AI readiness assessment: 20 checks for small businesses

For a business of 10 to 100 people, an AI readiness assessment turns on the work, the rules and who's in charge far more than on technology. Start with what your staff already do.

In August 2026, 40.5% of employed US adults aged 18 to 64 used generative AI for work, up from 37.4% a year earlier. The figures come from the Real-Time Population Survey, run by economists Alexander Bick, Adam Blandin and David Deming.

At smaller companies, much of that use runs on tools the business didn't provide. Microsoft and LinkedIn's 2024 Work Trend Index surveyed 31,000 knowledge workers in 31 markets in early 2024. Among AI users at small and medium-sized companies, 80% were bringing their own AI tools to work. In the same research, 61% of small and medium business leaders said their company lacked a vision and a plan to implement AI.

Counted by business rather than by worker, small firms are behind. "SME AI adoption remains relatively low compared to other digital technologies and to larger firms," the OECD wrote in a December 2025 paper for the G7.

What is an AI readiness assessment?

An AI readiness assessment is a structured check of whether a business has what it needs to use AI on real work. Versions written for large companies score data platforms and computing power. A small business uses AI inside software it already pays for, or through AI chat apps, so its check looks at the work, the information, the accounts and the rules.

NIST, the federal standards agency, publishes a voluntary AI Risk Management Framework. It came out in January 2023, and NIST says it is now being revised as part of the White House AI Action Plan. It sorts the work into four functions: Govern, Map, Measure and Manage. NIST's Playbook for the framework says it "is neither a checklist nor set of steps to be followed in its entirety," so you can take the parts that fit. The checks below cover all four functions in plain terms.

How to score the checklist

Count one point for each statement that's true for your business today. A plan for next month scores zero, and so does anything that lives only in someone's head. Give yourself the point when you could show it to a colleague.

Answer with two people in the room. The owner or manager knows the budget, the rules and the contracts. Someone who does the weekly work knows how long each task takes and which AI they already use. Set aside an hour, and write down every check you missed, because those gaps decide what you do first.

The AI readiness checklist

Your weekly tasks

1. You can name five tasks that come up every week and are mostly reading or writing. Replies to inquiries, quotes from site notes, meeting follow-ups and job reports are typical. The first step of our guide to starting with AI lists five for each type of business.
2. Each of those tasks follows a pattern a new hire could learn in a day. If a new hire would need weeks of shadowing to learn it, it's a poor first task for AI.
3. You have three examples of each task done well. Past replies, quotes or reports you were happy with show the AI what good looks like.
4. A person checks each task's output before a customer sees it. Start where that check already happens. A task that goes straight to customers is a poor first choice.

Where the information lives

5. The facts those tasks depend on are written down. Prices, service areas, refund terms, opening hours and product details have to sit in files you can hand to the AI.
6. Each of those files has one current version. With three price lists in three inboxes, the AI quotes from whichever one it gets. Pick one, date it and archive the rest.
7. You know which of your information is confidential. For most businesses that means client personal details, staff records, financial figures and anything a contract says must stay private.
8. Everyone signs in to email and file storage with their own account. With a shared login, you can't see who used it or lock out one person when they leave.

The AI you already have

9. You know which AI features your Google Workspace or Microsoft 365 plan includes. The section of our guide on the AI you already pay for covers what each suite includes and what it costs.
10. You've asked your team which AI apps they use for work. Ask whether they sign in with a work or a personal email, and what they paste in. Ask without blame, or you'll get a shorter list.
11. Every AI account that touches company information is a business account you control. Google's Workspace privacy page says Workspace doesn't use customer data to train models without the customer's permission. Microsoft's data protection page says the prompts and responses in its business AI aren't used to train foundation models. We checked both pages on November 1, 2026. Neither covers a personal account, and nobody at your company can see or close one.
12. Before adding a new AI subscription, you've tested the one you have on your five tasks. Try each task on three real examples. Pay for a second tool only for the tasks the first one gets wrong.

Who owns it

13. One named person is responsible for AI in the business. That person decides which tools are allowed and keeps the rules current. Everyone else knows to ask them first.
14. That person has a fixed weekly slot for it in their calendar. Writing instructions, testing them and fixing what goes wrong need regular time, such as Friday mornings, or the job waits behind everything else.
15. You've set a monthly budget for AI. With a figure agreed, the owner can switch on a business plan or pay for help without a fresh discussion each time.

