, not only for licences. [ 0 / 1 / 2 ]Evidence: budget lines for each
- Success measures for the first use cases were agreed before work started. [ 0 / 1 / 2 ]Evidence: a one-page brief per use case with a baseline
- Outcomes in the leadership plan
- A ranked, owned use-case list
- Budget that includes people and change
- Run a two-hour leadership session to agree outcomes
- Collect use cases from each function head
- Score them on value, feasibility and risk
- Owner
- CEO or COO, with an executive sponsor
- Evidence
- Plan, use-case register, budget
- Typical gap
- Licences bought before outcomes were agreed
- Go deeper
- How to identify AI use cases
Pillar 2. Leadership and governance
People use AI more, and more safely, when the rules are clear. Governance here means a short policy, a list of approved tools, and a named person who decides on higher-risk uses.
- A written AI usage policy exists and employees know where to find it. [ 0 / 1 / 2 ]Evidence: the policy and where it is published
- There is a list of approved AI tools and a simple route to request new ones. [ 0 / 1 / 2 ]Evidence: the tools register and request form
- A named person or group approves higher-risk AI uses. [ 0 / 1 / 2 ]Evidence: terms of reference or an approval log
- Leaders can explain in plain words what AI may and may not be used for. [ 0 / 1 / 2 ]Evidence: ask three leaders; compare answers
- Client contracts and NDAs with AI restrictions have been identified. [ 0 / 1 / 2 ]Evidence: a contract register with an AI column
- AI-related risks appear in the company risk register and are reviewed. [ 0 / 1 / 2 ]Evidence: risk register entries and review dates
- A policy people can quote
- A current tools register
- A named approver for high-risk use
- Adapt our AI policy template
- Publish the approved tools on the intranet
- Add AI to the next risk-register review
- Owner
- CIO, COO or a governance lead
- Evidence
- Policy, tools register, approvals
- Typical gap
- Rules exist but nobody has been told
- Reference
- India AI Governance Guidelines (MeitY, November 2025)
Pillar 3. Data
AI assistants and agents are only as useful as the information they can reach, and only as safe as the permissions around it. This pillar checks both.
- You know where the data for your top use cases lives and who owns it. [ 0 / 1 / 2 ]Evidence: a simple data map for each priority use case
- Information is classified, for example as public, internal, confidential or restricted, and people use the labels. [ 0 / 1 / 2 ]Evidence: the classification scheme and labelled samples
- Key documents and records are digital, searchable and reasonably current. [ 0 / 1 / 2 ]Evidence: a spot check of five important folders
- Personal data used in AI tasks has been mapped against your DPDP Act duties. [ 0 / 1 / 2 ]Evidence: a note from the data protection lead
- File and system permissions are tidy enough that an AI assistant would not surface files people should not see. [ 0 / 1 / 2 ]Evidence: an access review of shared drives and sites
- Someone is responsible for data quality in each priority area. [ 0 / 1 / 2 ]Evidence: named data owners
- A data map for each priority use case
- Labels used day to day
- Permissions reviewed before AI goes live
- Map data for the top three use cases only
- Clean up over-shared folders first
- Ask legal for a short DPDP note on AI use
- Owner
- Data or IT lead, with the data protection lead
- Evidence
- Data map, labels, access review
- Typical gap
- Over-shared drives that AI search exposes
- Law
- DPDP Act, 2023 and DPDP Rules, 2025
Pillar 4. Technology and security
This pillar asks whether employees have secure, approved AI tools that connect to the systems they work in, and whether IT can see and control what is happening.
- Employees have access to at least one AI assistant on a business plan with written data terms. [ 0 / 1 / 2 ]Evidence: the plan and the vendor’s data terms
- Single sign-on, multi-factor authentication and device management cover the AI tools in use. [ 0 / 1 / 2 ]Evidence: identity and device settings
- IT can see which AI tools are being used, including unapproved ones. [ 0 / 1 / 2 ]Evidence: a report from network or browser controls
- Core systems such as CRM, ERP, HRMS and document stores can connect to AI tools through supported integrations. [ 0 / 1 / 2 ]Evidence: an integration list
- Security has reviewed vendor terms, data location and retention for every approved tool. [ 0 / 1 / 2 ]Evidence: a vendor review record
- There is a way to log, monitor and switch off AI agents and automations. [ 0 / 1 / 2 ]Evidence: logs and an owner for each automation
- Business plans, not personal accounts
- Visibility of shadow AI
- Agents with logs and an off switch
- Move power users to a business plan first
- Turn on reporting for AI sites
- Start agents in draft-only mode
- Owner
- CIO and the security lead
- Evidence
- Plans, settings, vendor reviews, logs
- Typical gap
- Good tools bought, permissions left open
- Reference
- NIST AI RMF; ISO/IEC 42001
Pillar 5. People and skills
In most organisations this is the pillar that decides whether AI pays off. Tools are easy to buy; habits are not. The questions look at employees, managers and the specialists who make AI work.
