AI Readiness Assessment: A Scored Checklist for 2026 (with Free Template)
A practical AI readiness assessment for 2026: a 35-question scored checklist across seven pillars, four readiness bands, a worked example, a comparison of Cisco, Gartner, Microsoft, Google, AWS, NIST and ISO 42001 frameworks, and a free Excel scorecard.
An AI readiness assessment scores how prepared your organization is to deploy AI and get measurable value from it. Ours uses 35 yes/partial/no questions across seven pillars (strategy, data, infrastructure, talent, governance, use-case ROI and culture), weighted to 100 points, with four bands and a 90-day plan for each.
Most companies don’t have an AI problem. They have a readiness problem. They can buy models, copilots and agent platforms in an afternoon. What they can’t buy is clean data, a named owner, a risk process and a way to prove the pilot paid off.
This guide gives you a practical AI readiness checklist you can finish in a working session. It’s the scoring framework we use at The Brief Script, built from the major public frameworks and from our own studies of 250 enterprise AI case studies and 150 enterprise AI agent deployments. You get the full question set, the weights, a worked example and a free scorecard that totals itself.
Download the free scorecard (Excel, auto-scores and shows your band) or the one-page PDF checklist.
Why AI readiness matters in 2026
Adoption is no longer the hard part. Value is. Every major survey this year says the same thing in different words.
- Use is broad, profit impact is flat. In McKinsey’s State of AI in 2026 (published August 25, 2026; 1,719 respondents), 44% said AI is scaling across their enterprise, up from 38%. Yet only 37% attributed any EBIT impact to AI, essentially unchanged from 2025. High performers stayed at about 6%.
- Few companies are fully ready. Cisco’s AI Readiness Index (third edition, October 14, 2025; 8,000 leaders) puts “Pacesetters” at about 13% of organizations, a share that has barely moved in three years. Pacesetters were 4x more likely to move pilots into production.
- Value is concentrated. BCG’s Widening AI Value Gap (September 30, 2025; 1,250 executives) found 5% of companies achieving AI value at scale and 60% reporting minimal revenue or cost gains.
- ROI lags expectations. IBM’s 2025 CEO Study (May 6, 2025; 2,000 CEOs) found only 25% of AI initiatives delivered expected ROI and 16% scaled enterprise-wide.
- Operational readiness trails strategy. Deloitte’s August 12, 2026 survey of 501 U.S. leaders found 52% prepared on vision and strategy, but only 42% on data, 39% on risk and governance, 25% on workforce and 21% on business processes.
You’ve probably also seen the claim that “95% of AI pilots fail.” It comes from MIT NANDA’s The GenAI Divide (July 2025), whose executive summary says 95% of organizations are getting zero return on generative AI. Treat it with care. The report calls itself preliminary. It rests on 52 interviews, 153 survey responses from four conferences and a review of 300+ public initiatives, and it lists its own limits: possible selection bias, success definitions that vary by organization and a six-month window that may understate results. It’s a useful signal that custom enterprise tools often stall. It isn’t a failure rate for AI.
Our own data points the same way, with a twist. In our 250-case study, 90% of cases published a quantified outcome, but only 11.6% disclosed explicit money, ROI or payback figures, and just 4% paired an observed result with explicit ROI evidence. Companies are creating operational value. Most can’t yet show where it lands on the P&L. That’s a readiness gap, and it’s measurable.
The Brief Script AI Readiness Score at a glance
The framework has seven pillars. Each pillar has five questions. Answer each one No (0), Partial (1) or Yes (2), so every pillar has a raw score out of 10. Multiply by the pillar’s weight to get pillar points. The total is out of 100.
Why these weights? Data and use-case ROI get 20 points each because that’s where pilots die. Gartner predicted in February 2025 that organizations will abandon 60% of AI projects unsupported by AI-ready data through 2026, and Cisco found only 19% of companies have fully centralized data. Governance and strategy get 15 each. Infrastructure, talent and culture get 10 each: they matter, but infrastructure is largely buyable now, and talent and culture show up again inside the other pillars.
