When is your organisation ready for AI? An honest checklist

Translated with AI. This article was translated by an AI model from an article by Twentynext in another language, and the translation was checked automatically against the original. Verify figures and sources before acting on them. See our disclaimer.

The question now comes from all directions: from the executive board, from the supervisory board, from employees who already use ChatGPT at home. “What are we actually doing with AI?” And so a pilot is started. That pilot produces a nice demo, everyone is enthusiastic, and then nothing further happens.

A familiar risk for any organisation that is starting with AI. On closer inspection it often turns out that the preconditions were missing: no owner, no visibility of the data, no plan for ongoing management. This article gives you an honest checklist to test your AI readiness, before you invest budget, time and credibility.

What AI readiness does and does not mean

AI readiness is the extent to which your organisation is able to implement AI effectively and to benefit from it structurally or scale it up. Note that second part. Setting up a pilot is one thing; keeping an application in production, with ownership, management and oversight, is a fundamentally different task.

Being ready for AI does not mean that you have everything in order. It means that you know where your gaps are, that those gaps are not showstoppers for your first use case, and that you have a plan to close them. That is precisely what readiness checklists are for: mapping gaps before larger investments follow.

Nor does it mean that you have to wait until everything is perfect. Those who postpone the start until “the data is in order” run the risk that the start never comes. The art lies in the right sequence: starting small enough that your current maturity can handle it.

Checklist part 1: do you have a problem, or only a technology?

The first test is the simplest and is the one most often skipped. Answer these questions honestly:

• Can you say in one sentence which problem AI needs to solve for you? Not “working more efficiently”, but concretely: which process, which decision, which action. First determine why you want to use AI, before you test whether you are ready for it.
• Do you know what that problem currently costs you? In time, money, errors or frustration. A baseline measurement makes it much easier later on to demonstrate plausibly that the application works.
• Is there a process owner who wants to solve this problem? An AI initiative without an owner in the line organisation runs the risk of remaining an isolated project that never lands in day-to-day work.

If the answer to any of these questions is “no” or “not really”, you are not ready. In that case the first step is not tooling, but a conversation with the business about where the real friction is.

A common pitfall: starting from the question “what can we do with AI?” instead of “where do we get stuck, and could AI help with that?”. The first question produces demos. The second produces candidate solutions.

Checklist part 2: is your data good enough, for this particular use case?

Almost every AI readiness checklist names high-quality, accessible data as a core condition. But the question is not “is our data perfect?”. The question is: is the data that this particular use case needs good enough, findable and accessible?

Test yourself on these points:

• Do you know where the required data is and who owns it? If the answer is “in various systems, and nobody really knows exactly”, that is where your journey begins.
• Is the data quality known? Not perfect, known. Do you know where the gaps, duplicates and outdated fields are?
• Are you permitted to use the data for this purpose? Reusing personal data for a purpose other than the one for which it was collected requires, under the AVG (the GDPR, as it is called in Dutch), among other things a compatibility-of-purpose test and a valid legal basis. How that works out depends on the context. Involve your privacy officer early and have this reviewed legally: this article is not legal advice.
• Is someone responsible for data quality as an ongoing task? Data quality is not a one-off clean-up exercise. If nobody holds that task structurally, there is a real chance that quality will slip again over time.

Our advice: explicitly reserve time in your planning to genuinely test data quality before you build. It is unobtrusive work, but it largely determines what your application is worth.

Checklist part 3: can your people and processes carry this?

Readiness is not only about technology and data, but explicitly also about processes and people. The NIST AI Risk Management Framework expressly treats AI as a sociotechnical issue: the organisation around it helps determine whether an application holds up. Test:

• Is there someone who can assess the result of the AI? AI applications can produce incorrect outcomes. Someone in the process must be able to see when an outcome is wrong, and have the mandate to deviate from it.
• Does the application fit into the existing work process? A tool that sits alongside the work is easily ignored. A tool that changes the work process requires that you genuinely adapt that process too, including instructions, training and time.
• Is there basic knowledge of what AI can and cannot do? Employees do not need to understand models. They do need to know that AI output can be incorrect and must not be treated as fact without checking.
• Is the executive board willing to hear no as well? Sometimes the honest outcome of an exploration is: this is not (yet) a good use case. An organisation that does not accept that forces teams to push things through.

So take the adoption question just as seriously as the technology. An application that is not used delivers, by definition, nothing.

Checklist part 4: is governance arranged, or will that come “later”?

Governance sounds like something for large organisations, but it is a precondition for scaling up. The NIST framework even puts governance first: it is the first of its four functions, and it runs through all the others. The core questions are relevant to everyone:

• Who is responsible if the AI makes a mistake? If nobody can answer that question, the application is not ready for production.
• Do you know which regime of the AI Act your application falls under? Broadly speaking, the European AI Act has several regimes: prohibited practices, high-risk systems with stricter requirements, transparency obligations for certain applications, and other systems. So not every application gets a single simple “risk label”. Map out early roughly where your use case sits, and have the precise interpretation reviewed by someone with legal expertise.
• Is there a process to monitor the application after it goes live? Data and circumstances can change, and depending on the type of application, performance can decline. Without monitoring you run the risk of only noticing problems when a user or citizen complains.
• Can you explain how the application arrives at an outcome? Whether and to what extent explainability is mandatory depends on, among other things, the type of decision, the applicable legislation and the role of human intervention. Certainly for decisions that affect people, the sensible assumption is: design as if you have to be able to account for it, and have the legal scope reviewed.

Governance questions do not disappear by postponing them. Those who include them from the start can build requirements into the design instead of adapting a built solution to them afterwards.

How to use the checklist: not a grade, but a roadmap

The temptation is great to score the checklist and put an “AI readiness score” on a slide. Do not do that. A score suggests that you are ready at an eight out of ten, and that is not how this works.

Use the checklist differently:

1. Walk through the four parts for one concrete use case. Not for “the organisation” in general, that becomes too abstract.
2. Mark the showstoppers. No problem owner, no access to the data, no legal basis: those are stoppers. Resolve those first.
3. Accept the points for attention. Imperfect data or limited AI knowledge are no reason to wait, but they are a reason to start small and learn.
4. Repeat for each use case. An organisation can be ready for an internal text assistant and at the same time not ready for automated decision-making. Readiness is context-dependent.

Be honest about lead times. How much time it takes to close gaps in data ownership, governance and process embedding varies greatly per organisation and per gap. Say so in advance and do not promise quick results; that prevents disappointed stakeholders halfway through.

The first step: one use case, one afternoon, four questions

You do not need to buy in a large assessment programme to get started. Do this:

Plan a half-day working session with the process owner, someone who knows the data, someone from privacy/compliance and a decision-maker. Choose one concrete use case in advance. Walk through the four parts of this checklist together and write down for each part: what do we know, what do we not know, what is a showstopper?

The outcome of that afternoon is a shared, honest picture of where you stand, and a concrete list of what needs to happen before you build.

And if the outcome is that you are not ready yet? Then you have drawn that conclusion before it cost money and credibility. That too is a gain. If you would like to hold that working session with someone from outside present, that is where our AI consultancy begins.

Want to know where you stand first? Take the free Data Maturity Scan: sixteen questions, instant results.