What an AI readiness assessment actually measures (and why the generic checklists get it half right)

An AI readiness assessment is supposed to answer one question: will this company get real value from an AI project, or will it burn six months and a budget line finding out it wasn't ready? Most of the assessments ranking for this term don't answer that question. They score you on five buckets, hand you a percentage, and point you toward a bigger engagement.

Cisco's AI Readiness Assessment tool, RSM, Eide Bailly, Avanade, and Microsoft's Adoption program all converge on roughly the same five pillars: strategy and vision, data foundation, technical infrastructure, people and culture, governance and compliance. Harvard Business School Online's piece on how to know if your company is AI-ready uses a version of the same framework. It's not wrong. It's just built for a different company than the one reading this.

These frameworks assume you have a data team, an infrastructure team, and a governance committee that can each score their own domain. A founder-led company doing $5M to $50M in revenue usually has none of those things as separate functions. The CFO owns data. The COO owns process. The founder owns the decision to spend money. Scoring "technical infrastructure maturity" on a scale of 1 to 5 tells that person almost nothing they can act on this quarter.

Why readiness is a process-ownership problem before it's a data problem

The most common reason mid-market AI projects stall isn't bad data. It's that nobody picked a single, bounded process with a measurable ROI ceiling and put one person's name on owning the outcome. Fix that, and imperfect data becomes a solvable engineering problem. Skip it, and perfect data won't save the project.

The failure numbers back this up more than most vendors want to admit. RAND Corporation's 2024 research found that AI projects fail at roughly double the rate of standard IT projects, and the root causes it identifies are almost entirely organizational: misunderstanding the problem, poor data, and a lack of the right skills mapped to the right task, not a shortage of GPUs. Gartner went further in a June 2025 press release, predicting that over 40% of agentic AI projects will be scrapped by 2027 because of escalating costs, unclear business value, and inadequate risk controls. None of those three are infrastructure problems. They're diagnosis problems that got skipped.

McKinsey's State of AI research describes the same pattern from the adoption side: most companies report using generative AI somewhere, but far fewer have actually redesigned a workflow around it or captured measurable bottom-line value. Adoption isn't readiness. A team using ChatGPT to draft emails has adopted AI. It hasn't gotten ready for anything.

The five things worth actually assessing at a $5M to $50M company

If you're going to run a readiness check, run it against these five questions instead of a maturity score. They're ordered the way we actually diagnose them at Genta AI Solutions.

• Process clarity and ROI ceiling. Can you name the exact process, describe its current cost or leakage in dollars, and state what "fixed" looks like? If the answer is "we want AI in operations somewhere," you're not ready to build anything yet, you're ready to go find the process.

• Data accessibility, not data perfection. Does the data needed for this one process exist, and can a system reach it? You don't need a clean enterprise data warehouse. You need clean inputs for the specific workflow you're automating.

• A named process owner. Someone inside the company, not the vendor, who is accountable for the outcome and will keep using the system after the vendor leaves. Projects without this owner tend to quietly die around month four.

• Compliance and data-residency exposure. Does this process touch regulated data (PHI, PII, financial records) and does that change where the model can run? This is the pillar generic checklists treat as a footnote and regulated-industry buyers treat as a dealbreaker.

• Build-versus-buy readiness. Is there software on the market that already solves 80% of this, or is the process specific enough to your business that no SaaS product will fit without heavy customization? Answering this wrong is the single most expensive mistake we see.

Notice what's missing compared to the Cisco/RSM/HBS version: there's no "strategy and vision" pillar, no "culture" score. Those matter for a 5,000-person company rolling AI out across departments. They're noise for a company deciding whether to automate one billing workflow.

How to run a lightweight readiness check in under two weeks

You don't need a six-month consulting engagement to answer these five questions. You need a structured two-week diagnostic, and a founder or COO can drive most of it directly.

Week one: pick the single most painful, most measurable process (invoice processing, claims intake, prospecting research, whatever is eating the most manual hours) and pull three numbers. Current time spent per week, current error or exception rate, and current dollar cost including headcount. Then interview the person who actually does the work daily, not their manager. They know where the process breaks in ways nobody has documented.

Week two: map the data sources involved and confirm they're reachable by a system (an API, a database, even a shared drive counts). Confirm who owns the process going forward. Check compliance exposure, meaning does this touch data covered by HIPAA, GDPR, or state-level rules like Colorado's AI Act. Then, and only then, decide whether an off-the-shelf tool covers 80% of the need or whether the process is specific enough to warrant a custom build.

