AI Readiness: 12 Questions to Answer Before You Spend a Dollar

The Short Answer

An AI readiness assessment should evaluate one candidate workflow, not your company. Ask whether you can name the decision the output changes and its current owner, produce 100 labeled examples from your own history within a week, point to an existing baseline metric, bound the blast radius of a wrong answer, and state the cost per completed transaction. If those five have good answers, build it. Maturity scores do not predict outcomes.

Why the Standard Readiness Assessment Measures the Wrong Object

The consensus version is a maturity model: five pillars, four levels, a radar chart, and a rubric that concludes you are at Level 2 and need outside help. It measures organizational maturity, which is not what determines whether a specific AI feature works.

A company with no AI strategy and no governance council can ship a working denial-appeals system in six weeks if the task is narrow, the data already exists, and one person owns the outcome. A company scoring Level 4 on every pillar will still burn a quarter on a general assistant that nobody depends on. Stanford HAI's 2026 AI Index puts organizational AI adoption at 88%. Adoption at that level tells you nothing about whether any specific workflow depends on the output, which is the only thing that pays back.

Readiness belongs to the use case. You assess one workflow at a time, and every question below is about that workflow.

About the 95% Failure Statistic

Most posts on this subject open with "95% of enterprise AI pilots fail." The number traces to MIT NANDA's report The GenAI Divide: State of AI in Business 2025. Before you repeat it in a board deck, read the report's definition of success and the size of the sample it rests on, because neither travels with the headline.

The number gets quoted in both directions and supports neither. It is used to kill budgets and used to sell remediation. An industry-wide percentage cannot tell you whether your workflow is fundable, because it averages projects that had no baseline metric, no owner, and no evaluation set together with projects that had all three. Those are not the same bet.

Answering the questions below separates those two groups for your own workflow, and it takes about a week rather than a survey.

The 12 Questions

They come in four blocks. One disqualifying answer stops the project. You do not average it away.

Value: is there a decision here at all

1. What decision does the output change, and who makes that decision today? If you cannot name a person and a decision, you are building a document nobody currently produces, with no baseline, so it can never be measured.

2. What metric exists today that this is supposed to move? Handle time, approval rate, error rate, cost per case. If none is recorded, spend the first two weeks instrumenting the manual process before touching a model.

3. Who loses something if this fails? A pilot with no named executive exposure is already dead. Projects of this kind are rarely canceled because the model underperformed. They are canceled because nobody could say what the output was worth, and that begins with nobody owning it.

Data and evaluation: can you tell whether it worked

4. Can you produce 100 real, labeled examples of the task from your own history within five working days? That set is your evaluation harness. If you cannot assemble it you are not ready to build, because everything after this ships on vibes.

5. Who owns the documents the system will retrieve from? Name an owner per corpus, not per system. Retrieval quality is set by whether a person is accountable for deleting the superseded copy of a policy. Three versions of the same handbook with different effective dates, all ranking equally, is an ownership failure that reaches the user as a confident wrong answer. Confirm each corpus has an authoritative copy and a deprecation process before you budget for retrieval.

6. If you plan to use an LLM as your quality gate, how will you calibrate it? A judge model that agrees with itself across reruns is stable, not correct. Score it against human labels on a sample and report a chance-corrected statistic such as Cohen's kappa, because raw agreement percentages are inflated by however often both the judge and the human pick the majority class. A judge that is consistently wrong is worse than no judge, because it manufactures a passing grade.

Risk: what happens when it is wrong

7. What can the system do, not just say? If it can send, refund, publish, book, delete, or execute, the question is blast radius, not accuracy. Require a scoped credential, a per-action rate cap, an audit log, and a reversal path before launch. OWASP files this under Excessive Agency, and it is the most common shortcut in agent projects.

8. Does untrusted content reach the model's context? Email, uploaded files, web pages, third-party tickets. If yes, assume prompt injection succeeds and design so it does not matter. EchoLeak (CVE-2025-32711) was an AI command injection in Microsoft 365 Copilot which, per the CVE record, allowed an unauthorized attacker to disclose information over a network. Treat content filtering as a rate reducer, not a boundary. The boundary is whatever the model's credentials permit.

