The short answer
AI readiness is less about the model and more about the groundwork around it. Before you invest, you should be able to name the problem AI will solve and its owner, point to the data it needs, show that only the right people can see that data, and explain how you will check results and measure value.
The worksheet below covers nine areas. Score each from evidence, not optimism. If you find gaps, you are in good company, and the fix nearly always starts with data and permissions.
Why readiness matters more than the model
AI magnifies whatever is already true about your organization. An assistant that searches your files finds the outdated policy as easily as the current one, and one that works with each person's permissions surfaces every folder shared too widely years ago.
Governance is part of readiness too. Canada's federal, provincial and territorial privacy commissioners have said that generative AI does not sit outside existing privacy law, and that accountability for decisions rests with the organization, not with an automated system (OPC). PIPEDA's fair information principles, such as identifying purposes, limiting collection and safeguards, apply to personal information used in AI (OPC), and provincial laws such as Quebec's Law 25 add their own duties. This is general information, not legal advice. For a structure to grow into, borrow from the voluntary NIST AI Risk Management Framework: govern, map, measure, manage.
The AI readiness worksheet
Tick an item only when you can show evidence: a document, report, setting or named person.
Strategy and ownership
- An executive sponsor who can make decisions and remove obstacles
- Two or three written business goals AI should support
- A business owner for each use case, not only IT
- A budget that separates one-time build costs from ongoing licence and usage costs
Use cases
- Candidates scored on value, feasibility, data readiness, risk and cost
- A first use case that is frequent, contained and easy for a person to check
Data
- Location: you know where the information each use case needs lives
- Quality: key documents and records are current, with obsolete versions archived
- Access: the data is reachable through supported APIs, connectors or exports
- Sensitivity: personal, confidential and regulated information is identified and labelled where your tools allow
Systems and integration
- An inventory of core systems: Microsoft 365 or Google Workspace, ERP, CRM and line-of-business applications
- AI features already built into those systems are known, with a decision on each
- A test environment that keeps AI trials away from live records
Identity and permissions
- Individual accounts for everyone, protected by multifactor authentication
- Content shared with "everyone" or all-staff groups reviewed
- A named owner for every site, team and shared drive
- Access removed promptly when people leave or change roles
Security
- Managed, patched devices for anyone using AI tools
- Logging on, and retained, for the systems AI will touch
- Unapproved AI apps, browser extensions and add-ins detected or blocked
- AI applications you build tested for prompt injection and data leakage
Privacy and governance
- Policy: an AI acceptable use policy that staff have read
- Register: approved AI tools and use cases, each with an owner
- Risk review: a short assessment for each new use case, including privacy
- Human review: rules for checking outputs that affect people, money or compliance
- Vendor terms on training, retention and processing location reviewed
- Deployment model chosen for sensitive data: an enterprise AI service, models in your own cloud account or self-hosted open-weight models
People and skills
- Practical training on approved tools, including their limits
- Champions in each team who share what works
- A person accountable for each AI solution after launch
Measurement
- A baseline for each use case (volume, time per item, error rate)
- Success measures and a stop threshold agreed in advance
- A review date and someone responsible for the numbers
For security and people, the Canadian Centre for Cyber Security's generative AI guidance is a good companion: choose vendors carefully, limit what information you provide and train employees.
How to score your readiness honestly
Give each area a score:
- 0, not in place: it does not exist, or nobody can show it.
- 1, partly in place: it is informal, covers only some teams or systems, or lives in one person's head.
- 2, in place: it is documented, has a named owner and could be shown to an auditor or board.
Four rules keep the score honest. Score today, not the plan: a draft policy is a 1. Ask the people who do the work, who often rate data quality and permissions lower than their managers. Look at the lowest score, not the average: strong strategy does not make up for a zero on permissions. Score per use case where it differs: supplier invoices may be ready while shared drives are not.
| What your scores show | What it usually means | Sensible next step |
|---|---|---|
| Mostly 2s, no zeros | Ready for a contained first use case | A proof of concept on your own data, with agreed accuracy and cost thresholds |
| A mix of 1s and 2s | Ready for a narrow, low-risk pilot | Pilot one use case and close the gaps in parallel |
| A zero in data, permissions or governance | Not ready for AI that reads internal content | Fix that foundation first |
| Mostly zeros and ones | Early stage | Policy, approved tools, permissions and data clean-up |
These bands are a rule of thumb, not a formal standard.
Rather talk it through? If your scores are mixed or hard to judge, we can work through the checklist with your team and tell you plainly what to fix first. Talk to a Promatics specialist
If you are not ready yet
Not being ready is the normal starting point, and it usually means AI would have exposed problems you already had. A sensible order of work:
- Set rules for today's use. Staff are probably using AI already. Publish a short policy and name approved tools so work moves out of personal accounts (see our guides to an AI acceptable use policy and shadow AI).
- Fix permissions. Review content shared with everyone, give every site an owner and remove stale access. Planning Copilot? Read our Copilot readiness guide.
- Clean the data for one use case, not the whole organization.
- Measure the task you want to improve, so you can tell later whether AI helped.
- Then choose one contained use case that is frequent, easy to check and low in risk.
This pays off even without AI: tidier permissions and data reduce risk on their own.
What usually goes wrong
- Scoring the plan, not the reality. The checklist looks green, then the pilot stalls waiting for data access.
- Starting with a platform. Licences are bought before anyone agrees what problem they solve.
- No owner after launch. Accuracy, costs and permissions drift once the pilot team moves on.
When to bring in help
You can run this checklist yourself, and a general AI chatbot can help you draft the questions. A small team using AI features built into its existing software, under a clear policy, may need nothing more for now.
Bring in a professional when AI will read your internal documents or records, when personal or regulated information is involved, when you must choose between platforms, or when a board or funder wants evidence. A checklist cannot open your sharing reports or test what an assistant would reveal to a junior employee.
Our AI strategy and readiness service does that work: interviews with your teams, a review of your data, systems, identity and security, a scored use-case shortlist and a 90-day plan with owners. Because we also deliver managed IT and cybersecurity, the people who find the gaps can help you close them.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Principles for responsible, trustworthy and privacy-protective generative AI technologies, Office of the Privacy Commissioner of Canada
- PIPEDA requirements in brief, Office of the Privacy Commissioner of Canada
- AI Risk Management Framework, National Institute of Standards and Technology (NIST)
- Generative artificial intelligence (ITSAP.00.041), Canadian Centre for Cyber Security
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.