AI Readiness Assessment: How to Score Your Organisation and What to Fix First

The AI Implementation Readiness Assessment is a free, 26-question self-assessment that scores how ready your organisation is to run AI in production. It covers six dimensions: strategy, data, talent, use cases, culture, and governance. It returns an overall maturity tier, a score per dimension, and one concrete next move for each. It runs entirely in your browser and takes about ten minutes.

This guide explains exactly how the scoring works, walks through a sample run, and covers what to do at each tier. It also covers what a self-assessment like this cannot tell you, which matters as much as the score.

Why AI projects stall before they pay off

Most AI projects do not fail because the model is bad. They fail because the organisation around the model was not ready for it. The best evidence for this comes from people who build these systems for a living.

In 2024, RAND interviewed 65 experienced data scientists and engineers for its report The Root Causes of Failure for Artificial Intelligence Projects. The report cites estimates that more than 80 percent of AI projects fail, about twice the rate of IT projects without AI. Its interviews named five root causes:

• Stakeholders misunderstand or miscommunicate the problem AI is meant to solve.
• The organisation lacks the data needed to train an effective model.
• The team chases the latest technology instead of a real user problem.
• The infrastructure to manage data and deploy models is not there.
• The problem is simply too hard for AI to solve.

Four of those five are readiness problems, not model problems. Strategy, data, and infrastructure show up directly. The fifth, problem difficulty, is a use-case selection problem.

Governance is the other half. The NIST AI Risk Management Framework (AI RMF 1.0, released January 2023 for voluntary use) organises AI risk work into four functions: Govern, Map, Measure, and Manage. NIST describes Govern as a cross-cutting function infused throughout the other three. The same document puts skills inside governance: its GOVERN 2.2 outcome asks that personnel and partners receive AI risk management training. Executive accountability sits there too, in GOVERN 2.3.

Generative AI widened the risk surface further. NIST's Generative AI Profile (NIST AI 600-1), published July 2024, defines twelve risks unique to or exacerbated by generative AI. They include confabulation, data privacy, and information security. On the security side, the OWASP Top 10 for LLM Applications ranks prompt injection first and sensitive information disclosure second. The list also covers supply chain risk and excessive agency.

My view, from 15 years building identity and security products: the readiness gap I see most often is not a lack of ambition. It is a pilot that worked in a sandbox meeting production data, production users, and a security review for the first time, all at once. The assessment is built to surface that gap before the pilot does.

What the assessment asks

Every question is a statement about your current operating state. Each one has four answers, scored 1 to 4, and each answer describes observable behaviour rather than an attitude. "AI use cases in production today" runs from "Zero" to "Dozens of production AI workloads spanning multiple business functions." That design makes it harder to answer aspirationally.

How it scores

The scoring is deliberately simple, and knowing it helps you read the result correctly.

• Dimension score: the average of that dimension's answers, from 1.0 to 4.0.
• Overall score: the average of all 26 answers. It is not an average of the six dimension scores. Strategy and data have five questions each, so they carry slightly more weight (about 19 percent each, against about 15 percent for the other four).
• Tier: Exploring below 1.8, Foundational from 1.8, Operational from 2.5, and Transformational from 3.3. The same thresholds apply to each dimension.
• Strengths and gaps: the two highest-scoring dimensions are listed as "What's working" and the two lowest as "Where to invest next."
• Next move: each dimension gets one recommendation chosen by its own tier, so a weak dimension gets advice for its level, not yours.

Results only appear once all 26 questions are answered. Answers are saved to your browser's local storage, so a refresh does not lose progress. Nothing is sent to a server.

A walkthrough with sample answers

To show how the output reads, I answered as a hypothetical mid-sized company. It has a named AI sponsor, a draft strategy, a couple of pilots, enthusiastic staff, and very little governance. These answers are illustrative, not drawn from any real organisation.

Step 1: Answer the strategy questions honestly. Open the assessment and start with Strategy & Leadership. Pick the option that describes today, not the plan for next quarter.

Step 2: Work through data, talent, use cases, and culture. The sample answers mostly sit at 2: some clean data, a few engineers with side projects, one or two pilots. Culture scores higher, with broad adoption of sanctioned tools.