One rule overrides the total. If any pillar scores 3 or less out of 10 raw points, your band is capped at Piloting. A company with a great strategy and no governance isn’t ready to scale, whatever the arithmetic says.
The full AI readiness checklist
Score honestly. The rule we use: answer Yes only if you could show evidence (a document, a dashboard, a named owner) to an auditor tomorrow. “We’re working on it” is Partial.
1. Strategy and leadership (15 points)
| ID | Question | What “Yes” looks like |
|---|---|---|
| S1 | We have a written AI strategy tied to two or three named business goals, approved by the executive team. | A signed-off document with goals and targets |
| S2 | One named executive owns AI outcomes and the AI budget (not only IT). | A name, a budget line and a mandate |
| S3 | AI has multi-year funding beyond single pilots. | Funding in the annual plan, not discretionary spend |
| S4 | Leadership reviews AI portfolio results at least quarterly, against agreed metrics. | A recurring agenda item with a scorecard |
| S5 | We have a clear build, buy or partner rule for AI solutions. | Written criteria used in recent decisions |
Cisco found 99% of Pacesetters have a defined AI roadmap versus 58% of all companies. For help writing one, see our guide to enterprise AI strategy.
2. Data (20 points)
| ID | Question | What “Yes” looks like |
|---|---|---|
| D1 | The data for our top three use cases is identified, owned and accessible. | Named data owners and access paths |
| D2 | We measure data quality (completeness, accuracy, freshness) for those datasets. | Quality metrics with thresholds |
| D3 | Data is classified, with rules for what may be sent to external AI models. | A classification policy enforced in tools |
| D4 | We can show lineage: where training or grounding data came from and who approved it. | Lineage in a catalog or pipeline logs |
| D5 | Pipelines or APIs feed AI applications in production, not manual exports. | Automated, monitored data feeds |
3. Infrastructure and technology (10 points)
| ID | Question | What “Yes” looks like |
|---|---|---|
| I1 | Staff use approved AI platforms or models with single sign-on, logging and data controls. | An approved-tools list and enterprise contracts |
| I2 | We can deploy, monitor and roll back models and agents (MLOps/LLMOps). | Versioning, monitoring and rollback in place |
| I3 | AI tools connect to core systems such as CRM, ERP or ticketing through APIs. | Live integrations, not copy and paste |
| I4 | We track inference and compute cost per use case, not just the total bill. | Unit cost per task or transaction |
| I5 | We test for AI-specific threats such as prompt injection and data leakage. | Red-team or test results on file |
Deloitte’s State of AI in the Enterprise 2026 report (3,500 senior leaders) found 71% of companies track total AI inference spend but only 44% track per-unit cost. If you’re still choosing a platform, our Enterprise AI Platform Index scores 22 platforms on 29 sourced fields. Only 9 of the 22 publish a full price list, so ask for unit pricing early.
4. Talent and skills (10 points)
| ID | Question | What “Yes” looks like |
|---|---|---|
| T1 | AI literacy training is offered to all staff and completion is tracked. | Completion rates by department |
| T2 | We have, in-house or under contract, data engineering, AI engineering and AI product skills. | Named people or partners for each |
| T3 | Teams whose workflows change get role-specific training. | Training tied to each rollout |
| T4 | AI roles (AI product owner, model risk owner) are defined with responsibilities. | Role descriptions in use |
| T5 | We have a workforce plan for roles that AI will change. | A plan HR and the business agree on |
5. Governance, risk and compliance (15 points)
| ID | Question | What “Yes” looks like |
|---|---|---|
| G1 | A published AI use policy covers approved tools and unsanctioned (shadow) AI. | A policy staff have acknowledged |
| G2 | We keep an inventory of AI systems in use, including vendor AI, with risk tiers. | A living register with owners |
| G3 | High-risk use cases get a risk assessment before launch, mapped to NIST AI RMF or ISO/IEC 42001. | Completed assessments on file |
| G4 | Human-oversight rules match each system’s level of autonomy, and accountability for bad outcomes is named. | Approval and escalation rules per system |
| G5 | We know which AI laws apply to us (EU AI Act, U.S. state laws) and track their deadlines. | A regulatory map with dates |
This pillar is the most common weak spot we see. The same Deloitte 2026 report found 40% of companies let AI execute decisions without human approval to at least a moderate degree, yet 23% say accountability for a bad outcome is unclear. Our AI regulation tracker checked 25 jurisdictions against official sources and found 12 with binding AI rules already in force. In the EU, the AI Omnibus pushed high-risk Annex III obligations to December 2, 2027, per the European Commission. That’s a deadline, not a reprieve. For the controls themselves, use our AI audit checklist and our playbook on AI enterprise governance.
