SME AI Readiness Checklist: 20 Checks

How to use this AI readiness checklist

This checklist is 20 yes-or-no questions across four areas: data, process, people, and security. Score one point for each honest yes. It takes about ten minutes, and the honesty matters more than the speed, because the whole point is to find the gaps before an AI tool finds them for you at machine speed.

Why these four areas? Because they are where AI projects actually fail in small and medium businesses. Almost no SME AI project dies because the technology was not good enough. They die because the data underneath was wrong, the process being automated was never stable to begin with, the staff never trusted or adopted the tool, or someone connected an AI assistant to information it should never have been able to see. Each of those is checkable in advance. That is what the next three sections do.

A few rules for scoring yourself:

• Answer for the business as it runs today, not as it will run after the cleanup you have been meaning to do.
• If you have to say "mostly" or "sort of", the answer is no. Partial credit is how businesses talk themselves into failed projects.
• If you do not know the answer, that is also a no, and it is worth noticing which questions you cannot answer. Not knowing is itself a readiness finding.

One more framing point. A low score is not a verdict on your business. Most well-run SMEs score under 12 the first time, because nothing about running a good business automatically produces AI-ready data and documentation. The score just tells you the order of work: what to fix before you spend real money on tools. If you have already been eyeing a specific product, read Don't buy that AI tool yet alongside this. The two make the same argument from different directions.

Data readiness: six checks

Data is where most SMEs lose the most points, and it is the section that most decides whether AI gives you answers you can trust. AI treats your records as fact. Six checks:

1. One number, one answer. If two people pulled your active customer count from your systems today, would they get the same figure? If reports get challenged when they land, the answer is no.
2. Duplicates are under control. Sort your contacts by email or company name. If more than roughly one in twenty records is a duplicate, every AI count and summary inherits the error.
3. Key fields are actually filled in. Pick the five fields an AI tool would need, such as industry, status, owner, and last contact date. Are they complete on at least 80 percent of records?
4. Each data type has one named master. You can say, without debating it, which system is the authoritative home for customers, jobs, and products. If that question starts an argument, see the single source of truth guide.
5. Critical data lives in systems, not spreadsheets. The information the business runs on sits in databases with defined fields, not in workbooks only one or two people understand.
6. The data is current. Records reflect this quarter's reality. If a big share of your contacts have not been touched in 18 months, AI will reason from history and present it as now.

Score yourself out of six. If you scored three or less here, stop reading vendor websites and start with data work. The five warning signs in 5 signs your data is not ready for AI map directly onto these checks and cover the fixes for each.

Process and people readiness: nine checks

Process and people are the checks vendors never mention, because they are your problem rather than the software's. They decide whether an AI tool gets adopted or quietly abandoned within a month.

Process, five checks:

1. The target process is written down. Somewhere other than in someone's head, at a level a new hire could follow. If the knowledge only exists in people, start with a knowledge base your AI can use.
2. The process is stable. It ran roughly the same way for the last six months. Automating a process you are still changing means paying to rebuild.
3. The exceptions are known. You can list the cases where the process goes off-script and what happens then. Every unlisted exception becomes a surprise during the build.
4. The process runs often enough to matter. Daily or weekly, not quarterly. Rare tasks rarely repay an AI or automation build.
5. You know what it costs today. Roughly how many hours a week the process consumes. Without this number you cannot know whether any tool paid for itself.

People, four checks:

1. One named owner. A specific person is accountable for the tool working after go-live. Not a committee, and preferably not you.
2. The team knows the purpose. Staff can say what the tool is for and what it is not for. Tools introduced as vague "efficiency" land as vague threat.
3. Someone will check the outputs. For the first months, a person reviews what the AI produces before it reaches customers. AI that is almost right needs catching.
4. There is time budgeted to learn. Real hours in real calendars, not "the team will pick it up". Adoption is a cost. Unbudgeted, it silently becomes non-adoption.

Security and access readiness: five checks

Security is the shortest section and the least forgiving, because an AI assistant connected to your systems reads at machine speed and does not know what it should not repeat. Five checks:

1. Access is role-based. People see and edit only what their job needs. If everyone can see everything today, an AI assistant will surface everything to everyone, including salaries, margins, and disputes, faster than any browsing employee could.
2. Changes are logged. Your key systems record who changed what and when. Without change history, you cannot trace how an error got in, and you cannot show a future buyer or auditor that your data is controlled.
3. Offboarding actually happens. When someone leaves, their access is removed within days, and no automations or integrations run under a departed person's personal login. Orphaned accounts are the most common gap we find.
4. Sensitive data is separated. HR records, payroll, and genuinely confidential material live in separately permissioned stores that a general AI assistant cannot reach. Access control is not solved by the AI layer; it has to exist underneath it.
5. You know where vendor tools send your data. For each AI tool you are considering, you can answer where your data is processed, whether it is used for training, and how you would get it out. If the vendor cannot answer plainly, that is your answer.

Score out of five. Anything under four here is worth fixing before connecting any AI tool to live systems, regardless of your other scores, because the failure mode is not a wasted budget. It is a staff member reading the payroll, or customer data in a training set. Those are the mistakes you cannot undo by cancelling a subscription.

Scoring: what your result actually means

Add up your points out of 20 and read the band honestly.

• 16 to 20: ready to proceed. Your foundations can support a real AI project. The remaining risk is choosing the wrong process to start with, so pick something frequent, stable, and measurable, and run the numbers on it before you build.
• 10 to 15: close, with specific gaps. This is the most common band for well-run SMEs. The right move is to fix your lowest-scoring section first, not to buy a tool and hope the gaps do not matter. They will matter, and they are cheaper to fix before a build than during one. A focused Data Readiness Sprint, 2 to 6 weeks from $6,000 plus GST, typically moves a business from this band into the top one.
• Under 10: stop, in the kindest possible way. Any AI tool you buy now will sit on foundations that cannot support it. The money is not wasted because AI is wrong for you. It is wasted because it is out of order. Data first, process second, then AI. The good news is that the fixes are known, sequenced work, not mysteries.

Two honest caveats. First, a checklist is a screening tool, not a diagnosis. It tells you where to look, not exactly what is wrong or what fixing it costs. Second, self-assessment flatters. Owners score their own business higher than an outsider does, because the workarounds have become invisible.

That is what the Business Readiness Audit is for: $1,990 inc GST, fixed scope, about two weeks, with written findings and a scorecard built from observation rather than memory, fully credited toward any engagement within 90 days. Run the checklist first. If your score surprises you in either direction, the audit will tell you which number to believe.

FAQ

Questions owners ask