AI readiness assessment checklist for mid-market companies, with scoring

Why run an AI readiness assessment before buying tools

An AI readiness assessment tells a leadership team whether the company can put AI to work before it spends on licenses, pilots or hires. The checks below target the gaps that commonly stall mid-market pilots: no agreed use case, data scattered across systems nobody owns, unclear promises about customer data, and no one accountable once the consultants leave.

The checklist is written for management consultants, fractional CTOs and MSPs running a short assessment for companies of roughly 50 to 500 employees. It adds a section most templates skip: an inventory of the company's own data assets. Those records matter twice. They are the raw material for internal AI use, and they have outside value too. Epoch AI projects that, if current trends continue, language models could fully use the stock of public human-written text between 2026 and 2032, a forecast with wide uncertainty that helps explain why AI developers now license permissioned, non-public business records.

How to score it

Score each item 0 (absent), 1 (partial or informal) or 2 (in place and documented). Each section has five items, so it scores 0 to 10, and the full assessment scores 0 to 60.

Interview at least the CEO, the CFO, whoever runs IT and one operations lead. Ask for evidence, such as a policy, a system list or a sample export, instead of accepting a verbal yes. Score the data-assets section last, once you have seen the systems.

The checklist

1. Strategy and use cases

• Leadership has named two or three business problems for AI to address, each with an accountable owner.
• Each use case has a baseline metric measured today, such as cycle time, cost per ticket or quote turnaround.
• Budget is approved for the pilot and for running the result after the pilot ends.
• A build, buy or partner decision has been made for each use case.
• The owners or board have seen the plan and agreed what success looks like.

2. Data foundations

• A current list of business systems exists, with a named owner for each.
• Core records (customers, orders, tickets, projects) share consistent identifiers across systems.
• Someone can export full history from the main systems, not only recent records.
• Known data quality problems are logged: duplicates, missing fields, inconsistent free text.
• Retention rules say how long each record type is kept and who may delete it.

Quality deserves weight here. The Copyright Office's pre-publication report on generative AI training notes that model performance depends heavily on data quality, a point that applies as much to a company's internal assistant as to a frontier model.

3. Infrastructure and security

• Single sign-on and role-based access cover every system that holds sensitive records.
• There is an approved list of AI tools and a written rule on what staff may paste into them.
• Logs show who accessed or exported data, and someone reviews them.
• Compute, network and cloud capacity have been checked against the chosen use cases.
• Backups and archives are tested, including those of retired systems.

4. People and skills

• An executive sponsor outside IT owns the AI outcomes.
• Teams expected to use AI have had training built around their own tasks.
• At least one person per use case can judge whether model output is good enough.
• Change management is planned for every workflow that will change.
• Hiring or partner gaps are named, with a plan and a date.

5. Governance, privacy and risk

• Privacy policies, terms of service and customer contracts have been read for what they promise about data use.
• Sensitive categories (health, financial, children's, biometric) are mapped to the systems that hold them.
• Any health information is handled under HIPAA, including its de-identification standard.
• Contracts with AI vendors state whether company data may train the vendor's models.
• New AI use cases go through a review before launch.

Two facts anchor the governance interview. FTC staff have stated that companies' promises not to use customer data for undisclosed purposes, such as training models, are enforceable, whether made in a privacy policy, terms of service or marketing. And health information offered for licensing generally must be de-identified under one of the two methods in HHS guidance on the HIPAA Privacy Rule, expert determination or safe harbor, or otherwise authorized. This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

6. Data assets: systems, history, rights and export

This section doubles as a preliminary fit screen for data licensing.

• Headcount reached 50+ full-time employees at peak (contractors excluded), over several years of documented operations.
• Work is recorded across many systems: email, chat, shared drives, CRM, finance, support, engineering and operations tools (strong companies often run 10 to 15 or more).
• History runs back five years or more, including archived or retired systems that were exported before shutdown.
• Records carry outcomes: tickets resolved or escalated, deals won or lost, projects delivered late or on time, approvals granted or refused.
• The company created the records and its contracts allow licensing; they are not mainly client-owned, consumer or patient data.

One question sits outside the score: is the owner or CEO open to licensing these records exclusively for AI training, for a set term, in return for a single payment? Note the answer in the interview record. The company fit checker runs a preliminary, non-binding version of this section without contact details.

How to use the results

A company can score low on readiness and high on data assets at the same time. That combination is worth naming in the readout, because the asset exists whether or not the AI program does.

If you package this as a paid deliverable, the guide to adding a data asset review to an AI strategy engagement shows how to scope it, and a client roundtable on AI and company data is a low-pressure way to test interest across several clients at once.

Red flags in the data-assets section

Score the section, but stop short of any licensing conversation when you see these:

• The records mainly belong to the company's clients, as at many agencies and outsourcers, and those clients have not agreed.
• The data is mostly consumer personal information or patient records without authorization or de-identification.
• Archives were deleted, or tools were cancelled without an export.
• The same data has already been licensed for AI training.
• Records were generated with AI in order to sell them.
• Nobody at the company can run exports or own an inventory.

What to tell the client

Keep the data-assets finding factual and separate from your AI recommendations.

For background the client can read on their own, the explainer on how companies sell data to AI developers covers the basics.

If you make the introduction as a SourceX partner, the client's records stay with the client, and you neither export nor summarize them; SourceX qualifies the company directly with its owner or an authorized executive. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, and the reward becomes payable only after the buyer pays and SourceX receives its fee. Because the reward comes out of SourceX's share, the client's payment is unaffected, and no reward is guaranteed. Check your engagement letter and any independence policy before accepting it.

Next step

Run the data-assets section on your next assessment and compare it with the who qualifies baseline. When a client scores well and wants to explore it, register as a partner and send them your referral link.