AI Readiness Assessment: A Scored Self-Check for Startups

Executive Summary

Most AI readiness advice asks whether your data and infrastructure can support AI. The question a customer asks is different: is anyone accountable for what your AI does, and can you prove it? That is the question an AI readiness assessment has to answer for a startup.

An AI readiness assessment is a structured check of whether an organization has what it needs to adopt or scale AI. For a SaaS startup, that means scoring ownership, inventory, data handling, vendors, security, staff literacy and incident response before an AI feature ships, then fixing the lowest scores first.

Quick take The check below has 28 questions in 7 areas, scored 0, 1 or 2, for a maximum of 56. Four hard-stop questions block a customer-facing launch whatever the total says. No law or standard requires an assessment by this name, and the scoring model is ComplyJet's own, not an ISO, NIST or EU method.

Note This is a company-level self-check. It is not a risk assessment of one AI system (see the AI risk assessment guide), not the build guide for a governance programme (see the AI governance framework), and not an ISO 42001 certification audit (see the ISO 42001 checklist). It also does not score data platforms, infrastructure or ROI, which is the other meaning of "AI readiness".

You can finish it in an afternoon, and you will leave with three numbers: a total, a count of hard-stop failures, and the areas that need work first.

Here's what I'll cover:

What an AI readiness assessment is, and how it differs from a maturity model or a risk assessment
The 28-question AI readiness checklist, seven areas, with what a top score looks like
The 0-1-2 scale, the four hard stops and the three outcome tiers
A copyable scorecard template and a worked example
How the score maps to ISO 42001, NIST AI RMF and the EU AI Act
A 30-day fix plan and a final go-live gate for each AI feature

What an AI Readiness Assessment Is, and What It Is Not

An AI readiness assessment is a structured check of the prerequisites for adopting AI: strategy, data, infrastructure, skills, governance and culture. That is how the consultancies and cloud vendors define it, and it is a fair definition.

For a team that sells software to businesses, the prerequisites that decide whether AI can ship are narrower and more practical. Governance, data handling, vendor terms, security, people and incident readiness. Those are the things a security reviewer asks about, so those are what this assessment scores.

A complete assessment has four parts:

A scope: which AI uses are in play, both the features you ship and the tools your staff use
A scored set of questions: each answered against evidence, not opinion
A result with tiers: so the score turns into a go or no-go decision
An action list: ordered by risk, with owners and dates

AI Readiness Maturity Levels vs an AI Readiness Assessment

Readiness is a check of prerequisites before you act. Maturity describes how far along a capability is after you have built it. The two get mixed up because both produce a score.

	Question it answers	When you use it	Output
Readiness assessment	Can we start or ship?	Before launch and after major changes	A go or no-go plus a fix list
Maturity model	How advanced are we?	Once a programme is running	A stage on a scale
Risk assessment	How bad could this one system be?	Per AI use case	A scored risk register

This guide scores readiness only. Its three tiers double as a coarse maturity ladder (ad hoc, controlled, managed), but it does not try to replace a full maturity model.

What This AI Readiness Assessment Does Not Do

Four things are out of scope, and each has a better home:

A risk assessment of one AI system: use the AI risk assessment guide for likelihood, impact and a register.
A certification gap audit: the ISO 42001 checklist covers the controls an auditor tests.
Legal advice on the EU AI Act: the EU AI Act compliance guide covers dates and obligations, and counsel decides how they apply to you.
A data-platform or ROI review: covered near the end of this guide, because it is a different assessment.

Why Run an AI Readiness Assessment Before a Customer Asks

A prospect's security reviewer reads your questionnaire answers and writes back one line: "Who approved this AI feature, and where is the record?" The honest answer is a Slack thread from March.

That is the situation an AI readiness assessment prevents. Enterprise security questionnaires now carry AI sections: which models you use, what data they see, who approves changes, and how incidents are handled. "We're working on it" stalls a deal, and so does an answer you cannot back up.

The pattern underneath is AI shipped by enthusiasm. A copilot goes into the product, a coding assistant lands on every laptop, and nobody owns it, nobody wrote a data rule, and nobody can switch it off. You find out at the worst moment.

A score helps a small team because it turns "are we okay?" into a ranked fix list. It also gives leadership a go or no-go it can defend, which is the difference between tool curiosity and operational preparedness.

Watch out Readiness is about the company, not the model. A strong model running inside a weak process still fails the questionnaire.

ISO 42001

Want the answers a customer asks for to already exist?