This is close to what Genta runs as a standalone, paid Discovery phase before any build work starts, because a real diagnosis takes real time from someone who has done it before, but it doesn't require months. Most engagements start in that two-week window and produce a specific recommendation, not a maturity percentage.

Red flags that mean you're not ready yet

A few patterns show up over and over in companies that aren't ready, regardless of what their data infrastructure looks like.

There's no baseline. If nobody can tell you the current error rate or processing time for a task, you have no way to prove the AI system improved anything later, which makes the whole project unfundable in year two. There's no process owner, just a vague mandate from leadership to "look into AI." There's unclear regulatory obligation, meaning nobody has checked whether the data involved triggers HIPAA, a state privacy law, or (for EU-facing companies) GDPR and the EU AI Act's risk tiers. The NIST AI Risk Management Framework, built around four functions (Govern, Map, Measure, Manage), is a useful structure to borrow here even outside government contracts. If you can't answer basic Govern and Map questions about a process, that's the readiness gap, not your server capacity.

The last red flag is subtler: leadership wants a big, visible AI initiative before anyone has proven a small one works. This is exactly the pattern behind why pilots stall after they succeed, and it's worth reading in more depth if that sounds familiar.

What happens after the assessment: build, buy, or wait

A real readiness assessment ends in one of three decisions, not a score. Buy, if a mature product already fits the process and customization needs are light. Build, if the process is specific enough to your business that a generic tool would require so much configuration it stops being cheaper. Wait, if there's no process owner, no accessible data, or unresolved compliance exposure. "Wait" is a legitimate outcome and the one vendors are least likely to hand you, because it doesn't generate a contract.

The build-versus-buy call deserves its own diagnosis, since it's where most of the wasted spend happens. And once you've decided to build or buy, the next problem is vetting whoever does the work, which is a separate risk conversation worth having before any contract gets signed.

What diagnosis-first actually looks like in practice

Two examples from Genta AI Solutions' own case studies show what changes when the diagnosis happens before the build, not after.

At C&G Energy Services, an electric infrastructure company, the initial ask was vague: "help us fix billing." The diagnosis broke that into six discrete projects across field logs, invoicing, and reconciliation, and found that most of the fix wasn't AI at all, it was process automation and integration work. That distinction alone recovered roughly $800K a year in leaking revenue. Skipping the diagnosis and jumping straight to "build us an AI billing tool" would have produced the wrong system entirely.

At iCanvas, an e-commerce retailer managing over a million SKUs, the diagnosis identified a narrow, well-bounded process (programmatic taxonomy and keyword mapping) that a custom agent could handle end to end. What had been scoped as roughly a year of manual work got done in four weeks, connected to live keyword data. The process-ownership question and the ROI ceiling were both clear from day one, which is exactly what made the build fast instead of speculative.

Neither project started with a maturity score. Both started with a specific, bounded question about one process, one owner, and one number to move.

If you're working through this decision internally, this is exactly what our Discovery phase maps out, and we're happy to compare notes.

Frequently asked questions

What are the five pillars of AI readiness?

The consensus version (used by Cisco, RSM, and HBS Online) covers strategy, data, infrastructure, people, and governance. For a $5M to $50M company, a sharper version works better: process clarity with a defined ROI ceiling, data accessibility for that specific process, a named process owner, compliance exposure, and a clear build-versus-buy call. Score the second list, not the first.

How do I know if my company is ready for AI?

You're ready when you can name one specific process, state its current cost in dollars or hours, confirm the data it needs is reachable, and name a person who owns the outcome. If you can only say "we want to use AI somewhere in operations," you're not ready yet, you're still shopping for a problem.

Do we need clean, perfect data before starting an AI project?

No. You need clean, accessible data for the specific process you're automating, not an enterprise-wide clean data warehouse. Companies wait years chasing perfect data governance before ever touching a real project. Scope the process first, then check whether the inputs it actually needs exist and are reachable.

What does the Microsoft AI Readiness assessment measure?

Microsoft's Adoption program readiness tooling scores organizations against similar categories to Cisco and RSM: strategy alignment, data and infrastructure maturity, skills, and governance, largely oriented toward enterprises already running Microsoft's stack. It's useful as a self-check but isn't built to answer the process-level question a mid-market company needs answered first.

How long should an AI readiness assessment actually take?

Two weeks is enough for a focused assessment on a single process: one week to quantify the problem and interview the people doing the work, one week to check data access, ownership, and compliance exposure. Six-month consulting engagements are built for enterprise-wide rollouts, not for deciding whether to fix one workflow.