On this page
Key takeaways
- An assessment covers five areas: operations, data, systems, people and governance. Most skip the first and over-weight the second.
- The output that matters is a ranked shortlist of use cases, a business case for each, and a 90-day plan. A maturity score alone is not an output.
- A readiness assessment differs from a maturity model (benchmarks the company) and from an online self-assessment (benchmarks the respondent's optimism).
- Two to four weeks is enough when the right people are in the room; longer assessments are usually strategy projects in disguise.
- The 25-point checklist below is the minimum a leadership team should expect any assessment to answer.
Last updated: October 2026
An AI readiness assessment is a structured review of a company's operations, data, systems, people and governance that returns the AI use cases worth funding first and what has to be true for them to work. It exists because most AI spend still goes to pilots that never reach daily use: ISG's 2025 survey of 400 senior AI decision makers found that only 31% of enterprises had moved a top-three funded use case into full production, and only one in four initiatives was meeting revenue expectations. A good assessment is short, specific to the company, and ends in a decision.
The five areas an AI readiness assessment covers
Operations. Where work waits, what moving between people and systems costs, and which of those steps are reading, checking, matching or chasing. This is where AI value sits, and it is the area most assessments skip because it needs conversations with the people who run the process rather than a questionnaire.
Data. Whether the data the shortlisted use cases need exists, is current, is accessible and is trusted. Gartner's 2024 survey of 1,203 data leaders found that 63% of organisations lack suitable data management practices for AI or are unsure whether they have them, and Gartner predicts 60% of AI projects without AI-ready data will be abandoned through 2026.
Systems. Which core systems hold the data and whether an agent can read from and write to them: APIs, integration layers, legacy constraints, cloud and identity.
People. Who would own each use case, who would review the agent's work, and what the team's current habits with AI tools are.
Governance. What data may be used where, who approves a new AI use, how decisions are logged, and which regulations apply, including the EU AI Act for companies operating in Europe.
What a good output looks like
Three artefacts, written for a leadership decision rather than for an IT backlog.
- A ranked shortlist of use cases, each with the workflow it changes, the number it would move, the data and systems it needs, and the blockers found.
- A business case for the top two or three: effort, cost, expected effect on the number, and the first proof that would show it is working.
- A 90-day plan: what gets proved first, who owns it, what has to be fixed in data or systems before it can start, and the decision point at the end.
An assessment that returns a maturity score, a heat map and a vendor list has described the company and not decided anything. The gap between describing and deciding is where most companies sit: McKinsey's 2025 survey of 1,993 organisations found 88% using AI somewhere and 7% with it scaled across the enterprise.
Readiness assessment vs maturity model vs online self-assessment
| Readiness assessment | Maturity model | Online self-assessment | |
|---|---|---|---|
| Input | Interviews, data checks, system access | Survey against a framework | A questionnaire |
| Output | Shortlist, business case, 90-day plan | A score and a benchmark | A score and a sales call |
| Specific to the company | Yes, to the workflow | Partly, to the function | No |
| Duration | 2–4 weeks | 4–8 weeks | 20 minutes |
| Decision it enables | What to fund first | Where the company stands | Whether to talk to the vendor |
| Useful when | Budget exists and the first use case is open | A board wants a benchmark | Nothing has started |
The checklist
Twenty-five questions a leadership team should expect any AI readiness assessment to answer. A "no" is not a failure; it is a blocker with an owner.
Operations
- Which five recurring workflows consume the most people-hours?
- In each, where does work wait between people and systems?
- Which steps are reading, checking, matching or chasing?
- Which number would leadership accept as proof that a workflow improved?
- Who runs each workflow today, and have they been interviewed?
Data
- Does the data each shortlisted use case needs exist in a system of record?
- Is it current, and how is it kept current?
- Can it be accessed through an API or a warehouse, or only through screens?
- Does the business trust it, and where do people keep their own copies?
- Is personal or regulated data involved, and under which rules?
Systems
- Which systems would an agent need to read from and write to?
- Do those systems expose APIs, and who owns them?
- Which cloud and identity provider would the solution run on?
- Which legacy systems have no integration path, and what is the workaround?
- Is there an existing data platform, and does it hold what the use cases need?
People
- Who would own each use case after it ships?
- Who would review the agent's work day to day?
- Which teams already use AI tools, and for what?
- Does the engineering team have capacity, and for how long?
- Which skills are missing, and will they be hired, trained or brought in?
Governance
- Which data may be sent to which AI provider?
- Who approves a new AI use, and how long does it take?
- How are agent decisions logged and audited?
- Which regulations apply, including the EU AI Act risk tier for each use case?
- What happens when the proof fails: who decides, and what is kept?
How long it takes and who needs to be in the room
Two to four weeks, set by the number of teams in scope. The people who have to take part: the sponsor who owns the budget, the heads of the two or three functions in scope, the people who run the candidate workflows, the data or IT owner who can grant system access, and whoever speaks for legal and security. An assessment that cannot get these people for a few hours each is being run too early.
Twistag runs this format as the AI Readiness Sprint, fixed fee from €5,000, two to four weeks, with the three artefacts above as the output.
Frequently asked questions
Does a company need an AI strategy before an AI readiness assessment?
No. The assessment usually produces the first version of the strategy, because it answers where AI creates value here, what has to be true, and what to prove first. A strategy written before the assessment tends to describe the industry rather than the company.
Can an AI readiness assessment be done internally?
Partly. The operations and people areas need honest interviews, which are easier for an outsider to run. The data and systems areas need engineers who have built agents on similar systems and know what breaks. The governance area can be done internally with legal and security.
What does an AI readiness assessment cost?
From a few thousand euros for a fixed-scope sprint to six figures for a consultancy-led strategy engagement. The checklist above is a useful filter: a provider that cannot answer most of it in four weeks is selling something else.
Is a readiness score useful?
For a board benchmark, yes. For a funding decision, no. A score says how the company compares; a shortlist with a business case says what to do on Monday.