ISO 42001 is the management system standard for AI. See how ComplyJet keeps policies, inventory, assessments and evidence in one place.

Explore ISO 42001

AI Readiness Assessment for Startups: Who Should Run It and How Long It Takes

Yes, run one if you ship AI to customers or let staff put company data into AI tools. No external consultant is needed at this size. The consultancy engagement that runs for weeks is a different product, built for enterprises with data platforms to assess.

Different people hold different answers, so get them in the room:

Role	What they answer
Founder or CTO	Ownership, risk appetite, off-limits uses
Engineering lead	Security testing, logging, switch-off
Product	Inventory, disclosure to users
Security or compliance lead	Policy, vendors, evidence
Sales or support	What the company promises customers about the AI

A solo founder runs it alone and writes "owner: me" next to each answer.

An AI readiness assessment for startups is a short exercise. Plan on one working session of two to three hours with the evidence open (the policy, the inventory, the vendor list), plus a follow-up week for the fix list. Treat those as this guide's own guidance, not a measured figure.

A self-score runs optimistic, so use one rule to keep it honest: a 2 needs a document or a record you can open right now. If you cannot show it, score it 1.

The AI Readiness Framework: Seven Areas, 28 Questions, One Score

The seven areas of this AI readiness framework follow the order in which a company builds the capability, and each one is a question a customer or auditor tends to ask.

Area	The question it answers	Questions	Max score
1. Ownership and policy	Who decides, and what are the rules?	4	8
2. Inventory and risk tier	What AI do we have, and how risky is each piece?	4	8
3. Data	What data goes where?	4	8
4. Vendors and models	Who else touches our AI and our data?	4	8
5. Security and access	Can it be attacked, and can we reconstruct what happened?	4	8
6. People and literacy	Do people know what they are doing, and what we promise?	4	8
7. Monitoring, incidents and evidence	Do we see problems, and can we prove our answers?	4	8

Important This is ComplyJet's own illustrative model, built from what ISO 42001, NIST AI RMF and the EU AI Act ask of a company deploying AI. It is not an official method, and no standard requires these exact questions.

The seven areas of the AI readiness assessment as cards, each worth 8 points across 4 questions, with hard-stop markers on Ownership (Q1), Data (Q9 and Q10) and Monitoring (Q26), and a total of 56 points where each answer scores 0, 1 or 2.

The AI Readiness Checklist: 28 Questions to Score

Answer each question 0, 1 or 2 using the scale in the next section, and write the evidence next to each answer. Questions marked HARD STOP carry a special rule, explained after the tables.

Area 1: Ownership and Policy (Questions 1-4)

#	Question	What a 2 looks like
1	HARD STOP. Does a named person own AI decisions and have authority to approve or stop an AI feature?	A named owner in writing, with authority to say no, and a record of decisions
2	Is there a written AI use policy covering what staff may use AI for and what data may go in?	An approved, dated policy that staff have acknowledged
3	Is there an approved-tool list that staff actually know about?	A current list, linked from onboarding, with a way to request additions
4	Has leadership written down which AI uses are off-limits, such as automated decisions about people with no human review?	A short, dated list of prohibited uses that product and engineering have seen

The AI governance policy guide gives policy text you can adapt, and the AI governance framework covers the roles step.

Area 2: Inventory and Risk Tier (Questions 5-8)

#	Question	What a 2 looks like
5	Is there an inventory of every AI feature you ship and every AI tool you use, each with an owner?	One list, one owner per row, updated when something is added
6	Has each shipped AI feature been placed in an EU AI Act risk category, with the decision and reasoning recorded?	A written classification per feature, with the reasoning, signed off by the owner
7	Does each customer-facing AI feature have a documented risk assessment?	A completed assessment per feature, dated, with open risks assigned
8	Does a review gate stop a new AI feature or tool shipping or being bought until it passes?	A gate in the release or purchase process that has actually blocked or delayed something

Question 6 builds on the EU AI Act risk classification guide, and question 7 on the AI risk assessment guide.