Step 3: Do not flatter yourself on governance. This is where honest answers matter most. The sample company has draft principles that are not enforced, no bias review, and no model monitoring beyond uptime.

Step 4: Submit and read the overall tier. The sample lands at 2.0 out of 4.0, which is Foundational.

Step 5: Read the breakdown, not just the headline. This is the part that earns its keep. The overall tier says Foundational. The breakdown says governance is at 1.5, which is Exploring, and data sits exactly on the 1.8 threshold.

That gap is the real finding. Culture is ahead of governance, which means people are adopting AI faster than the organisation can manage its risk. That is the pattern I wrote about in the AI security hole most CISOs never test for. Enthusiasm without controls is how shadow AI starts.

What to do at each readiness level

The tool gives one next move per dimension. Here is how I would think about the overall tier.

Exploring (below 1.8)

Do not buy a platform yet. Pick one problem with a clear owner, a measurable outcome, and low regulatory exposure. RAND's first root cause, a misunderstood problem, is the one to beat here. Write down what success looks like before anyone picks a model. In parallel, draft a short acceptable-use policy for generative AI tools, because staff are already using them.

Foundational (1.8 to under 2.5)

This is the stage where pilots go to die. Your job is to build the path from pilot to production: data access, deployment, monitoring, and a security review that happens at intake rather than the week before launch. Add a kill criterion so stalled projects end on purpose. I covered the warning signs in why most AI projects fail.

Operational (2.5 to under 3.3)

You ship AI. Now the risk is scaling faster than your controls. Map your governance to a recognised framework. The NIST AI RMF is free and voluntary. ISO/IEC 42001 is certifiable, though what ISO 42001 actually certifies is narrower than many buyers assume. Automate evaluation, drift detection, and access reviews for any agent that can act on your systems.

Transformational (3.3 and above)

The risk now is erosion. Governance that worked at ten use cases bends at a hundred. Run red-team exercises against your own AI systems, track regulatory obligations such as the EU AI Act duties that apply even when you only call an API, and prune AI features that no one uses.

What a self-assessment cannot tell you

A score is only as honest as the answers. Use it as a conversation starter, not an audit. Its specific limits:

• It measures perception. One person's answers reflect one person's view. Have three people from different functions take it separately and compare. The disagreements are often more useful than the score.
• The average hides weak spots. As the sample shows, a Foundational overall can contain an Exploring governance score. Always read the breakdown.
• The thresholds are judgment calls. They are not calibrated against a benchmark dataset of organisations, so the tool cannot tell you how you compare with peers.
• It is written for enterprises. Questions about multi-million budgets and teams of 5 to 20 engineers will under-score a capable 30-person startup. Read the descriptors, not just the number.
• Security has no dedicated dimension. Privacy, monitoring, and incident response sit inside governance. It does not test prompt injection, agent permissions, or data leakage. Use the OWASP LLM Top 10 for that.
• It is not compliance evidence. A Transformational score does not show conformance with the EU AI Act, ISO/IEC 42001, or the NIST AI RMF.

Retake it every quarter. Answers persist in the same browser, so you can update only what changed and see whether the weakest dimension moved.

FAQ

How long does the AI readiness assessment take?

About ten minutes for 26 questions. Progress is saved in your browser, so you can stop and come back.

Is my data collected?

No. Answers are stored in your browser's local storage and the score is computed on your device. Nothing is sent to a server.

Why is my overall tier higher than some of my dimension tiers?

The overall score is the average of all 26 answers. Strong dimensions pull a weak one up. Check the category breakdown and treat the lowest dimension as your real constraint.

Is this based on the NIST AI Risk Management Framework?

Not directly. The six dimensions follow common enterprise AI maturity models. The governance questions overlap with themes in the NIST AI RMF, such as accountability, fairness, privacy, and monitoring, but the tool does not map answers to NIST outcomes.

Who should take it?

Anyone who owns or funds AI work: a CTO, a CISO, a head of data, or a business sponsor. It works best when several of them take it separately and compare answers.

Ready to score your organisation? Take the AI Implementation Readiness Assessment, then start with the lowest bar in your breakdown.