What does AI readiness actually mean for a mid-sized business?

AI readiness is the state of your data, processes, people, technology, strategy and governance before any AI tool touches them. It is not a measure of how much AI you have bought, how many pilots are running, or whether someone in the business has a ChatGPT licence. It is a measure of whether the conditions exist for an AI tool to produce a result you can point at in a board meeting and defend.

That distinction matters because most organisations are measuring the wrong thing. They count deployments. The useful question is whether the underlying business could support a deployment at all. If your customer list lives in four systems and nobody owns its accuracy, an AI tool trained on it will produce confident nonsense at speed. That is not an AI failure. That is a data ownership failure that AI made visible and expensive.

The evidence that readiness, not technology, is the binding constraint

Start with the ROI numbers, because they are the ones your CFO already has.

In a survey of 200 US finance chiefs, only 14% said they had seen a clear, measurable impact from their AI investments to date, while two-thirds expected impact within two years (CFO.com). Read those two figures together. The gap between what has been proven and what is expected is where the next round of awkward board questions lives.

IT leaders are saying the same thing about their own work. A NetApp-commissioned survey found 67% of IT decision-makers see AI as strategically important, yet 42% say their current AI adoption is not likely to deliver a return on investment (TechRadar Pro). That is an admission against interest from the exact people who signed the purchase orders. They are not saying AI does not work. They are saying their version of it, in their business, on their data, probably will not pay.

The mechanism behind that is the interesting part. The Upwork Research Institute surveyed 195 SMB leaders at firms of 10 to 99 employees in Q1 2026. Seventy-four per cent said AI had improved productivity, but the improvements stayed under 25% for most. The report’s diagnosis is blunt: you cannot build a sensible agent deployment strategy when your CFO, your head of operations and your IT lead hold three different mental models of what an AI agent is. Misaligned definitions produce misaligned expectations, and those produce deployments that feel like failures even when the technology performs exactly as designed (Upwork).

Read that last clause again. The technology worked. The organisation experienced it as a failure. That is a readiness problem with a technology-shaped shadow.

Why “small and nimble” is the wrong story

The vendor pitch to companies your size usually runs: you have less bureaucracy, fewer legacy systems, no procurement committee, so you can move faster than the enterprise. It is flattering and it is mostly wrong.

The AICPA/CIMA and NC State ERM Initiative surveyed 1,735 executives. Only 24 to 27% reported adequate AI-skilled talent, IT system readiness or regulatory preparedness. Smaller organisations came out worst: fewer than one in five have the required talent or systems (AICPA/CIMA).

Speed of decision is not the same as capacity to execute. A 200-person firm can approve an AI tool in a single meeting. It cannot conjure a data owner, a documented process or a governance policy in that same meeting. The absence of bureaucracy that makes the purchase quick is frequently the same absence that makes the deployment fail.

The six pillars, and what each one is actually asking

Readiness is not one number. It is six conditions that can each fail independently, and the weakest one caps the rest.

Data. Not “do you have a data strategy”. The honest test is narrower: if you needed a clean, accurate list of your best 500 customers right now, how confident are you in what you would get? Can your key systems share data without someone manually exporting and importing spreadsheets? And the question that exposes most businesses: who is responsible for the quality and accuracy of your data? If the answer is a shrug or a committee, you have found something.

Process. How many of your core processes are documented well enough that a new starter could follow them without asking anyone? If you gave three people the same task, how similar would their approaches be? AI automates process. Where the process is undocumented and inconsistent, automation multiplies the inconsistency rather than removing it.

People. Attitude and capability, separately. If you asked your team to use an AI tool tomorrow, how capable would they actually be? And are you, as the leader, modelling adoption yourself, or delegating enthusiasm downwards? Grant Thornton’s 2026 AI Impact Survey found CIOs and CTOs are five times more likely than COOs to say the workforce is ready to adopt AI (Grant Thornton). Two people in the same executive team, looking at the same staff, reaching opposite conclusions. One of them is running the pilot.

Technology. Whether your systems can support integration at all, and whether anyone knows what is already installed.

Strategy. Whether AI activity is tied to a business outcome someone owns, or whether it exists because the board asked what you are doing about AI.

Governance. Who signs off, who monitors, who is accountable when something goes wrong. In Avalara’s June 2025 survey of finance leaders across the US, UK, Australia and India, 23% said responsibility for an AI mishap would fall to no one, or would be unclear (CFO Dive). Nearly a quarter of businesses running these systems have no named human at the end of the chain.

The accountability vacuum has a new occupant

Something structural has shifted in who is expected to own this. Forbes Research data shows COO involvement in AI strategy rose from 2% in 2024 to 41% in 2025 (Larridin).

A twentyfold increase in mandate in twelve months. The instruments did not arrive with it. The COO now owns AI outcomes while the CFO controls the budget, the CIO controls the systems, and, per Grant Thornton, the CIO is five times more optimistic about workforce readiness than the COO is. The person carrying the outcome has the least favourable view of the inputs and the least control over them.

If you are the COO in that position, readiness assessment is not a nice-to-have. It is the only way to convert a vague accountability into a documented position you can point at when the pilot underdelivers.

What a readiness score is for, and what it is not

A readiness score does not tell you which AI tool to buy. It tells you which of the six conditions will break first, which changes what you should be spending on this quarter.

The practical value is in sequencing. If Data scores badly and Process scores well, you have a documented business running on numbers nobody trusts, and the fix is ownership and integration before any tool. If Process scores badly and People scores well, you have a willing team with nothing consistent to automate, and the fix is documentation. Those are completely different budgets, completely different timelines, and both get described as “we need to sort out our AI readiness” by someone writing a board paper.

A score also does something less comfortable and more useful. It creates a baseline. Right now, most organisations cannot answer the question “were we more ready in March than we are in August?” because nothing was written down in March. That is why only 14% of those finance chiefs can prove impact. Not because impact did not happen, but because nobody recorded the before.

Testing your own position

There are three things you can do this week without spending anything.

First, run the definition test. Ask your CFO, your operations lead and your IT lead separately, in writing, what an AI agent is and what one would do in your business. Do not let them confer. Compare the three answers. If they differ materially, you have located the misalignment the Upwork research identified, and you have located it before it costs you a deployment.

Second, before you approve the next AI tool, write down one number it should move, that number’s value today, and the name of the person accountable for moving it. One page. If you cannot fill in all three fields, you are not ready to approve it. This is also the artefact that makes the spend defensible in ninety days when someone asks whether it worked.

Third, get an actual score rather than an impression. The free AI Readiness Audit is 30 questions across the six pillars, five per pillar, and takes 7 minutes. It gives you a readiness score out of 120, a band for each pillar and a short synopsis. Every answer is self-reported, so it reflects what you believe about your business rather than an inspection of your systems, which is precisely why it is worth having three of your leaders take it separately and comparing the results. No call is booked at the end unless you ask for one.

The uncomfortable version of the argument

If your readiness is poor, buying AI does not fix it. It converts a slow, tolerable problem into a fast, visible, invoiced one.

A business with undocumented processes and unowned data was already losing money before anyone mentioned AI. It was losing it quietly, through rework, disputed reports and decisions made on the loudest opinion in the room. Adding an AI layer on top does not remove any of that. It accelerates it, gives it an air of authority, and attaches a monthly licence fee.

That is the real reason readiness comes first. Not because assessment is virtuous, but because the alternative is paying to industrialise your existing weaknesses and then explaining the result to your board.