Area 3: Data (Questions 9-12)

#	Question	What a 2 looks like
9	HARD STOP. Do you know which data classes (customer data, personal data, credentials, source code) may go to which AI tools and models?	A table of data classes against approved tools, known to the people using them
10	HARD STOP. Can you show that customer data is not used to train third-party models without a contractual basis?	Contract terms or account settings on file for each vendor that touches customer data
11	Is personal data processed through AI covered by a lawful basis, your privacy notice, your data processing agreements and your subprocessor list?	Each of the four updated to name the AI processing
12	Are retention and deletion defined for prompts, outputs, logs and embeddings?	Written retention periods, with deletion that has been tested

Area 4: Vendors and Models (Questions 13-16)

#	Question	What a 2 looks like
13	Has every AI vendor passed a due diligence step covering data use, retention and subprocessors?	A completed review per vendor, kept with the contract
14	Do contracts with model providers cover training on your data, confidentiality and incident notice?	Signed terms covering all three, checked by someone who can say what they mean
15	Do you know which model and version each feature uses, and will you be told when it changes?	Model and version recorded per feature, with a change-notice commitment or a check you run yourself
16	Is there a fallback if a model provider has an outage or changes behaviour?	A documented fallback that has been tried at least once

The AI vendor risk management guide has the full questionnaire for Questions 13 to 16.

Area 5: Security and Access (Questions 17-20)

#	Question	What a 2 looks like
17	Were AI-specific attacks (prompt injection, data leakage through tools, jailbreaks) tested before launch?	A test record with findings and fixes, repeated after major changes
18	Do AI agents and integrations run with least privilege, with human approval for actions that cannot be undone?	Scoped credentials per agent, and an approval step on destructive actions
19	Is access to AI tools tied to single sign-on and offboarding?	AI tools are in the SSO and leaver checklist, with a recent check
20	Are inputs, outputs and tool calls logged well enough to reconstruct an incident?	Logs retained, searchable, and used in at least one test or real review

SOC 2 and ISO 27001 controls cover part of this ground but do not test AI behaviour. The does SOC 2 cover AI and ISO 27001 and AI compliance guides show where the line sits.

Area 6: People and Literacy (Questions 21-24)

#	Question	What a 2 looks like
21	Have staff who build or use AI had training, and is there a record?	A training record by person and date, matched to their role
22	Do humans review AI output where a wrong answer causes harm, and do reviewers know what to check?	A named review step with a short checklist for the reviewer
23	Is customer-facing AI disclosed as AI where the law or customer expectation requires it?	Disclosure in the product or contract, checked against Article 50 and customer terms
24	Do sales and support have an approved, accurate description of what the AI features do and do not do?	One approved description, used in sales material and support macros

Area 7: Monitoring, Incidents and Evidence (Questions 25-28)

#	Question	What a 2 looks like
25	Does someone review live AI output quality and safety on a schedule?	A recurring review with a named reviewer and notes from the last one
26	HARD STOP. Can a named person switch off each AI feature quickly, and has it been tested?	A feature flag or kill switch with a named decision-maker, tested in the last six months
27	Does the incident process cover AI failures (wrong output, data exposure) with severity levels and customer notice windows?	AI scenarios written into the incident plan, with severity levels and who notifies customers
28	Is evidence for all of the above kept in one place and retrievable within days?	One folder or system, indexed by question number, tested by pulling three items on request

Your AI Readiness Score: The 0-1-2 Scale and the Four Hard Stops

To score AI readiness, give each question a 0, 1 or 2, add the 28 answers, then check the hard stops and the weak areas. The maximum is 56, and each area tops out at 8.

Score	What it means	The evidence test
0	Not in place	Nothing exists, or nobody can describe it
1	Partly in place	It exists but is informal, undocumented, untested or held in one person's head
2	In place	Documented, owned, and used or tested in the last six months, with a record you can open in the room

The rule from earlier carries the weight here: a 2 needs a record you can open. Sales teams learn the same lesson in questionnaires.

ComplyJet's short video on security questionnaires makes the point from the sales side: the answer that loses deals at that stage is not "I don't know," it is "yes." Watch it before you score, then hold your own answers to the same test.

A confident 2 with nothing behind it is the same unsupported yes, just scored on yourself. If you cannot open the record, write a 1 and move on.

The Four Hard Stops: Q1, Q9, Q10 and Q26

A 0 on any of Q1, Q9, Q10 or Q26 blocks a customer-facing launch, whatever the total says. They are the gaps that turn a mistake into an incident with no owner, no data rule or no way out:

Q1: nobody has authority to approve or stop an AI feature
Q9: nobody knows what data may go to which tool
Q10: you cannot show customer data stays out of third-party training
Q26: you cannot switch the feature off

A 1 on a hard stop is a warning, not a block.

