AI Readiness Assessment: 15-Question Self-Test

1. Strategy & leadership: Is there a written AI objective derived from your business strategy?No, AI is not a strategic topic for us yet · There is interest, but no written objectives · Yes, objectives are written down but not yet tied to metrics · Yes, with measurable targets reviewed regularly by managementWithout an objective derived from strategy, AI remains a collection of one-off experiments whose value nobody can assess. Good means: a few written objectives with metrics that management reviews regularly.
2. Strategy & leadership: Who is accountable for AI in your company?Nobody explicitly · A few interested people on the side, without a mandate · A named person with a clear mandate but no budget of their own · A named owner with a management mandate, budget and reporting dutyAI initiatives rarely fail on technology; more often nobody drives decisions forward. Good means: a named person with a mandate, time budget and reporting line to management.
3. Strategy & leadership: How are AI investments decided and funded?Not at all – there is no budget for it · Case by case from the general IT or department budget · There is a dedicated AI or digitalisation budget for this year · Multi-year planning with a business case per initiative and success reviewIf budget is scraped together case by case, initiatives are often stopped just when they could deliver results. Good means: a dedicated budget line and a short business case per initiative that is reviewed after the pilot.
4. Processes & use cases: How well do you know the processes where AI could create the most value?We have not looked into it yet · We have a rough list of ideas without assessment · There is a prioritised list with estimated effort and benefit · The top candidates are quantified with current cost, volume and target valuesAI creates value in concrete processes, not in the tool. Good means: you know volume, current cost and target value of your best candidates and prioritise accordingly.
5. Processes & use cases: How far along is your most advanced AI initiative?There is none · Employees use AI assistants individually, without a defined process · A pilot or proof of concept is running or completed · At least one AI solution runs in production in a core processOnly live operation reveals integration effort, acceptance and actual value. Good means: at least one solution runs in production in a core process and is actually used there.
6. Processes & use cases: Do you measure the success of AI applications?No · By gut feeling and team feedback · For individual initiatives with predefined metrics · Systematically: targets up front, measurement afterwards, decision to scale or stopWithout measurement you can justify neither scaling nor stopping. Good means: target values before the start, measurement afterwards and a documented decision.
7. Data & systems: How accessible is the data your most important use cases need?Scattered across inboxes, spreadsheets and people's heads · Partly in ERP/CRM, with inconsistent quality and completeness · Core data is central, clean and has clear owners · Central, maintained, documented and machine-accessible via interfacesAI applications are only as good as the data they can access. Good means: the data you need is central, maintained and has clear owners.
8. Data & systems: Can your core systems (ERP, CRM, DMS, ticketing) be connected to AI applications via APIs?No, or unknown · Only through manual exports · Some systems have documented APIs · Yes, the relevant systems have APIs and there is integration experienceWithout APIs, AI stays an island that someone has to feed by copying data manually. Good means: documented APIs to the relevant systems and first experience in connecting them.
9. Data & systems: How do you handle confidential data with AI tools?There are no rules, everyone decides for themselves · Verbal agreements, but no approved tools · Approved tools with business contracts (no training on your data) · Data classification, approved tools and technical controls (e.g. access rights, logging)Without clear rules, confidential data quickly ends up in private accounts or unvetted tools. Good means: approved tools with business contracts, a simple data classification and technical controls.
10. People & skills: How widespread is basic AI knowledge among staff?Hardly present · A few employees taught themselves · Selected teams have been trained · Everyone who uses AI has been trained, and the training is documentedPeople who understand what AI can and cannot do use it more sensibly and safely; as amended by the Digital Omnibus (Regulation (EU) 2026/1744), Art. 4 of the AI Act requires organisations to promote their staff's AI literacy. Good means: documented training for everyone who uses AI.
11. People & skills: Do you have people who can implement or steer AI solutions, functionally and technically?No · Interested domain experts without delivery experience · Yes, in-house or through a regular external partner · Yes, in-house with delivery experience, supplemented by external specialistsSomeone has to define requirements, assess vendors and oversee solutions technically, otherwise you depend entirely on third parties. Good means: internal people with delivery experience, supplemented by external specialists where needed.
12. People & skills: How do employees and the works council (if any) view AI?Rather negative or unsettled · Wait-and-see, the topic has hardly been communicated · Open, with first communication and involvement · Actively involved: pilot groups, feedback loops, a works agreement where applicableSolutions the workforce does not support are not used day to day; in Germany, a works council has co-determination rights over technical systems that can monitor behaviour or performance. Good means: early information, pilot groups and fixed feedback channels.
13. Governance & legal: Do you know which AI systems are used in the company?No · Roughly, but not documented · There is a list of approved tools · A maintained AI inventory with purpose, owners and EU AI Act risk classificationYou can only assess and safeguard what you know about. Good means: a maintained inventory with purpose, owners and AI Act risk classification that also covers tools teams procured themselves.
14. Governance & legal: Is there an AI usage policy for employees?No · In progress or only verbal · Yes, written and communicated · Yes, written, trained, regularly updated and with a clear approval process for new toolsA policy tells employees what is allowed and prevents shadow IT. Good means: written, short, trained and with a clear route for getting new tools approved.
15. Governance & legal: How do you check data protection (GDPR) and AI Act obligations for new AI initiatives?Not at all · Only on request or case by case · Data protection is checked (e.g. processing agreements, a DPIA where needed), AI Act not yet systematically · A fixed review step for GDPR and the AI Act (role, risk class, transparency duties) before every go-liveThe GDPR applies to every AI initiative that processes personal data, and obligations for high-risk systems under Annex III of the AI Act apply from 2 December 2027. Good means: a fixed check before every go-live that clarifies role, risk class and transparency obligations.

