AI strategy
AI readiness assessment: a practical framework
Six areas, four levels, and the red flags that tell you an AI programme will stall before it starts.
By Kesho Partners
10 minute read
An AI readiness assessment tells you whether your organization can turn AI into results, not just whether it can run a pilot. Score six areas: strategy and use cases, data, technology, people and skills, governance, and the capacity to deliver change. Your weakest area sets your pace. Most organizations are not held back by the AI itself. BCG found 70% of the effort to get value from AI sits in people and processes, and McKinsey reports the limiting factor is increasingly the ability to absorb change.
Free tool for investors
Portfolio AI Readiness Score
Apply this framework across your portfolio companies and get a clear next step for each: build, pilot, prepare or monitor.
Why assess readiness before you invest
Most companies already use AI somewhere. In McKinsey's 2026 survey, nearly nine in ten respondents said their organization uses AI regularly in at least one function. Yet only 37% reported any effect on operating profit. BCG's 2024 study of 1,000 senior executives found only 26% had the capabilities to move beyond pilots.
The gap between use and results is a readiness problem. A readiness assessment shows where that gap is in your organization, so investment goes to the thing that is actually blocking progress rather than another tool.
If your current AI activity is mostly general-purpose assistants, start with our article "A chatbot is not an AI strategy". It explains why tools alone rarely move the numbers.
Survey figures are self-reported by respondents and describe their organizations' experience, not audited financial results.
The six areas to assess
These six areas draw on the UK government's AI Playbook, the NIST AI Risk Management Framework, and ISO/IEC 42001, the international standard for AI management systems. They are written for leaders, not engineers. Each one asks a simple question.
- Strategy and use cases
- Do we know which business problems AI should solve, in what order, and how we will measure success? The UK playbook says use cases should be led by business and user needs, not by what the technology can do.
- Data
- Is the data we need available, good enough, and ours to use for this purpose? Poor data quality and quantity are among the most common reasons AI fails to deliver.
- Technology
- Can our systems connect AI to the places where work happens, securely, and at a cost we can sustain?
- People and skills
- Do leaders understand AI's risks and opportunities, and do we have people who can design, build, test, and support it?
- Governance
- Do we know what AI we use, who owns each system, which risks matter, and how we would catch and fix a problem?
- Capacity to deliver change
- Can we redesign workflows, bring people along, and move from pilot to production without stalling?
Score each area from one to four
Use the table to place your organization honestly in each area. Score based on evidence you could show someone outside the company, not on plans or intentions. Two or three people from different parts of the business should score independently, then compare.
| Area | 1. Exploring | 2. Experimenting | 3. Scaling | 4. Embedded |
|---|---|---|---|---|
| Strategy and use cases | Interest in AI but no agreed priorities | Several pilots, chosen mostly by enthusiasm | A short, ranked list tied to business outcomes | AI priorities are part of the business plan and reviewed with results |
| Data | Data scattered and owners unclear | Data pulled together by hand for each pilot | Key datasets owned, documented, and quality checked | Reliable data with clear rights, lineage, and access controls |
| Technology | Standalone tools only | Pilots built outside core systems | Shared platform connected to core systems | AI built into workflows, monitored, with costs tracked per outcome |
| People and skills | Few people understand AI | A small group of enthusiasts | Trained teams and leaders who understand the risks | AI skills spread across the business with clear roles |
| Governance | No list of AI in use | Policies drafted but not applied | Inventory, owners, and risk reviews for each system | Controls operate routinely and are tested and improved |
| Capacity to deliver change | No one owns AI delivery | Pilots rarely reach production | A repeatable path from idea to production | Workflows redesigned and benefits tracked after launch |
How to read your results
Do not average the scores. Your lowest area sets your pace. A company scoring four on technology and one on data will not get far, because every AI system depends on the data underneath it.
Look for mismatches between ambition and readiness. If the plan involves customer-facing AI or decisions about people, governance needs to be at level three before launch. If the plan depends on proprietary data, data needs to be at level three before build.
BCG's research gives a useful sense check. It found successful companies spend about 10% of their effort on algorithms, 20% on technology and data, and 70% on people and processes. If your plan is weighted the other way, the plan is probably the problem.
Sources: [2]
Red flags that predict a stalled programme
Any one of these should pause new investment until it is fixed. They are the patterns we see most often in organizations that run many pilots but scale few.
- No one can list the AI in use
- The UK playbook recommends keeping an inventory of AI systems. Without one, you cannot manage risk or cost.
- Success is measured in users, not outcomes
- The UK playbook warns that strong model scores do not guarantee people trust or act on the output. Measure the business result.
- Pilots have no owner after launch
- If the vendor or IT owns it, nobody in the business is accountable for whether it delivers.
- Data is prepared by hand for each project
- It works for a demo. It does not survive production or scale to the next use case.
- Access permissions are untidy
- AI search tools surface whatever a user can technically reach. Existing permission problems become visible very quickly.
- Running costs are unknown
- About one in five McKinsey respondents said operating costs, including model usage fees, are constraining their use of AI.
- Too many pilots
- BCG found leaders pursue about half as many opportunities as others and scale twice as many. Breadth is not progress.
Governance does not have to come first, but it cannot come last
Governance often scores lowest because it sounds like bureaucracy. It does not need to be. A small set of working controls is enough to start: an inventory, named owners, a risk review before launch, and a way to report and fix problems.
Our minimum viable AI governance pack lists the eight artifacts to have in place before production. For a fuller structure, our guides to the NIST AI Risk Management Framework and ISO/IEC 42001 explain how those frameworks fit together.
Smaller organizations can also use the UK government's AI Management Essentials, a free self-assessment tool designed to help start-ups and SMEs check and improve how they manage AI.
Test the data claim before you build
Data is where most readiness assessments are too generous. Teams say data is available when they mean it exists somewhere. The real questions are whether it is accurate, complete, representative of how the system will be used, and legally yours to use for this purpose.
Our article on AI due diligence and data lineage sets out how to trace data from its source to the decision it supports. The same test works whether you are buying a company or building your own system.
Turning the assessment into a plan
A readiness assessment is only useful if it changes what you do next. Take the two lowest-scoring areas and agree what level three would look like for each within six months. Then choose one or two use cases that the improved foundations will support.
Repeat the assessment every six to twelve months. The aim is not a perfect score. It is to make sure each AI investment is going somewhere the organization can actually absorb it.
Sources: [1]
Related service
AI governance
We run independent AI readiness assessments and turn the results into a practical plan, with the controls, owners, and data foundations needed to move from pilots to production.
Explore the service