Enterprise AI Readiness Checklist: 25 Questions Every CIO Should Answer Before Investing in AI
The 25 questions we ask every CIO before recommending an AI investment — organized by strategy, data, security, talent, and change management.
Most enterprise AI programs that stall in year one didn't fail on the model or the vendor. They failed on readiness — a set of conditions inside the organization that either enable or block the program before the first line of code ships. This checklist is the diagnostic we run with CIOs before recommending any material AI investment.
There are 25 questions across five domains: strategy, data, security and governance, talent and operating model, and change management. Score each one green (yes, evidenced), yellow (partial, in progress), or red (no, or unknown). Enterprises with more than five reds should not launch a new AI program until at least three of them are cleared — the ROI math simply doesn't survive the friction.
Strategy (5 questions)
- 1. Is there a written AI strategy that names the top 3–5 outcomes we're pursuing over 24 months?
- 2. Does each outcome have a named executive sponsor with P&L authority?
- 3. Have we defined what we will NOT do with AI (use cases, data, vendors)?
- 4. Is AI funding a distinct capital line or a bolt-on to IT run-rate?
- 5. Do we have a mechanism to kill a program that fails its 90-day metric?
Reds here are almost always fatal. Without an outcome-anchored strategy and the ability to kill bad programs, an enterprise ends up running 40 pilots and shipping four.
Data (5 questions)
- 6. Do we have a canonical inventory of the datasets that would fuel our top 3 use cases?
- 7. For each of those datasets, do we know owner, freshness, quality score, and lineage?
- 8. Is customer PII classified and mapped across systems (per GDPR/CCPA)?
- 9. Do we have a labeled evaluation dataset for at least one target workflow?
- 10. Is there a data platform (warehouse, lakehouse, feature store) that AI systems can query without bespoke ETL per use case?
The most common red in this section is #9. Enterprises that ship AI without evals are shipping without tests. The fix is usually two weeks of work with SMEs and worth every hour.
Security and governance (5 questions)
- 11. Do we have an AI acceptable-use policy that covers both employee tools and production systems?
- 12. Is there an AI risk classification (aligned to NIST AI RMF or ISO/IEC 42001) applied to every proposed use case?
- 13. For third-party model vendors, do we have DPAs, model card review, and data-residency guarantees?
- 14. Is there a mandatory human-in-the-loop policy for high-risk decisions (EU AI Act Article 14 aligned)?
- 15. Do we have model observability, prompt/response logging, and incident response for AI systems?
The EU AI Act's high-risk provisions are now enforceable in most jurisdictions, and US state-level equivalents (Colorado AI Act, California SB 942/1047 successors) are landing throughout 2026. Reds here are legal exposure, not just governance debt.
Talent and operating model (5 questions)
- 16. Do we have at least one senior AI engineer or ML platform lead in-house, not just at vendors?
- 17. Is there a defined operating model for who owns models, prompts, evals, and monitoring?
- 18. Do product managers on target workflows have basic prompt-engineering and eval literacy?
- 19. Have we identified the SMEs (10+ years of domain experience) who will define quality?
- 20. Is there a career path and retention plan for the AI talent we'll hire or upskill?
Change management (5 questions)
Free 30-min audit
Want us to build this for your business?
We build n8n automations and AI agents for SMBs. Book a free 30-minute audit — we'll map your highest-ROI workflow live, no pitch.
Book a free call- 21. Do the frontline teams whose workflows will change know it's coming, and have they been consulted?
- 22. Is there a training plan and adoption target for each production AI system?
- 23. Do we have a communications plan that names both the opportunity and the honest constraints (job impact, error rates)?
- 24. Are managers whose teams adopt AI measured and rewarded on adoption metrics?
- 25. Is there a feedback channel from end users into the AI team, and does it drive backlog priority?
How to use the score
Total up your greens, yellows, and reds. Programs that ship in production consistently look like: 18+ greens, 5 or fewer yellows, and 2 or fewer reds. Programs that don't ship look like: 8–12 greens, 10+ yellows, and 5+ reds. The distribution is more important than the average.
Readiness is the cheapest thing to fix and the most expensive thing to ignore.
The most impactful next step, for almost every enterprise we've run through this, is a two-week gap-closure sprint on the top five reds before the next AI investment cycle. It is dramatically cheaper than the alternative, which is spending 12 months and $1–5M discovering the same reds inside a running program.
Tutorial: run the 25-question assessment in an afternoon
Below is the same 25-question checklist as a scored JSON template. Distribute it to your program sponsor, data platform lead, security lead, HR partner, and one line-of-business director. Score independently, then reconcile in a 60-minute session — the disagreements are where the real readiness gaps live.
{
"program": "enterprise-ai-readiness",
"as_of": "2026-07-07",
"domains": {
"strategy": {
"written_strategy_with_3_5_outcomes": "green",
"each_outcome_has_pnl_sponsor": "yellow",
"explicit_do_not_do_list": "red",
"distinct_capital_line": "green",
"kill_criteria_defined": "yellow"
},
"data": {
"canonical_dataset_inventory_for_top_3": "yellow",
"owner_freshness_quality_lineage_known": "yellow",
"pii_classified_and_mapped": "green",
"eval_dataset_for_one_workflow": "red",
"data_platform_accessible_to_ai": "green"
},
"security_governance": {
"ai_acceptable_use_policy": "green",
"risk_classification_per_use_case": "yellow",
"vendor_dpas_and_model_cards_reviewed": "green",
"human_in_the_loop_for_high_risk": "green",
"observability_and_incident_response": "yellow"
},
"talent_operating_model": {
"in_house_senior_ai_engineer": "yellow",
"defined_ownership_of_models_prompts_evals": "red",
"pm_prompt_and_eval_literacy": "yellow",
"smes_identified_for_quality_definition": "green",
"career_path_for_ai_talent": "yellow"
},
"change_management": {
"frontline_teams_informed_and_consulted": "yellow",
"training_and_adoption_targets_per_system": "red",
"communications_plan_with_honest_constraints": "yellow",
"manager_incentives_include_adoption": "red",
"user_feedback_channel_into_backlog": "yellow"
}
},
"totals": { "green": 7, "yellow": 12, "red": 6 },
"recommendation": "close top 5 reds before next AI investment cycle"
}
The pattern that works is a 2-week 'gap-closure sprint' after scoring. Pick the top 5 reds, assign one owner per gap, ship a written artifact (a policy, an eval set, a sponsor commitment) per gap, and rescore. Enterprises that do this consistently move from 8 greens to 18+ greens inside two quarters.
What to do with the yellows
- Yellows are usually 'we're doing it, but not evenly across business units.' Address by standardizing the artifact and requiring it on every new use case.
- Don't let yellows accumulate — a yellow ignored for two quarters is a red on the next scan.
Frequently asked questions
What's your AI Readiness Score?
10 questions. A personalized score, profile, and a 90-day automation roadmap built for your business. No email required.
Ready to simplify your business with AI automation?
Let's talk about how intelligent automation can save your team time, reduce errors, and help you focus on what actually drives your business forward.
0 Comments
Be the first to comment. Start the conversation below.