Calculating Your AI Readiness Score

Three numbers summarise the result:

Total: the sum of all 28 answers, out of 56
Hard-stop zeros: how many of Q1, Q9, Q10 and Q26 scored 0
Weak areas: any area at 3 or below out of 8

Fix any area at 3 or below first, even when the total looks healthy.

What Your AI Readiness Score Means: Three Tiers and What to Do Next

Tier	Score	Hard stops	What it means	Next step
1. Not ready	0 to 19, or any hard-stop zero	Any 0	Do not ship to customers	Fix the hard stops, then re-score
2. Ready for a controlled pilot	20 to 37	No zeros	A pilot is reasonable	Limited users, no sensitive data, a named owner, the review gate switched on
3. Ready to deploy with a gate	38 to 56	No zeros	You can ship	Ship, with scheduled monitoring and re-scoring on triggers

These bands are a judgment aid, not a statistical result. A 40 with a zero on Q26 is still Tier 1 for launch, because the total cannot buy back a missing off switch.

Three tiers of AI readiness as ascending steps: Tier 1 not ready at 0 to 19, Tier 2 controlled pilot at 20 to 37, and Tier 3 deploy with a gate at 38 to 56, with a note that any hard-stop zero puts you in Tier 1.

The tiers also work as coarse AI readiness maturity levels: ad hoc, controlled, managed. That is enough to track progress from one scoring round to the next without turning the exercise into a full maturity model.

AI Readiness Assessment Template: A Scorecard You Can Copy

Use this AI readiness assessment template as a spreadsheet: copy the table below, one row per question, and add a summary block above it with the total, hard-stop zeros, areas at 3 or below, the date and the assessor.

#	Question	Score (0/1/2)	Evidence link	Owner	Fix by
1	Named owner with authority to approve or stop AI features	2	AI policy, section 2	Founder	n/a
9	Data classes mapped to approved AI tools	1	Draft table in the wiki	Eng lead	Week 2
26	Named person can switch off each AI feature, tested	0	None	Eng lead	Week 1

Free Template

Download the AI Readiness Scorecard (PDF)

All 28 questions with the 0-1-2 scale, hard-stop markers, evidence and owner columns, a summary block and the three tiers. A self-check, not legal advice.

Download PDF

Re-score at least once a year, and again after a trigger: a new AI feature, a new model provider, a new customer segment, an incident, or a change in law. No regulation sets this cadence, so it is a sensible default rather than a requirement.

AI Readiness Assessment Example: How a 22-Person SaaS Company Scored

Here is how a scored AI readiness assessment reads in practice. Northwind is a fictional 22-person SaaS company, used as an illustration only. It ships a support copilot to customers and lets its engineers use an AI coding assistant.

Area	Score	Max
1. Ownership and policy	6	8
2. Inventory and risk tier	4	8
3. Data	5	8
4. Vendors and models	4	8
5. Security and access	5	8
6. People and literacy	3	8
7. Monitoring, incidents and evidence	3	8
Total	30	56

Bar chart of the illustrative Northwind scores out of 8 for each of the seven areas, with People and Monitoring highlighted at 3, a total of 30 out of 56 placing it in Tier 2 by score, and a zero on Q26 pushing it to Tier 1.

By score alone, 30 is Tier 2. But Q26 scored 0: turning the copilot off needs an engineering deploy, and nobody owns the decision to do it. That puts Northwind at Tier 1 for the wider customer launch until Q26 is fixed.

What the example shows The total hid the one problem that mattered. A reviewer asking "how do you stop it if it goes wrong?" would have found it in one question.

The two lowest areas, People and literacy and Monitoring, incidents and evidence, become the fix list. Northwind's five actions, in order, with illustrative owners and dates:

#	Action	Question	Owner	By
1	Add a feature flag for the copilot and name who may use it	Q26	CTO	Week 1
2	Record the EU AI Act risk decision for the copilot	Q6	Product lead	Week 2
3	Start AI literacy training with a record	Q21	Head of people	Week 3
4	Define a weekly output review	Q25	Support lead	Week 3
5	Write the data-class table for AI tools	Q9	Security lead	Week 4

Customer Story

"ComplyJet has become an indispensable part of our compliance workflow."

Raghuram Vadapally, Managing Director & Head of Software Engineering, Synexar AI. Hospital buyers required SOC 2 and HIPAA assurance before Synexar's AI product could be sold.

Read the Synexar AI story

AI Compliance Readiness: How the Score Maps to ISO 42001, NIST AI RMF and the EU AI Act

No law or standard requires a standalone AI readiness assessment. The seven areas line up with what three frameworks ask a company deploying AI to have, which is why a good score makes any of them easier.