9. Is the output a statement to a customer about your policies, prices, or entitlements? Then you own it, and "the assistant generated it" is not a position you want to be defending. Constrain the output to retrieved, versioned policy text with a citation back to the clause, or keep a human in the approval path. The expensive failure is not a rude answer. It is a fluent, confident, generous answer about a refund or an entitlement that your actual policy does not offer.

Economics and platform: can you afford to run it

10. What does one completed transaction cost in dollars, including retries and failed tool calls? Not tokens. Anthropic's published example puts a support conversation at roughly 3,700 tokens and 10,000 tickets at about $37.00 on Claude Haiku 4.5, priced at $1 per million input tokens and $5 per million output. Model choice then dominates every other lever: on Anthropic's own price list the spread from Haiku 4.5 to the top of the range is 10x on both input and output. If projected cost per transaction exceeds the human cost of the same work, stop.

11. Does the business case survive at the cheapest model tier? Prototype there from day one. A demo built on the flagship that falls over on the small model has proven nothing except that the flagship works. Budget in dollars rather than tokens, because tokenizers change underneath you: Anthropic documents that the tokenizer used by Claude 4.7 and later models produces approximately 30% more tokens for the same text.

12. Does the system the AI will touch have logging, CI, rollback, and on-call? Google's 2025 DORA report surveyed nearly 5,000 technology professionals and found 90% now use AI at work while 30% report little or no trust in the code it generates. Its stated conclusion is that AI does not fix a team, it amplifies what is already there. A weak platform fails faster, not slower, and an AI feature raises change volume before it raises anything else.

The Scoring Rule

Five greens means build it, whatever your maturity score says. Two or more reds means fund a two-week discovery instead.

The Answer Nobody Wants

Run this honestly and the most common result is that more than half the projected effort is data plumbing. That is the correct answer, not a red flag. Reclassify it as a data project with an AI endpoint, staff it that way, and set the milestone on data availability rather than model accuracy.

Two more results are worth naming. Vectara's public hallucination leaderboard, scored over more than 7,700 articles, currently spans 1.8% to 23.5% on the constrained task of summarizing a document using only the facts in that document. The best model on the most grounded task available is not at zero, so design the workflow around wrong answers instead of budgeting for their absence. And if a vendor cannot show you their evaluation set, their failure taxonomy, and their escalation path, you are buying a demo. Ask for the eval set first and watch what happens to the timeline.

Where the EU AI Act Changes the Answer

If the workflow falls into an Annex III category (employment and recruitment, credit scoring, education access, biometrics), high-risk obligations attach to it. The Act's published implementation timeline puts the bulk of its provisions, those obligations included, at 2 August 2026. Proposals to defer parts of that schedule have been in circulation, so confirm the operative date with counsel rather than with a blog post, this one included.

The engineering answer does not move either way. Technical documentation, event-level logging, and a defined human oversight step are far cheaper built into v1 than retrofitted, and a deferral changes only when someone asks to see them. If your candidate workflow sits in Annex III, put those three in scope before you estimate the timeline rather than after.

What This Looks Like in Practice

At SASID we have shipped 7 production AI systems across 5 industries with more than $1M in documented ROI. The ones that worked passed the first block of questions before any code existed. The healthcare denial-appeals system is the clearest example: one named decision, an existing specialist workflow taking 30 to 60 minutes, and historical cases available as labeled examples. That made the outcome measurable, and the same work now takes under 2 minutes. Narrow scope and an existing baseline are also why a production build lands in 4 to 8 weeks rather than a quarter.

Get a Free Technical Assessment

If you are deciding whether an AI use case is worth funding, we offer a free technical assessment: a 30-minute call about the specific workflow, followed by a written roadmap within 48 hours covering feasibility, evaluation approach, risk controls, timeline, and cost. There is no obligation, and the roadmap is yours to keep. Book at sasid.ai.