Your result by area

• Strategy & leadership: Derive two or three AI objectives with one metric each from your business strategy – management drafts them, and it is done when the objectives are in writing and a standing item at the next leadership meeting. Name one person accountable for AI with a written mandate from management – it is done when mandate, time budget and reporting rhythm are recorded and announced across the company. Set aside a dedicated budget for the first AI initiatives and tie every spend to a short business case – management and controlling agree on it, and it is done when the budget line is in the plan for this or next year.
• Processes & use cases: Collect the ten most time-consuming routine tasks with your department heads and rate them by volume, effort and data situation – the AI lead facilitates, and it is done when a prioritised list with the three best candidates exists. Record time spent, case volume and error rate for the three best candidates – each department measures for two to four weeks, and it is done when a baseline and a target value are documented for each candidate. Run a time-boxed pilot for the top-rated candidate with a stop criterion agreed upfront – the AI lead steers it together with the department, and it is done when a documented decision to scale or stop is on record.
• Data & systems: Write down which data your three most important use cases need, which system holds it and who maintains it – IT and the business department build the overview together, and it is done when every data source has a named owner. Check whether ERP, CRM, DMS and ticketing system have documented and licensed APIs – IT or your system provider clarifies this, and it is done when there is a short profile per system with access route and open issues. Classify your data into three confidentiality levels and approve AI tools with business contracts (no training on your data) per level – IT and data protection decide, and it is done when the approved-tools list is published and nobody needs private accounts for company data any more.
• People & skills: Train everyone who uses AI on basics, limits and your internal rules – the AI lead organises it, and it is done when attendance and content are documented (as amended by the Digital Omnibus (Regulation (EU) 2026/1744), Art. 4 of the AI Act requires organisations to promote their staff's AI literacy). Name an AI contact in every department who collects ideas and supports colleagues – department heads choose them, and it is done when this group meets on a fixed rhythm. Inform staff and, where one exists, the works council early about goals, planned initiatives and rules, and involve affected employees in the pilot – management and the AI lead own this, and it is done when there is a fixed feedback channel and open questions are answered.
• Governance & legal: Set up an AI inventory listing tool, purpose, data processed, owner and a preliminary AI Act risk classification – the AI lead builds it with IT, and it is done when all tools in use are recorded and the list has a fixed review date. Adopt an AI usage policy of no more than two pages (approved tools, prohibited data, labelling, approval of new tools) – management, data protection and, where applicable, the works council agree on it, and it is done when every employee has received and acknowledged it. Introduce a fixed GDPR and AI Act check before every go-live (role as provider or deployer, risk class, transparency obligations) – the data protection officer and project owner review together, and it is done when no AI initiative goes live without a completed checklist.

Result levels

• Level 1: Beginner — AI beginner – orientation first, tools second: AI is used occasionally at most, and objectives, ownership and rules are missing. That is a good starting point to set things up properly from day one instead of cleaning up uncontrolled tool use later.
• Level 2: Explorer — AI explorer – from experimenting to prioritised initiatives: There is first experience and interest, but AI is not yet used systematically. Typical signs: individual assistants in use, ideas without assessment, inconsistent data and rules.
• Level 3: Advanced — AI advanced – move pilots into operations: Strategy, skills and first pilots are in place. The bottleneck is usually data access, integration into core systems and measurable value in day-to-day operations.
• Level 4: AI-Native — AI leader – scale and safeguard: AI is anchored in strategy, processes and governance. The focus now is scaling across several areas, agent workflows with clear permissions, and robust evidence for customers, auditors and regulators.