AI Readiness Assessment for Small Business: What It Covers and How to Start Yourself

Most small businesses approach AI backwards. They pick a tool first, then try to figure out where it fits. An AI readiness assessment flips that order. It looks at your business first and tells you whether you are set up to adopt AI safely, where it would actually pay off, and what has to be fixed before you spend a dollar on software.

I run these for small businesses, and I also think most owners can do a useful first pass themselves. So this post does both. It explains what a real assessment covers, and it gives you the DIY version you can run this week without hiring anyone.

What is an AI readiness assessment?

An AI readiness assessment is a structured evaluation of whether your business has the data, processes, security, and skills in place to adopt AI successfully. It produces three things: a picture of where you are today, a list of the highest-value places AI could help, and the gaps you need to close first.

It is not a sales pitch dressed as a diagnosis. A good assessment can conclude that you are not ready, or that the tool you were about to buy is the wrong one. That is the point. It is cheaper to find out where the problems are before deployment than after.

The assessment answers a simple question in a disciplined way: if we turned on AI in your business tomorrow, what would break, what would help, and what would leak.

What does an AI readiness assessment cover?

A real assessment looks at five areas. You can score yourself on each one.

1. Data readiness

AI is only as useful as the data it can reach. This area asks: where does your business information live, how organized is it, and how clean is it. If your documents are scattered across three cloud drives, a shared inbox, and someone’s desktop, an AI assistant has nothing reliable to work from.

You do not need a data warehouse. You need to know what you have, where it is, and whether it is current. A contractor with a tidy folder of past quotes is more AI-ready than an enterprise with a messy data lake.

2. Process readiness

AI pays off when it plugs into a repeatable task. Assessment question: which tasks in your business happen the same way every time. Quoting, invoicing, appointment scheduling, drafting standard client emails, summarizing documents. These are the tasks AI handles well. One-off judgment calls are not.

If you cannot describe a task as a series of steps, AI cannot help with it yet. Mapping your repeatable processes is half the value of the assessment on its own.

3. Security and compliance readiness

This is the area small businesses skip and later regret. Before you connect AI to your business data, you have to know what data you hold, how sensitive it is, and what rules apply. A medical practice has HIPAA obligations. A financial advisor has SEC and FINRA considerations. A law firm has privilege. Even a landscaping company holds customer payment details and personal information.

The assessment checks whether sensitive data would end up in a tool that is not authorized to hold it, and whether your team is already leaking data through unapproved tools. That second part is shadow AI, and it is more common than most owners think.

4. People and skills readiness

Tools do not adopt themselves. This area looks at whether your team will actually use AI, whether anyone is afraid of it, and whether there is a plan to train people. It also checks for the opposite problem: employees already using AI with no rules, no guidance, and no idea what is safe to type in.

Since 2025, the EU AI Act has required AI literacy for staff at companies deploying AI, and while that is a European rule, the underlying logic applies everywhere. Untrained users are your biggest risk and your biggest bottleneck.

5. Governance readiness

Governance sounds like a big-company word, but for a small business it just means: are there rules, and does someone own them. Who decides which tools are approved. Who people ask when they are unsure. What happens when someone makes a mistake. An AI acceptable use policy is usually the first governance artifact a small business needs, and most do not have one.

How to run a DIY AI readiness assessment this week

You can get most of the value of a first-pass assessment on your own. Here is the version I would tell any owner to run before they spend money.

Step 1: List your repeatable tasks. Sit down with your team and write out every task that happens more than once a week the same way. Quoting, invoicing, scheduling, standard emails, report generation, research. This list is your AI opportunity map. Rank each one by how many hours it eats per week.

Step 2: Follow the data. For your top three tasks, ask: what information does this task use, and where does it live. If the answer is “it is all in different places and half of it is in someone’s head,” you have found a readiness gap that matters more than any tool choice.

Step 3: Find your shadow AI. Ask your team, without blame, which AI tools they already use and what they put into them. Free ChatGPT, Gemini, note-takers on their phones. You are not trying to catch anyone. You are trying to see your real exposure. If people are pasting client data into free tools, that is your most urgent finding. A structured version of this is a shadow AI audit.

Step 4: Classify your sensitive data. Write down the categories of sensitive information you hold: client PII, payment details, health data, financial records, privileged documents. Note which regulations apply. This tells you which tasks can safely use general tools and which need a secure, private deployment.

Step 5: Score each of the five areas from 1 to 5. Data, process, security, people, governance. Your lowest scores are where you start, not where AI goes. If security scores a 2, fixing that comes before deploying anything.

At the end of this exercise you will have what most consultants charge for the first phase of an engagement: a ranked opportunity list, a data map, a shadow AI picture, and a prioritized set of gaps. That is real progress you can make in an afternoon.

What an assessment does that DIY cannot

The DIY version gets you a long way. Where it falls short is depth and objectivity.

A professional assessment brings a security lens that most owners do not have. As a CISSP-certified security engineer, I look at data flows the way an attacker or an auditor would, not the way a hopeful buyer does. I have also seen what breaks across many businesses, so I recognize patterns an owner seeing their own business for the first time will miss.

The other thing outside assessment provides is honesty about your own blind spots. It is hard to audit your own shadow AI when the person pasting client data into ChatGPT is you. An outside review does not have that problem.

If your DIY pass turns up serious security gaps, or your business handles regulated data, that is the signal to bring in help rather than push forward alone.

How much does an AI readiness assessment cost?

Industry pricing for AI strategy and assessment work runs from $5,000 to $25,000 depending on business size and complexity. For a small business, the assessment is often bundled into a larger engagement rather than sold standalone. My own pricing and engagement details break down where an assessment fits.

The honest answer for most 5 to 50 person businesses: run the DIY version first. If it surfaces a clear opportunity and no serious risk, you may be ready to move to a specific tool. If it surfaces security gaps or regulated data, a paid assessment pays for itself by preventing an expensive mistake.

Frequently asked questions

What is the difference between an AI readiness assessment and an AI audit?

A readiness assessment looks forward: are you set up to adopt AI. An AI audit usually looks at what is already happening, especially unauthorized tool use (shadow AI). Many engagements include both, because you cannot plan the future without seeing the present.

How long does an AI readiness assessment take?

A DIY first pass takes an afternoon to a few days. A professional assessment for a small business typically takes one to two weeks, including interviews, a data review, and a shadow AI check.

Do I need an AI readiness assessment if I only want one tool?

If the tool touches sensitive data, yes, at least the DIY version. If you are adding a general writing assistant with no access to client data, a light review is enough. The risk scales with the sensitivity of the data the tool can reach.

Who should run an AI readiness assessment?

For low-risk use, the business owner and team can run the DIY version. For regulated data (healthcare, finance, legal) or any deployment connecting AI to client records, use someone with security and compliance credentials, not just a developer.

Where to start

Run the five-step DIY assessment this week. It costs you an afternoon and gives you a ranked list of where AI would actually help and what to fix first. If it surfaces sensitive data or shows your team is already leaking information through unapproved tools, that is the point to get a second set of eyes.

If you want that second set of eyes, my secure AI service starts with exactly this kind of assessment, run through a security lens, before a single tool gets deployed. Book a call and we will look at where your business actually stands.

---

Jose Lugo is a CISSP-certified security engineer with 12 years of U.S. Army intelligence experience. He builds secure AI work environments for small businesses at josecustom.ai.