Guide · Governance, policy and return on investment
AI readiness assessment: a 12-question self-check for your organisation
AI readiness is whether your organisation has the foundations to use AI safely and usefully: someone who owns it, an approved tool, clear rules on data, people who can check the work, and one task worth improving. The 12-question self-check below shows which foundation to fix first. “Not ready yet” is an honest result, not a failure.
By Andrew Ward, Founder of ScorchsoftChecked 11 minute read
In short
- Readiness is about the organisation that uses AI, not the technology. Five foundations matter: leadership, process, data, security and people.
- Answer the 12 questions on this page honestly. “Not sure” counts as “no”, because it means nobody has checked.
- A “no” isn’t a failure. Each one comes with what it means and a first step that needs no budget.
- If you have several, fix them in order: an owner, then an approved tool and rules on data, then the rest.
- “Not ready yet” is an honest answer, and a useful one: it tells you what to do next.
Written for: Owners, managers and governance leads in UK organisations that use AI tools rather than build them.
What does AI readiness mean for an organisation that uses AI?
For an organisation that uses AI rather than builds it, readiness means the conditions are in place for people to use AI on real work without guessing: who decides, what tool, what data, who checks, and what it is for.
Many AI readiness checks online are written for companies that build AI systems, so they ask about data science teams, model pipelines and cloud platforms. A 30-person firm whose staff use an AI assistant to draft letters and summarise meetings needs different questions. Its risks come from everyday choices: which account someone uses, what they paste in, and whether anyone reads the result before it goes to a client.
This guide groups its questions under five foundations, written for that kind of firm:
- Leadership: someone owns how AI is used, and has said what it is for.
- Process: you know which work you want to improve, how it goes today, and who checks the result.
- Data: people know what information may go into which tool, and where the information a task needs lives.
- Security: there is an approved tool on an organisation account, and you know what else is in use.
- People: staff have had practical training and have time and someone to ask.
Readiness is not a one-off. You can be ready for people to draft emails with an approved assistant long before you are ready to connect AI to your client records. Answer the questions for the use you have in mind next.
How ready is your organisation? A 12-question self-check
Answer each question yes or no for your whole organisation, not your own team. Count “not sure” as “no”. Each “no” comes with what it usually means and a first step that costs nothing but time.
Take about ten minutes, ideally with one other person who sees the organisation from a different angle, such as whoever handles IT or data protection. Write down your “no” answers as you go.
| Question | If the answer is no | First step |
|---|---|---|
| 1. Leadership. Is one named person responsible for how your organisation uses AI? | Decisions drift. Nobody can approve a tool, answer a question or stop something going wrong. | Name an owner this month. It needn’t be a technical role: it needs authority and a little time. |
| 2. Leadership. Have leaders said in writing what AI is for here, and what it isn’t for? | People guess. Some use AI quietly; others avoid it in case they are not allowed. | Write three sentences: why you are using AI, what it must never be used for, and who to ask. |
| 3. Process. Can you name one repeated task where AI might help, and roughly how long it takes today? | You have no baseline, so later you can’t tell whether AI helped. | Pick one task and time it for a week before anyone changes how it is done. |
| 4. Process. Is it agreed who checks AI-assisted work before it leaves the organisation? | Mistakes can reach clients, and nobody is clearly carrying the outcome. | Agree that a person reviews anything that goes out, with more checking where more is at stake. |
| 5. Data. Do staff know which information may go into which AI tool? | Client or personal details may already be in tools you haven’t approved. | Draw up tramlines: green, amber and red for your own kinds of information. |
| 6. Data. For the task in question 3, do you know where its information lives, and can the right people reach it? | AI will work from guesses or copied spreadsheets, and the results will vary. | List the documents and systems the task draws on, and who owns each. |
| 7. Data. If personal data would go into an AI tool, has anyone considered whether a data protection impact assessment is needed? | You may be missing a step UK data protection law requires where processing is likely to be high risk. | Ask whoever leads on data protection to read the ICO’s guidance on when a DPIA is needed. |
| 8. Security. Do people have an approved AI tool on an organisation account, with its data settings checked? | Work is going through personal accounts, where your organisation has no say over the terms. | Choose one tool using a trust check, and set it up under business terms. |
| 9. Security. Do you know which AI tools people use now, including on their own accounts and phones? | There is shadow AI you can’t see, so you can’t support it or make it safer. | Run a no-blame week: ask people what they use and what for, and thank them for answering. |
| 10. Security. Can someone report an AI mistake or worry without fear of blame? | Problems stay hidden until they are bigger. | Name where reports go, and say plainly that honest mistakes reported early are welcome. |
| 11. People. Have staff had practical training on using AI safely in their own work? | Access isn’t adoption. People are left to work out alone what is safe and what good looks like. | Give everyone an hour on real tasks: what is safe to share, and how to check the result. |
| 12. People. Do people have time to try AI on real work, and someone to ask when they are stuck? | Good habits stay with the few who are already keen. | Set aside a regular slot to try one task, and name an AI champion with time to help. |
Why there is no score here
Adding up yes answers hides what matters. Eleven yeses and a “no” on question 5 is a bigger problem than three “no” answers on training. Read which questions you said no to, not how many.