6. Use-case portfolio and ROI (20 points)
| ID | Question | What “Yes” looks like |
|---|---|---|
| U1 | We keep a prioritized use-case backlog scored on value and feasibility. | A ranked list reviewed each quarter |
| U2 | Every use case has a baseline and a unit-of-work metric before launch. | “Minutes per claim,” not “productivity” |
| U3 | At least one use case runs in production (not a pilot) with measured results. | A live system with a results dashboard |
| U4 | We track financial impact (cost, revenue, payback), not only time saved. | Finance signs off on the numbers |
| U5 | Pilots face a stage gate (scale, fix or stop) within a set period, such as 90 days. | Documented gate decisions, including kills |
Our 250-case study found that the strongest deployments define the unit of work, publish a baseline, measure long enough to separate a demo from a system and explain how the number was produced. Cisco found 95% of Pacesetters track the impact of their AI investments versus 32% overall.
7. Culture and change (10 points)
| ID | Question | What “Yes” looks like |
|---|---|---|
| C1 | Each production use case has a change-management plan. | Plans with owners and dates |
| C2 | Business units co-own use cases, and front-line staff help design them. | Business sponsors on every project |
| C3 | Employees have a safe, sanctioned way to try AI and propose use cases. | A sandbox and an intake process |
| C4 | We redesign workflows around AI instead of bolting AI onto old processes. | New process maps, not old ones with a tool |
| C5 | We measure adoption and user trust for each AI tool. | Usage and satisfaction data |
McKinsey’s 2026 survey found nearly three-quarters of AI high performers had fundamentally redesigned workflows, against about one-quarter of everyone else. For a playbook on moving from pilots to daily use, see our guide to enterprise AI adoption.
How to score yourself (and read the result)
- Assemble a small panel. Include the AI owner, a data lead, a security or risk lead, a finance partner and one business-unit leader. One person scoring alone tends to overrate their own area.
- Score with evidence. Use the Yes/Partial/No rule above. Where the panel disagrees, take the lower answer.
- Calculate. For each pillar, add the five answers (0 to 10), divide by 10 and multiply by the weight. Add the seven pillars.
- Apply the gate. If any pillar has a raw score of 3 or less, cap the band at Piloting.
- Record owners. Every No becomes an action with a name and a date.
Exploring (0 to 39). You have interest and scattered experiments but no shared strategy, data plan or guardrails. Next: name an executive owner, publish an AI use policy, inventory the data for two or three use cases and run one pilot with a baseline.
Piloting (40 to 59). You have pilots and some wins, but few reach production and value isn’t measured consistently. This is where most companies sit. Next: add stage gates and baselines, build a governance inventory, fix data quality for the pilots that matter and stop the rest.
Scaling (60 to 79). You run several production use cases on a shared platform and can show value in some areas. Next: industrialize with shared MLOps, unit-cost tracking, workflow redesign and risk tiers mapped to NIST AI RMF or ISO/IEC 42001.
AI-native (80 to 100). AI is embedded in core workflows with governed, measured, bounded autonomy. Next: expand agents within clear limits, add continuous monitoring and external assurance, and reinvest the gains.