- Most employees have had basic, hands-on AI training on the approved tools. [ 0 / 1 / 2 ]Evidence: training records by function
- Managers know how to review AI-assisted work before it leaves the team. [ 0 / 1 / 2 ]Evidence: a review checklist managers actually use
- Each function has at least one person who designs and shares good AI workflows. [ 0 / 1 / 2 ]Evidence: a list of named champions
- AI skills have been assessed by role, not just counted as course completions. [ 0 / 1 / 2 ]Evidence: a role-based skills assessment
- Technical teams have the skills to integrate and secure AI tools. [ 0 / 1 / 2 ]Evidence: skills plans for IT, data and engineering
- Employees feel safe saying where AI is and is not working. [ 0 / 1 / 2 ]Evidence: pulse-survey comments or retro notes
- Hands-on training on your own tools
- Managers who can review AI output
- A named champion in every function
- Run short, role-based sessions on real tasks
- Give managers a one-page review checklist
- Name one champion per function
- Owner
- CHRO and the L&D lead
- Evidence
- Training records, skills assessment
- Typical gap
- Training done once, with no follow-up
- Go deeper
- AI skills gap analysis
Pillar 6. Process, change and measurement
New tools do not change results unless the work itself changes. This pillar checks whether you can redesign workflows, run pilots to a decision, explain the change to people and measure what moved.
- Target workflows are documented well enough to redesign them. [ 0 / 1 / 2 ]Evidence: process maps or standard operating procedures
- Each pilot has a business owner, a timeline and a date to decide whether to scale or stop. [ 0 / 1 / 2 ]Evidence: pilot briefs with decision dates
- A communication plan explains why the company is adopting AI and what it means for roles. [ 0 / 1 / 2 ]Evidence: the plan and the messages already sent
- Time saved or quality gained is measured against a baseline. [ 0 / 1 / 2 ]Evidence: before-and-after measures for at least one workflow
- Lessons from pilots are written down and shared across teams. [ 0 / 1 / 2 ]Evidence: a shared page of lessons and prompts
- Incentives and performance goals do not discourage people from using approved AI. [ 0 / 1 / 2 ]Evidence: a review of goals in one or two functions
- Pilots with decision dates
- A baseline for every measured workflow
- Lessons shared, not lost
- Pick one workflow and measure it before and after
- Put a decision date on every pilot
- Explain what AI means for roles, early
- Owner
- COO with function heads
- Evidence
- Pilot briefs, baselines, comms plan
- Typical gap
- Pilots that never end or scale
- Reference
- BCG 10-20-70 principle
Score sheet
Your AI readiness score sheet
Copy this table into a spreadsheet. Ask each panel member to score alone first, then agree a final score together. Record the lowest pillar as well as the total.
| Pillar | Questions | Max | Panel average | Agreed score |
|---|---|---|---|---|
| 1. Strategy and use cases | 1–6 | 12 | … | … |
| 2. Leadership and governance | 7–12 | 12 | … | … |
| 3. Data | 13–18 | 12 | … | … |
| 4. Technology and security | 19–24 | 12 | … | … |
| 5. People and skills | 25–30 | 12 | … | … |
| 6. Process, change and measurement | 31–36 | 12 | … | … |
| Total | 36 | 72 | … | … |
Running the assessment
How to run an AI readiness assessment in ten working days
A readiness assessment should be quick enough to finish before priorities change. This plan suits companies of 50 to 5,000 people.
After the score
What to do next at each stage
| Stage | Priority for the next 90 days | Avoid |
|---|---|---|
| 1. Exploring (0–14) | Agree outcomes, issue a short policy, approve one business AI assistant, run awareness sessions | Large platform purchases before you know the use cases |
| 2. Experimenting (15–29) | Build the use-case list, name a sponsor, train power users on real tasks, start measuring one workflow | Letting every team buy its own tools |
| 3. Piloting (30–44) | Run two or three owned pilots to a decision, tidy data permissions, train managers to review output | Pilots with no end date |
| 4. Scaling (45–59) | Role-based training across functions, a champion network, shared prompt libraries, quarterly reporting | Scaling a pilot that never measured a baseline |
| 5. Embedded (60–72) | Redesign end-to-end processes, govern agents, refresh skills as tools change | Assuming the job is done |
Where Skillopedia fits
From a readiness score to people who use AI well
Skillopedia is a corporate AI training firm (Skillopedia LLP, Mumbai, est. 2017) that has worked with 335+ organisations across 13 sectors. We do not sell software or audits. Every engagement runs on our FLUENT framework, and its first stage, Frame, is a readiness review of your tools, policies, skills and the workflows that take the most hours.
Where we help most is pillars 5 and 6: hands-on sessions where teams practise on their own work in your approved tools, manager briefings on reviewing AI output, champion networks, and follow-up clinics that keep adoption going. For leadership teams setting direction (pillar 1), see AI for CXOs and business leaders; for company-wide basics, see our guide to AI literacy training for employees. Participants rate our programmes 4.8/5 on average (300+ surveyed).
Frameworks behind the checklist
Published frameworks worth knowing
Cisco AI Readiness Index. Scores organisations on six pillars (strategy, infrastructure, data, governance, talent and culture) using 49 indicators, and groups them into four tiers from Pacesetters to Laggards. Our six pillars are similar but split people from process and fold culture into change.