The rules

16. A written list says what must never be pasted into AI. Start with client ID numbers, bank and card details, passwords and anything under a confidentiality clause. Our guide to what goes in an AI policy covers the rest of a one-page policy.
17. Your rules name who checks AI drafts and what they check them against. For example, the office manager checks every quote against the current price list. AI that sounds certain can still be wrong, and NIST's Generative AI Profile has a name for it: confabulation. A person who checks the facts against your files can catch it first.
18. Your team knows which data comes with legal or contract conditions. Some of it is regulated. If HIPAA applies to your business, HHS guidance treats a cloud service that creates, receives, maintains or transmits electronic protected health information for you as a business associate. That holds even if the service stores only encrypted data and has no key to it, and you must sign a business associate agreement with it. The FTC's Safeguards Rule guidance lists tax preparation firms among the financial institutions it covers and says their contracts with service providers must spell out security expectations. Client contracts can add limits of their own.

How you'll measure it

19. You've written down how many hours a week each task takes today. A rough figure from the person who does the task is enough. It's the number you'll compare against.
20. There's a date in the calendar, about 30 days after you start, to measure the same tasks again. If a number hasn't moved, look at the instructions and examples first, then at whether people use them.

What your score means

Add up your points. The total tells you how fast to move, and the checks you missed tell you what to fix first.

If you missed check 11 or 16, read your result one band lower until both are fixed. Staff on personal AI accounts and no list of what stays out of AI are risks you carry today, before you've set anything up.

Take a 25-person accounting firm with a clear task list, good examples of client emails and an office manager who already reviews everything that goes out. Nobody owns AI, some staff use personal AI accounts, and there's no never-paste list. The tasks score well and the owner, accounts and rules don't, so the firm's first two weeks go to naming an owner, moving everyone onto business AI accounts and writing the list. Client email replies come after that.

If you'd rather have someone run this with your team, Optimitor's AI audit takes one week, from $3,000.

Which free AI readiness tools are worth using?

Two public tools are worth your time, one now and one later.

The OECD built its SME AI Readiness Tool under the 2026 French G7 Presidency for owners and managers in G7 countries, including the US. It covers businesses with up to 249 employees, counted as full-time equivalents, and the questionnaire takes about five minutes. It asks about your digital foundations, how complex and how wide your AI use is, staff familiarity, risk management and the barriers you face. At the end you get a readiness profile and a list of government support programs in your country. Your answers are processed in your browser and never sent to a server, and the OECD labels the tool a pilot whose results may change.

The tool scores you against the taxonomy from the OECD's G7 paper, which sorts small adopters by digital maturity, complexity of use and scope of application. Use it to see which of its four adopter profiles fits your business, then use the checklist above for the fixes.

NIST's AI RMF Playbook suits a later stage, once AI touches more of the business. It lists suggested actions for each of the four functions, and NIST says the suggestions are voluntary.

Frequently asked questions

How long does an AI readiness assessment take?

About an hour for the 20 checks in this post, with the owner and one person who does the weekly work answering together. The OECD questionnaire takes about five minutes but gives you a profile rather than a list of fixes. Ours takes one week, because it includes 45-minute interviews with three of your people and a check of the software you pay for.

Is there a free AI readiness assessment?

Yes. The checklist in this post costs nothing to use or copy. The OECD's SME AI Readiness Tool covers firms with up to 249 employees in G7 countries, including the US, and processes your answers in your browser without sending them to a server. NIST's AI RMF Playbook is also public, but it suits businesses with more AI in use.

Do I need clean data before using AI?

Not for most first tasks. Drafting replies, quotes and summaries depends on a few current documents, such as your price list, your policies and good examples, rather than a cleaned-up database. Data quality starts to matter when AI reports on numbers from your CRM, accounts or analytics, so fix those sources before you automate a report.

Who should do the AI readiness assessment?

The owner or manager, with one person who does the weekly work. The owner knows the budget and the contracts, so checks 15 and 18 depend on them. If the owner answers alone, checks 10 and 19 become guesses, because only the people doing the work know which AI they use and how long the tasks take.

What should I do after the assessment?

Fix the gaps that block your first task, then set up AI on one or two tasks and test each on three real cases. Measure the same tasks 30 days later. Score the checklist again after that, because the gaps change once people use AI every day.