A note on calibration: our cut-offs are lower than Cisco’s (Pacesetters score 86 or more) because our questions demand evidence rather than self-rated deployment. Don’t compare the two numbers directly.
Worked example: a mid-size distributor (illustrative)
Northfield Supply is a fictional company we use to show the method. It isn’t a real company or survey result.
Northfield is a U.S. distributor with about 1,800 employees. It has an AI strategy signed off by the CEO, a COO who owns the budget and two production use cases: invoice matching in finance and a customer-service assistant. Here’s how its panel scored it.
| Pillar | Raw (of 10) | Weight | Points | Why |
|---|---|---|---|---|
| Strategy & leadership | 8 | 15 | 12.0 | Strategy and owner in place; funding still year to year |
| Data | 6 | 20 | 12.0 | Data classified and owned; no lineage, quality only partly measured |
| Infrastructure & technology | 7 | 10 | 7.0 | Approved platform and integrations; no unit-cost tracking |
| Talent & skills | 5 | 10 | 5.0 | Literacy training done; no defined AI roles |
| Governance, risk & compliance | 3 | 15 | 4.5 | Policy published; no risk tiers, no oversight rules, no regulatory map |
| Use-case portfolio & ROI | 7 | 20 | 14.0 | Two live use cases; financial impact only partly tracked |
| Culture & change | 6 | 10 | 6.0 | Business co-ownership; workflows mostly unchanged |
| Total | 100 | 60.5 | Scaling by score, capped at Piloting by the gate |
Northfield’s arithmetic says Scaling. The gate says Piloting, because governance scores 3 out of 10. That’s the right call. Its customer-service assistant talks to customers, and our 250-case study shows customer-facing errors are where AI failures turn into legal and reputational events. Northfield’s 90-day plan should start with an AI inventory, risk tiers and human-oversight rules for that assistant. Raising governance to 7 out of 10 would lift its score to 66.5 and clear the gate.
How the major AI readiness frameworks compare
Our scorecard borrows from established frameworks. Here’s what each one measures and when to use it.
| Framework | What it measures | Output | Best for |
|---|---|---|---|
| Cisco AI Readiness Index (2025 edition) | Six pillars (strategy, infrastructure, data, governance, talent, culture), 49 indicators | Score out of 100 and one of four levels, Pacesetter to Laggard | Benchmarking against a large global survey |
| Gartner AI Maturity Model (Nov 2024) | Seven pillars, from AI strategy and use-case portfolio to AI engineering, data, ecosystems and people | Levels 1 (planning) to 5 (leadership) per area | Gartner clients building a multiyear roadmap |
| Microsoft AI Readiness Assessment | Seven pillars, including business strategy, governance and security, data foundations and model management | Score with personalized recommendations | Organizations planning on Azure and Microsoft 365 |
| Google Cloud AI Adoption Framework | Six themes (lead, learn, access, scale, automate, secure) across people, process, technology and data | Tactical, strategic or transformational phase per theme | Building an ML engineering capability |
| AWS CAF-AI | Foundational capabilities across six perspectives: business, people, governance, platform, security, operations | Capability gap map, no single score | AWS-centric teams planning platform and operating-model work |
| MIT CISR Enterprise AI Maturity Model | Four stages, from experiment and prepare to AI future-ready | Stage placement | Linking maturity to financial performance |
| NIST AI RMF 1.0 | Risk management through four functions: govern, map, measure, manage (plus a generative AI profile) | Risk practices and profiles, not a score | U.S. organizations setting up AI risk management |
| ISO/IEC 42001:2023 | Requirements for an AI management system | Certification by an accredited body | Proving governance to customers and regulators |
The first six assess capability. NIST AI RMF and ISO/IEC 42001 govern risk and are usually the backbone of the governance pillar, not substitutes for a readiness score. MIT CISR’s research found companies in its first two stages performed below their industry average financially, while those in stages three and four performed well above it. Note that ISO/IEC 42001 is becoming a buying criterion: in our platform index, only 6 of 22 vendors held all five credentials we tracked, ISO 42001 among them.