BCG’s 10-20-70 principle. BCG describes AI leaders putting about 10% of effort into algorithms, 20% into technology and data, and 70% into people and processes. That is why two of our six pillars are about people and change.
NIST AI Risk Management Framework. A voluntary US framework released in January 2023, organised around four functions: Govern, Map, Measure and Manage. NIST added a Generative AI Profile in July 2024.
ISO/IEC 42001:2023. The international standard for an AI management system, published in December 2023, for organisations that develop, provide or use AI. Useful if you later want a certifiable system.
India’s DPDP Act and Rules, and the India AI Governance Guidelines. The DPDP Rules were notified on 14 November 2025 with an 18-month phased timeline. MeitY’s non-binding AI Governance Guidelines (November 2025) list capacity building as one of six pillars, which matches the people pillar here.
Getting it right
Five mistakes that make readiness scores useless
Scoring without evidence
A 2 should point to something others can check. Without evidence, scores reflect optimism, and the plan built on them fails.
Asking only IT
Technology is one pillar of six. Function heads, HR and legal see blockers that IT cannot, especially in people and change.
Chasing the total
A good total can hide a blocker. A company scoring 50 with a data pillar of 3 is not ready to scale.
Taking months
An assessment that runs for a quarter is out of date when it lands. Ten working days is enough for a first pass.
No owner for the actions
Every gap needs a named owner and a date, or the score becomes a slide nobody revisits.
Never reassessing
Tools and skills change fast. Re-score every six months, and after any major rollout, to see what moved.
For CXOs, HR and L&D leads
Scored your company? Let’s close the people gaps.
Share your total, your weakest pillar and the tools you have approved. We reply within one working day, and after a short call you receive a written proposal that can cover:
- a leadership session to agree outcomes and use cases
- hands-on, role-based training on your approved tools
- manager briefings on reviewing AI output
- a champion network and a 90-day follow-up
Ask for an AI adoption training proposal
We reply within one working day. No obligation.
FAQ
AI readiness assessment: common questions
What is an AI readiness assessment?
It is a structured review of whether a company can adopt AI safely and get value from it. It scores areas such as strategy, governance, data, technology, people and change, and turns the gaps into a short action plan.
What are the five stages of AI readiness?
There is no single official model. The scale on this page uses five stages based on the 72-point score: Exploring (0–14), Experimenting (15–29), Piloting (30–44), Scaling (45–59) and Embedded (60–72).
What are the five pillars of AI readiness?
Frameworks differ. Five-pillar versions usually cover strategy, data, technology, people and governance. Cisco’s index uses six pillars (strategy, infrastructure, data, governance, talent and culture), and this checklist uses six, adding process and change.
How to measure AI readiness?
Score a fixed set of questions on a simple scale, ask for evidence behind each score, and total them by pillar. Track the same questions over time so you can see what moved after training, tools or policy changes.
What is the 10/20-70 rule for AI?
It is a BCG principle for where AI effort should go: about 10% on algorithms, 20% on technology and data, and 70% on people and processes. It is a guide to effort, not a measured result for your company.
How long does an AI readiness assessment take?
A first pass takes about ten working days with a panel of six to ten people: a day to set up, a few days of independent scoring, evidence gathering, one calibration workshop and a planning session.
Who should complete the AI readiness assessment?
A cross-functional panel: an executive sponsor, IT and security, data, HR or L&D, legal or compliance, and two or three function heads who own the workflows AI will change.
Is this AI readiness assessment template free?
Yes. Copy and adapt the 36 questions and the score sheet for your own company. Please treat it as a planning aid rather than an audit or certification.
How is AI readiness different from AI maturity?
Readiness asks whether you have the foundations to adopt AI now. Maturity describes how far AI is already built into the business. In practice the stages overlap, which is why this checklist ends with an Embedded stage.
How is a readiness assessment different from a skills gap analysis?
A skills gap analysis looks at people and roles only. A readiness assessment covers the whole organisation, with skills as one of six pillars. Our AI skills gap analysis guide goes deeper on that pillar.
What should we do after an AI readiness assessment?
Fix any pillar scoring 4 or less, pick two or three use cases with owners and decision dates, and train the people who will use AI on those exact tasks. Then reassess in six months.
Does the DPDP Act affect AI readiness in India?
Yes. Personal data used with AI tools is still personal data under the DPDP Act, 2023, and the DPDP Rules, 2025 phase in duties over 18 months. Map personal data in your use cases and take legal advice on specifics.
How often should we reassess AI readiness?
Every six months is a sensible rhythm, and after any major rollout, policy change or new tool. Use the same questions each time so the scores are comparable.
Related
Where to go next
Next step
Turn your readiness score into a plan people follow
Tell us your score, your weakest pillar and your teams. We reply within one working day with a few questions, then send a written proposal with a fixed fee.
- Training built around your approved tools
- Practice on your own workflows
- A 90-day follow-up to check what moved
Ask for an AI adoption training proposal
Reply within one working day.