An AI readiness assessment framework for enterprises

This framework is for executives, operations leaders and technology leads who want to know whether their organization can put AI into real work, not only into demos. It is informational: a self-assessment you can run with your own team. If you want an external assessment and a prioritized plan, that is what the AI strategy and readiness service covers. For choosing and governing the first automated processes, read our AI automation for business operations guide.

What a readiness assessment is, and what it is not

A readiness assessment answers one question: which conditions must be true before AI can create value here safely, and which of them are missing? It looks at the organization, not at the model. It is not a vendor selection, a model benchmark or an ROI forecast. It produces a scored picture across six dimensions, a list of gaps and a sequence of actions.

There are three good reasons to run one before investing:

• AI pilots often succeed technically and then stall, because data, ownership or integration were never ready for production.
• Regulation increasingly expects organizations to know which AI systems they use and what risk each one carries.
• A shared picture stops the most enthusiastic team, or the most persuasive vendor, from setting the agenda alone.

The six dimensions

Maturity levels

Score each dimension on four levels. Use evidence, not opinion: a level counts only if someone can show the artifact behind it.

Most mid-sized organizations score unevenly: level 3 on technology because their core systems are modern, level 1 on governance because nobody has been asked to own it. That uneven profile is normal, and finding it is the point of the assessment.

Decision framework: what the scores tell you to do

The rule behind the table is simple: the weakest dimension limits everything else. A strong model on weak data, or a strong pilot with no owner, rarely reaches production.

Frameworks and regulation to map against

You do not need to invent the governance dimension from scratch. Two public references help structure it:

• NIST AI Risk Management Framework. A voluntary framework released in January 2023 and organized into four functions: Govern, Map, Measure and Manage. NIST's Generative AI Profile (NIST AI 600-1, July 2024) adds guidance for risks specific to generative AI. Mapping your governance and operations dimensions to these functions gives the assessment a recognized structure.
• The EU AI Act. Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies generally from 2 August 2026, with some obligations phased in on other dates. It takes a risk-based approach: some practices are prohibited, high-risk systems such as recruitment tools carry strict requirements, some systems carry transparency duties such as telling people they are interacting with AI, and most systems carry no specific obligations. If you serve EU customers or employ staff in the EU, classify each candidate use case against these categories in step 5 and check the European Commission's current timeline.

Neither reference certifies anything on its own, and this page is not legal advice.

Trade-offs in how you assess

Readiness checklist

• A ranked list of use cases, each with an owner and a measure.
• A data inventory for the top use cases, with quality and access rights checked.
• An integration path from AI outputs to the systems where the work happens.
• Named roles for building, reviewing and running AI systems.
• An AI inventory with a risk classification for each system.
• An approval step before production and a tested way to switch a system off.
• Human review for high-impact outputs, with review capacity planned.
• Baseline measures taken before go-live.
• Security controls on AI data: access control, encryption and logging.
• A review date for the assessment itself.

Example: where a delivered AI step sits

The dimensions show up clearly in delivered work. For 4over4, an online printing business, Netbase built a recommendation engine inside an existing order flow, where the inputs already existed, the integration point was clear and the business tracked its results; the same project automated file conversion. As reported in the case study, design-file production time fell 40%, fulfilment time fell 50% and revenue grew 82% within six months. The figures cover the whole engagement, not the recommendation engine alone.

Read the 4over4 case

The lesson for an assessment: the AI step came last, where data, integration and measurement were already at a working level. Where those are missing, an AI step inside a rule-based flow is often the right first project; our AI agent vs workflow automation comparison explains when each approach fits. For commerce teams, commerce operations automation covers the order, file and fulfilment flows where such steps usually sit, and retail and e-commerce shows the wider industry context.

Limitations of this framework

• It is a practical framework drawn from delivery experience, not original research, and it has not been validated statistically.
• Maturity levels are qualitative. Two assessors can score the same evidence differently; calibration in step 4 reduces this but does not remove it.
• The regulatory summary is general and was checked on the access date. Regulation and its timelines change; rely on the official sources.
• No ROI figure is offered. Value depends on the use case, the baseline and adoption, and should be measured in your own pilot.
• AI capabilities and costs change quickly, so this page is reviewed quarterly.

Next step

Send us your candidate use cases and the systems they touch, and we will book a solution review to score the six dimensions with you and name the first gap to close. You can also see the related service or browse more Netbase insights.

Related services and solutions