What does your result mean?
It depends on which questions you said no to. A “no” on question 1, 5, 8 or 9 means you are not ready to widen AI use yet, and that is an honest result to work from. It doesn’t mean stop: fix that foundation first. Other gaps can close while people start carefully.
Use your “no” answers to place yourself in one of three plain results:
- Not ready yet. A “no” on question 1, 5, 8 or 9. People may be using AI already, but without an owner, an approved tool or rules on data. Work on those before you encourage more use.
- Ready to start, carefully. Those four are yes, but there is a “no” on question 2, 3, 4, 6, 7 or 10. Let people use the approved tool on low-stakes work while you close those gaps.
- Ready to test one idea properly. Questions 1 to 10 are all yes. You can run a small, measured trial of one task, and close any gaps in training or time (questions 11 and 12) as part of it.
Being early is normal. The Office for National Statistics reported in July 2026 that around 35% of UK businesses with 10 or more employees used at least one AI technology in June 2026, and that only 10% of those users reported using AI extensively. Those are survey figures for businesses, not a measure of readiness, but they suggest that most businesses are still early in their use of AI.
Gareth Bennett manages a 40-person accountancy practice. He answers no to questions 1, 5, 8, 9 and 11. When he asks, he finds that Hayley, one of his coordinators, has been drafting client chasers on a personal AI account for months, and that she’d gladly show others how. His result is “not ready yet”. His first step is not a new tool: he names himself as the owner, runs a no-blame week to find out what people use, and asks Hayley to help write the practice’s tramlines.
If colleagues want a number, Scorchsoft’s AI Readiness assessment (opens in a new tab) is an optional, separate check that scores the same five foundations, and it asks for an email address to send your results.
What’s the first step if you’re not ready yet?
Name an owner, find out what people already use, then give them one approved tool and clear rules on data. Those three moves need time rather than budget, and most organisations can start them this week.
Step 1: Name an owner (leadership, this week)
A senior person agrees to own AI use: approving tools, answering questions and keeping the rules up to date. Write their name where staff will see it.
Step 2: Find out what is in use (owner, next week)
Ask everyone, without blame, which AI tools they use and for what. The answers tell you what people need, and they are the start of your shadow AI fix. Our shadow AI guide has a script for this.
Step 3: Agree one approved tool and the tramlines (owner and data lead, within a month)
Choose one tool on an organisation account and write down what information may go into it. A one-page rule is enough to start. The AI policy template covers what a fuller policy contains.
Then come back to the self-check. When questions 1 to 10 are yes, pick one task from question 3 and test it with a baseline and a stop rule. Our 90-day AI pilot guide walks through that, and the AI ROI guide shows how to tell whether it paid back.
When people need to learn the habits behind questions 5, 8 and 11, Module 1, From Unsure to Useful teaches what is safe to share and how to set your tramlines. The AI literacy guide covers training more widely.
The one thing not to do
Don’t start with a ban, or with software to watch what staff type. People usually turn to unapproved tools because nobody has offered an approved one. Give them a safe route first.