That is the practical meaning of AI compliance readiness: not a certificate, but the ownership, records and controls a framework would ask you to show.

Area	ISO 42001 (Annex A objectives, by title)	NIST AI RMF function	EU AI Act touchpoint
1. Ownership and policy	A.2 Policies related to AI; A.3 Internal organization	GOVERN	Article 5 prohibited practices shape the off-limits list
2. Inventory and risk tier	A.5 Assessing impacts of AI systems; A.6 AI system life cycle	MAP	Risk classification of each system
3. Data	A.7 Data for AI systems	GOVERN, MAP	Data governance duties for high-risk systems
4. Vendors and models	A.10 Third-party and customer relationships	GOVERN	Provider and deployer roles; general-purpose AI duties sit with model providers
5. Security and access	A.6 AI system life cycle; A.9 Use of AI systems	MEASURE, MANAGE	Accuracy, robustness and cybersecurity duties for high-risk systems
6. People and literacy	The management system's competence and awareness requirements; A.8 Information for interested parties	GOVERN	Article 4 AI literacy; Article 50 transparency
7. Monitoring, incidents and evidence	The management system's performance evaluation and improvement requirements	MEASURE, MANAGE	Post-market monitoring (Article 72) and serious incident reporting (Article 73) for high-risk systems

The function-level pairings with NIST are our reading, not an official crosswalk. NIST AI RMF 1.0 (January 2023) is voluntary, and GOVERN applies across all stages while MAP, MEASURE and MANAGE apply to specific systems and lifecycle stages. Our NIST AI risk management framework guide explains each function.

EU AI Act Status in October 2026

The dates matter because they decide which questions carry legal weight today, and the Digital Omnibus on AI (Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026) moved some of them.

Date	What applies
Since 2 February 2025	Prohibited practices and the AI literacy duty. Under the Omnibus, Article 4 now requires providers and deployers to take measures to support staff AI literacy, without guaranteeing any specific level
Since 2 August 2025	Rules for general-purpose AI models
Since 2 August 2026	Article 50 transparency rules; enforcement starts for prohibitions, general-purpose AI, transparency and AI literacy
2 December 2026	New prohibitions on non-consensual sexual deepfakes and child sexual abuse material; transition deadline for synthetic-content providers already on the market before 2 August 2026
2 December 2027	High-risk rules for Annex III systems
2 August 2028	High-risk rules for AI embedded in products covered by Annex I

Source: the European Commission's AI Act Service Desk timeline. The EU AI Act compliance guide walks through who each date applies to.

AI Governance Readiness: What a Strong Score in Areas 1 and 2 Gives You

AI governance readiness starts with Areas 1 and 2, and a high score there is the foundation an ISO 42001 programme builds on. ISO/IEC 42001:2023 is the first international standard for an AI management system, and it asks for exactly this: ownership, policy, an inventory and an impact check. This is readiness for building, not an audit.

If you want to go further, read what is ISO 42001 and the ISO 42001 checklist. For certification stages and cost, see ISO 42001 certification cost.

Watch out A good score is not compliance with the EU AI Act and does not replace legal advice for high-risk systems.

What an AI Readiness Assessment Does Not Score: Data Platforms, Infrastructure and ROI

Most pages that rank for this term score data quality, cloud infrastructure, talent pipelines, change management and ROI. Those matter if you are building or scaling AI systems, and they belong to a different assessment.

If that is what you need, run it in addition to this one, and treat it as a business-case question:

Data quality and pipelines: is the data clean and accessible enough for the model to work
Infrastructure: can your stack run and scale the workload
Talent and change management: do you have the skills and the appetite
ROI: does the use case pay for itself

This guide leaves them out because they decide whether AI will work, not whether it is safe to put in front of a customer. A startup with a great data platform and no off switch is still not ready.

Responsible AI Readiness: Your First 30 Days After Scoring

Responsible AI readiness comes from fixing gaps in a sensible order. Use this priority rule: hard stops first, then areas at 3 or below, then the cheapest 1s that become 2s.

