AI Readiness Checklist: What to Settle Before You Buy AI Tools

Each item here is a question a business owner can answer with yes, no or partly, followed by a line on why it matters. A no doesn't mean wait. It shows what to fix first, or which area to keep the first project away from.

Work through it with the people who do the work and whoever manages IT. NIST's AI Risk Management Framework Playbook covers much of the same ground in more depth, and NIST describes it as voluntary, with users taking the suggestions that fit their needs. Use this list the same way.

Goals and measures

1. Can you name the tasks you want AI to help with? "Quotes go out three days after the site visit" is a problem a tool can shorten. "Be more efficient" is too vague to act on.
2. Do you know today's number for each one? Time per task, volume per week, how often work gets redone. Without a before number, nobody can say later whether the tool helped.
3. Have you decided what result would make it worth keeping? Set it before you start, so the decision to keep or stop rests on the number.
4. Is each goal about time, revenue or quality? They get measured differently, and they justify different amounts of spend.

Processes

1. Is each target process written down, even as a rough list of steps? If the steps exist only in one person's head, any tool gets set up around guesses.
2. Do you know who does each step and roughly how long it takes? The value of a change is worked out from those two figures.
3. Do you know where work waits? A faster first draft does nothing for a quote that then sits two days waiting for approval.
4. Have you marked the steps that need a person's judgment or sign-off? Those become the review points in the AI-assisted version.
5. Do you know the common exceptions? Test any new setup on the odd cases as well as the routine ones.

Data

1. Do you know where the information for each process is kept? Which system, which folder, whose inbox. An AI tool can only work from what it is connected to or what someone pastes in.
2. Is there one agreed source for customers, prices and jobs? If two spreadsheets disagree, the answers depend on which one the tool was pointed at.
3. Is that information current? An AI draft built from an old price list will contain the old price.
4. Have you sorted your information into a few categories, such as public, internal, confidential and regulated? The use policy and the choice of tool both depend on these categories.
5. Can you export your data from each system? Connecting a new tool, or leaving one, depends on it.

Systems and access

1. Do you have a list of every software subscription, and do you know which ones already include AI features? Microsoft offers Copilot inside Microsoft 365 and Google offers Gemini inside Workspace. Check what your accounting, CRM and phone systems include too, before buying something separate.
2. Are shared drive permissions set correctly? Microsoft says Microsoft 365 Copilot only surfaces organizational data a user has at least view permission for, and Google says that if you don't have permission to see a file, Gemini can't see or use it either. Both protections depend on the permissions being right. A payroll folder open to everyone becomes much easier to find.
3. Does every person have their own login? Business plans manage access per user. Shared logins make it hard to see who did what, or to remove one person's access when they leave.
4. Is someone responsible for admin settings? In-house or an outside IT provider, someone has to turn on admin controls, set retention, and connect tools.
5. Do your main systems connect to each other? Check whether each has an integration or an export, since automation tools need one or the other.

Security and privacy

1. Do you know which AI tools people already use, including personal accounts? NIST's framework lists an inventory of AI systems as part of governance (GOVERN 1.6). Ask without blame. People already using AI are a good source of first projects.
2. Is each tool on a plan whose terms keep your content out of model training? Anthropic says that by default it does not use inputs or outputs from its commercial products to train its models. Microsoft says Copilot prompts, responses and data accessed through Microsoft Graph aren't used to train foundation models. Google says Workspace content isn't used for model training outside your domain without permission. Personal and free plans can differ, so check the plan and its settings. What is safe to put into ChatGPT explains the difference.
3. Is there a written list of what never goes into an AI tool? Passwords, card numbers, health information and anything under someone else's NDA are the usual start. The U.S. Small Business Administration's guidance tells small businesses to try not to feed sensitive data or proprietary information into these tools.
4. Is multi-factor authentication on for every account that will connect to an AI tool? An assistant connected to email and files can reach whatever that login reaches, so anyone who gets into the login gets that reach too.
5. Do you know how long each vendor keeps prompts and outputs, and who can delete them? For Microsoft 365 Copilot, admins can set retention policies for Copilot interactions in Microsoft Purview. Other vendors document this on their privacy pages.

Policy and compliance

1. Do you have a written AI use policy? Approved tools and plans, data rules, review rules, disclosure, and who approves new tools. One page is enough to start.
2. Do you know which laws and contracts apply to how you use AI? The first item under governance in NIST's framework is that legal and regulatory requirements involving AI are understood, managed and documented (GOVERN 1.1). For most small businesses that means client confidentiality terms, privacy law, and any rules specific to the industry.
3. Will AI touch decisions about people, such as hiring? New York City's Local Law 144 bars employers and employment agencies from using an automated employment decision tool unless it has had a bias audit within one year of its use. The European Commission lists CV-sorting software for recruitment among high-risk uses under the EU AI Act.
4. Does the business operate in the EU? Check the European Commission's AI Act page. The Act's AI literacy obligations entered into application on 2 February 2025.
5. Who checks AI output before it reaches a customer? The SBA's guidance says that if you use free AI tools, have another person review what they produce. Microsoft's Copilot documentation tells users to use their judgment when reviewing output before sending it to others.
6. Have you decided what to tell customers about your use of AI? The European Commission says that under the EU AI Act, people using AI systems such as chatbots should be made aware they are interacting with one. Check the rules where you operate, and decide what you will say even where none applies.

People and training

1. Do you know who already uses AI well? They make good first testers and in-house help.
2. Will everyone get training on the specific tools and on the policy? NIST's framework includes AI risk management training for personnel and partners, so they can do their jobs consistent with the organization's policies (GOVERN 2.2). A generic course won't cover your approval rules.
3. Do people know what to check in AI output? Facts, figures, names, tone, and anything that commits the business to something.
4. Have you told staff what the hours saved will go to? More jobs booked, faster replies, less overtime. Say it before asking anyone to change how they work.
5. Is there time set aside to learn? A new tool needs practice, so keep the rollout away from the busiest week of the quarter.

Budget and ownership

1. Is one named person responsible for AI in the company? NIST's framework asks for roles and responsibilities to be documented and clear to individuals and teams (GOVERN 2.1). In a small business that can be the owner or an office manager, with a few hours a week set aside for it.
2. Does the budget cover setup and training time as well as subscriptions? Staff hours spent learning and setting up are part of the cost.
3. Is there one person who approves new AI tools? Without that, subscriptions pile up across teams and nobody knows what is in use.
4. Is there a review date with a keep, change or stop decision? NIST's framework asks that the potential benefits and costs of an AI system be examined and documented (MAP 3.1 and MAP 3.2). Put the date on the calendar when the project starts.
5. Who keeps the tool list and the policy up to date? Vendors change their terms and features, and staff pick up new tools, so the list goes stale.

What to do with the answers

Count the no answers in each section.

Mostly yes across the board. Pick a first project and start. A task that repeats every week, is mostly writing or sorting, and is quick to check is the right size.

Several no answers in one or two sections. Fix what blocks the first project and start anyway with a project that stays clear of the rest. Loose shared drive permissions, for example, block switching on Copilot or Gemini across the company. They don't block one person drafting quotes in a business-plan assistant.

No answers spread across most sections. This is where an outside AI audit helps: the auditor ranks the gaps by what they cost and what fixing each one is worth, and turns the list into a roadmap.

For choosing first tasks and tools, see AI for small business.