AI readiness assessment for small and mid-sized businesses: a practical checklist

What is an AI readiness assessment?

An AI readiness assessment is a time-boxed review that answers three questions: where could AI genuinely help this business, what needs to be in place first, and is it worth doing now? It is sometimes called an AI readiness audit. An AI automation audit is a narrower version that looks only at repetitive tasks that could be automated, with or without AI.

The assessment is not a technology purchase. Its job is to stop you spending on tools before you know which problem you are solving, and to give you enough evidence to decide with confidence. It is most useful when at least one of these is true:

• Staff spend hours each week on the same repeat tasks.
• Enquiries wait too long for a reply, or go unanswered out of hours.
• You have been offered several AI tools and cannot tell which, if any, would help.
• You need a scoped plan to take to a partner, board or investor before spending.

What should you assess? Seven areas

You do not need perfect answers in every row. Gaps are findings in themselves: if nobody knows how many enquiries arrive each week, measuring that is step one.

Why start with one measurable workflow?

Trying to add AI across the whole business at once spreads attention thin and makes results impossible to measure. Choosing one workflow gives you a clear before and after. A good first workflow usually has these traits:

• It happens often, ideally daily or weekly.
• It follows a pattern a person could write down as steps.
• You can measure it: time per task, volume, response time or error rate.
• A wrong output is cheap to catch and correct.
• Someone in the business owns it and wants it improved.

Common candidates include answering repeat enquiries on web chat or WhatsApp, qualifying new leads before a call, booking and reminding appointments, drafting replies or proposals from templates, sorting incoming email, and extracting details from documents into a system.

Before changing anything, write down the current figures: for example, how many enquiries arrived last month, how long the first reply took on average and how many were never answered. Those numbers become the yardstick for any pilot.

How a five-working-day assessment runs

A focused assessment for a small or mid-sized business fits into five working days. This is the shape our AI-readiness sprint follows:

1. 1Day 1: kick-off and mapping. Agree the goals, meet the people who do the work and map the top workflows with their volumes.
2. 2Day 2: data, tools and touchpoints. Review where the data lives, what your current software can already do, how customers reach you, and how your website appears to search engines and AI assistants.
3. 3Day 3: risk and economics. Identify personal data and failure points, record baselines and estimate the effort for each option.
4. 4Day 4: shortlist and prototype. Rank options by value and effort, and build a working prototype or walkthrough of the top one so you can try it.
5. 5Day 5: handover. Walk through the written plan, agree the decision and, if you want to proceed, the scope of the next step.

Your team's time is usually a couple of working sessions plus quick answers to questions during the week.

What outputs should you expect?

• A workflow map showing where time goes today
• A baseline for the chosen workflow, so you can measure change later
• A ranked shortlist of opportunities, with value, effort and risk for each
• A data and risk summary: what personal data is involved and where a human must stay in control
• A recommendation on tools: use what you already have, buy, build, or wait
• A prototype or detailed walkthrough of the first workflow
• A clear next step with scope and timeline, which you can take to any supplier

Ask for everything in writing and in plain language. If you cannot explain the recommendation to a colleague after the handover, the assessment has not done its job.

Red flags to watch for

• Buying tools before defining the problem. Subscriptions bought first tend to go unused.
• No baseline. Without before figures, nobody can say whether a change helped.
• Guaranteed savings figures. A promised percentage before anyone has looked at your workflows is a sales line, not an estimate.
• Customer data pasted into tools without checking terms. Find out where data is stored, whether it is used for training and who can access it.
• No human fallback. Customer-facing automation needs a clear route to a person.
• Success measured by usage. Logins and messages sent are not outcomes; time saved, faster replies and fewer errors are.
• No owner. A pilot without a named person responsible usually stalls.

How to judge ROI without invented statistics

Industry-wide claims about AI returns tell you nothing about your business. Build the case from your own numbers instead:

1. 1Measure the workflow for two to four weeks: volume, time per task, response time and error rate.
2. 2Estimate the change conservatively, for example the share of enquiries a chatbot could fully answer, based on a review of real past messages.
3. 3Add up all costs: build, subscriptions, usage-based charges, maintenance, staff time to review outputs and training.
4. 4Run a small pilot on a slice of the work and measure the same figures.
5. 5Decide using the pilot results, not the estimate: stop, adjust or scale.

Risk, data protection and governance

Any workflow touching customer or staff data has legal obligations. In the UK, the ICO publishes guidance on AI and data protection (opens in a new tab) covering accountability, transparency, fairness and impact assessments; the ICO notes the guidance is under review following the Data (Use and Access) Act. In India, the Digital Personal Data Protection Rules, 2025 (opens in a new tab) were notified on 14 November 2025 with an eighteen-month period for phased compliance. Check the rules that apply wherever you and your customers are.

For a structured way to think about AI risk, the voluntary NIST AI Risk Management Framework (opens in a new tab) groups the work into four functions: govern, map, measure and manage. A small business does not need the full framework, but the habit of naming risks, measuring them and assigning owners scales down well.

If you would like this done with you, our AI consulting service runs it as the five-day AI-readiness sprint, starting with a free 30-minute call.