Week	Focus	Outputs	Questions moved
1	Hard stops and owner	Named owner, switch-off tested, data rule drafted	Q1, Q26, Q9, Q10
2	Inventory and tools	AI inventory, data-class table, approved-tool list	Q5, Q9, Q3
3	Vendors, gate and tiers	Vendor terms checked, review gate live, risk tier decisions recorded	Q13, Q14, Q8, Q6
4	People and evidence	Training record, switch-off retest, evidence folder, re-score	Q21, Q26, Q28

Use the AI governance framework as the build guide for each step, the AI governance policy guide for the policy text, the AI vendor risk management guide for Questions 13 to 16, and the AI risk assessment guide for Question 7.

AI Deployment Readiness Checklist: The Final Gate Before You Ship

The 28 questions assess the company. This AI deployment readiness checklist gates one feature on the day you ship it, with eight yes or no items:

An owner is named for this feature
Its risk tier is recorded
A risk assessment is done
The data classes it touches are approved
Vendor terms have been checked
Security testing for AI attacks is complete
Human review and disclosure are in place
The switch-off is tested and the incident route is named

Any "no" means not today.

This gate sits alongside the pre-launch checklist inside the AI risk assessment guide. Use the two together: that one scores the risk of the system, this one confirms the company around it is ready.

Mistakes That Make an AI Readiness Assessment Misleading

A score only helps if it is honest. These are the ways it goes wrong:

Scoring a 2 without a record: if you cannot open the evidence, it is a 1
Letting the builder mark their own work: the person who shipped the feature is the least objective reviewer of it
Averaging away a hard-stop zero: a total of 44 with a zero on Q26 is not a 44
Scoring only the AI you ship: staff use of AI tools carries the same data risk
Treating a high score as compliance: it is a readiness signal, not a certificate or a legal opinion
Running it once: a new model, vendor or customer segment changes the answers
Producing a report nobody owns: every low score needs an owner and a date, or the exercise was theatre

FAQs

What Is an AI Readiness Assessment?

It is a structured check of whether an organization has what it needs to adopt or scale AI. Many versions score data, infrastructure, skills and strategy. The one in this guide scores whether a startup can deploy AI responsibly: ownership, data rules, vendors, security, people and incident response.

How Do You Assess AI Readiness?

Work through four steps:

List your AI uses: the features you ship and the tools staff use
Answer the 28 questions: with the evidence open, scoring each 0, 1 or 2
Add them up: then check the four hard-stop questions and any area at 3 or below
Read the tier: it places you in one of three tiers and gives you a fix list

What Should an AI Readiness Assessment Include?

It needs four parts, plus the evidence behind each answer:

A scope: the AI uses in play
Scored questions: for a SaaS startup, covering ownership, inventory, data, vendors, security, people and monitoring
A result with tiers: so the score becomes a go or no-go
An action list: ordered by risk, with owners and dates

How Do You Score AI Readiness?

Give each question a 0 (not in place), 1 (partly in place) or 2 (documented, owned and tested in the last six months, with a record you can open). The maximum is 56. A 0 on any hard-stop question blocks a customer-facing launch whatever the total says.

What Is the Difference Between AI Readiness and AI Maturity?

Readiness checks whether the prerequisites exist before you start or ship. Maturity describes how advanced a capability is once it is running. Readiness gives a go or no-go, while maturity gives a stage on a scale.

Does a Startup Need an AI Readiness Assessment?

If you ship AI features to customers or let staff put company data into AI tools, yes. It is the fastest way to see what a security reviewer will find, and it does not need an outside consultant. If you do none of those things yet, bookmark it for the first time you do.

How Long Does an AI Readiness Assessment Take?

Plan on a two to three hour working session with the evidence open, plus a week for the follow-up fix list. These are this guide's own estimates rather than a measured figure. Larger companies with many AI systems will take longer.

Quick take One working session to score, one week to build the fix list. Treat both as this guide's own estimates, not a measured figure.

Who Should Run an AI Readiness Assessment?

A security or compliance lead usually runs it, with the founder or CTO, an engineering lead and a product owner in the room. A solo founder can run it alone. Avoid letting the person who built a feature score it by themselves.

Is an AI Readiness Assessment Required by the EU AI Act or ISO 42001?

No. Neither requires an assessment by that name. The areas line up with what both ask for, including ownership, risk classification, data handling, literacy and monitoring, so a good score makes either easier. A good score is not compliance with either.

How Often Should You Repeat an AI Readiness Assessment?

At least once a year, and after any trigger: a new AI feature, a new model provider, a new customer segment, an incident or a change in law. No regulation sets this cadence, so treat it as a sensible default.

Book a demo

See where your score would land

Talk through which gaps would block a launch, and how to keep the evidence behind each answer organised for a team your size.