How is AI readiness different from AI maturity?
Readiness asks whether the foundations are in place for your next move. Maturity describes where your organisation is on a longer path, from no agreed approach to AI built into how the business runs.
The two go together. An AI maturity model tells you roughly where you are; a readiness check tells you what is missing before the next step. Our own model is the AI Stairway™ to Success, seven steps from 0 (no formal adoption) to 6 (AI-first strategy). Questions 1, 2, 5 and 8 above are much of what it takes to move from step 0 to step 1, approved AI access. The AI maturity model guide explains it, and how it compares with a published model from Microsoft.
Later steps need more. Before a workflow can run with AI in it, it needs permission, access to the right data, governance and an owner. Module 10, From Glue to Workflow teaches how to check those for one idea.
Is there an official UK AI readiness standard?
No: there is no single official UK readiness check for organisations that use AI. The government consulted on a self-assessment tool, AI Management Essentials, and said in February 2026 that it would not publish it. Existing law, such as data protection, still applies.
The Department for Science, Innovation and Technology (DSIT) published AI Management Essentials for consultation in November 2024 as a self-assessment of AI governance. Its response, published on 6 February 2026, says DSIT “will not be publishing AIME” and plans future guidance focused on foundational governance, mainly for small and medium-sized firms deploying AI. Check GOV.UK for anything newer.
Meanwhile, the Information Commissioner’s Office (ICO) is the regulator to know if personal data is involved. Its guidance on when a data protection impact assessment is needed lists AI as an example of innovative technology, which can mean an assessment is required when combined with other risk factors. As of 29 October 2026, the ICO marks that guidance and its guidance on AI and data protection as under review after the Data (Use and Access) Act 2025, so read the current version.
Completing a self-check, this one or any other, doesn’t make your use of AI lawful. It shows you where to look. For how ownership, rules and review fit together, read our AI governance guide.
Questions people ask
How long does an AI readiness assessment take?
The self-check on this page takes about ten minutes. Allow longer if you need to ask colleagues, for example to find out which tools people use. Fixing the gaps it shows takes weeks, not minutes.
Who should do the AI readiness self-check?
Whoever will own AI use, with one other person who sees the organisation differently, such as the person who handles IT or data protection. Asking a few staff the same questions is a useful check on the answers.
We are not ready. Should we stop people using AI?
Usually not. A ban tends to push use out of sight. Name an owner, offer one approved tool with clear rules on data, and ask people to move their work to it.
Is an AI readiness assessment the same as an AI audit?
No. A readiness check is a quick look at foundations, answered by you. An audit is an independent examination against a defined standard or set of controls. A self-check can show you where an audit might be worth having.
How often should we repeat the self-check?
When you are about to widen how AI is used, such as a new tool or a new kind of data, and at least once a year. The answers change as people, tools and rules change.
Training for the whole team
The AI Stairway™ gives everyone the same careful habits, then helps your team agree its rules and test one AI idea properly. Everyone can start with the free introductory module.
AI training for teamsSources
Every figure on this page comes from one of these. Links open in a new tab.
- Artificial intelligence in UK businesses: 2023 to 2026 (opens in a new tab). Office for National Statistics, 20 July 2026.
- Guidance for using the AI Management Essentials tool: government response (opens in a new tab). Department for Science, Innovation and Technology, 6 February 2026.
- When do we need to do a DPIA? (opens in a new tab) Information Commissioner’s Office, read 29 October 2026 (marked as under review).
- Guidance on AI and data protection (opens in a new tab). Information Commissioner’s Office, read 29 October 2026 (marked as under review).
- Free AI Readiness Assessment (opens in a new tab). Scorchsoft, read 29 October 2026.
Keep going
Related guides
- AI maturity models: what they are, and how to use one honestly
- AI governance for small and mid-sized organisations: a simple framework
- Shadow AI: why staff use unapproved AI tools, and what to do about it
- AI pilot: how to run a 90-day workplace AI pilot
- AI ROI: how to measure whether AI is paying back
- What is AI literacy? What it looks like at work, and what EU Article 4 asks