Red flags that should lower your score
- Pilots with no kill date. If nothing has ever been stopped, your stage gate isn’t real.
- “Productivity” as the only metric. No baseline, no unit of work, no finance sign-off.
- No AI inventory. If you can’t list the AI in use, including features inside SaaS tools, you can’t govern it.
- Agents with write access and no oversight rules. In our 150-deployment study, 118 of 150 deployments described explicit human approval, exception handling or review. Bounded autonomy (38% of the sample) is what’s working.
- One team owns everything. IT-only programs rarely change workflows.
- A strategy deck with no budget line. Cisco found 96% of Pacesetters have short- and long-term funding strategies, against 43% overall.
- Per-seat licenses with no usage data. You’re paying for adoption you can’t see.
- Regulation treated as “later.” EU high-risk rules apply from December 2, 2027, and some U.S. state laws start in 2027.
A 90-day plan for each band
| Band | Days 1 to 30 | Days 31 to 60 | Days 61 to 90 |
|---|---|---|---|
| Exploring | Name an executive owner; publish an AI use policy; approve one enterprise AI tool | Inventory data for two or three candidate use cases; set baselines | Launch one pilot with a stage gate; run AI literacy training |
| Piloting | Build an AI inventory with risk tiers; add a baseline to every pilot | Fix data quality for the top two pilots; stop the rest | Move one pilot to production with finance-approved metrics |
| Scaling | Stand up shared MLOps and cost tracking per use case | Redesign one end-to-end workflow; map controls to NIST AI RMF or ISO/IEC 42001 | Add a second production use case on the shared platform; report value quarterly |
| AI-native | Define autonomy levels and approval rules for agents | Add continuous monitoring and incident playbooks | Commission an external assurance review; reinvest gains in the backlog |
If you’re capped by the gate, start with the weak pillar, whatever your band.
An interactive version of this AI readiness score, with instant benchmarks, is coming soon.
FAQ
What is an AI readiness assessment?
An AI readiness assessment is a structured check of whether an organization can deploy AI and get measurable value from it. It typically scores strategy, data, technology, talent, governance, use cases and culture, then points to the gaps to fix first. Ours uses 35 evidence-based questions weighted to 100 points.
How long does an AI readiness assessment take?
With the right people in the room, plan on two to three hours to score our 35 questions, plus time to gather evidence. Vendor self-assessments from Cisco and Microsoft are shorter online questionnaires. A consultant-led assessment usually takes several weeks because it adds interviews and document reviews.
What is a good AI readiness score?
On our scale, 60 or more with no pillar at 3 or below means you’re ready to scale proven use cases. Most organizations land in Piloting (40 to 59). Treat the score as a baseline to track over time, not a grade to compare across companies.
What is the difference between AI readiness and AI maturity?
Readiness asks whether your foundations can support AI right now. Maturity describes how far along the journey you are, usually in stages. In practice they overlap, and an AI maturity assessment like Gartner’s or MIT CISR’s covers similar ground. A readiness score is more useful for deciding what to fix next quarter.
Which AI readiness framework should I use?
Use a vendor-neutral checklist like ours for an internal baseline. Use Cisco’s to benchmark against peers, Microsoft’s, Google’s or AWS’s if you’re committed to that cloud, and NIST AI RMF or ISO/IEC 42001 for the risk and governance work underneath.
How often should we reassess AI readiness?
Every six months, and after any major change such as a new platform, a reorganization or a new regulation. Re-scoring every quarter is useful while you’re working through a 90-day plan. Keep the same panel so changes reflect progress, not different opinions.
How we built this framework
The pillars combine the dimensions shared by Cisco, Gartner, Microsoft, Google Cloud and AWS, with governance controls drawn from NIST AI RMF and ISO/IEC 42001. Weights reflect where surveys and our own studies show projects stall. Survey figures come from each publisher’s own report or press release, checked November 1, 2026. The worked example is fictional. The framework is a planning tool, not a certification.