AI Readiness Assessment: A Practical Guide for Small Business

An AI readiness assessment tells you whether your business can get real value from AI right now, and what to fix first if it can't. For a company with 10 to 250 employees, that means checking six things: whether you know which problem you're solving, whether your data and systems are clean enough, whether your people are on board, whether you have written rules for AI use, whether someone owns the result, and whether you can measure it. You can do a first pass in an afternoon.

Most published assessments are built for enterprises with a data team and a CIO. This guide is for owner-led companies where the office manager also runs the CRM.

TL;DR

Readiness is not a score you earn once. It is the gap between how a process runs today and how you want it to run, reviewed regularly.
Check six areas: use case, data, systems, people, policy, and measurement. A weak area tells you what to fix before you buy anything.
Write a one-page AI usage policy first. It is the cheapest readiness step and it covers the risk you probably already have: staff using AI tools on their own.
Pick one painful, repeatable process (lead follow-up, invoicing, scheduling) and define its target in numbers before choosing a tool.
If you'd rather have a specialist run the assessment, our Blueprint starts at $1,500 and a free self-check is available.

What an AI readiness assessment actually measures
Why small businesses stall (and what the data says)
The six-area self-assessment
AI usage policy for a small business
Common AI uses versus integrated systems
What to do with a low score
Our perspective: readiness is a loop, not a certificate
Want a specialist to run it?
FAQ
Sources

What an AI readiness assessment actually measures

The large technology vendors publish assessments that look alike at the top level. One widely used example scores organizations across six dimensions: strategy, infrastructure, data, governance, talent and culture. That framing is sound. The trouble is the depth: questions about GPU capacity and data lakes mean little to a 40-person HVAC company.

For a smaller business, we collapse those into questions an owner can answer without a consultant:

Use case. Can you name one process that costs you money every week, and say what "fixed" looks like?
Data. Do you know where customer, job and billing information lives, and who is allowed to touch it?
Systems. Do your tools talk to each other, or does someone retype things between them?
People. Does the team understand why you're doing this, and has anyone been trained?
Policy. Is there a written rule about which AI tools staff may use and with what data?
Measurement. Will you be able to tell, in dollars or hours, whether it worked?

Why small businesses stall (and what the data says)

Small firms are catching up. According to an SBA Office of Advocacy research spotlight, 8.8% of small businesses (under 250 employees) were using AI in late 2025, against 11.4% of larger firms in the Census data it draws on. Small firms averaged about two AI use cases, mostly marketing, and lagged furthest in more complex work such as robotic process automation and data analytics.

The pattern in the numbers is useful. The SBA's February 2026 small business FAQ reports that firms with fewer than five employees used AI at 8.2%, nearly as high as the biggest companies. The very smallest shops try simple tools. Mid-sized small businesses, with several systems, several departments and real process complexity, are where integration gets hard. That is exactly the 10 to 250 employee range.

The same SBA spotlight points to the likely cause: about half of small businesses using AI reported making no investment in the transition, meaning no training, no process changes and no vendor support. AI gets bolted on and then quietly abandoned.

The six-area self-assessment

Score each area from 0 (nothing in place) to 3 (documented and working). Be honest. A 12 out of 18 with a clear picture of the gaps beats an inflated 17.

1. Use case: one painful process, defined in numbers

The most common readiness failure is starting with a tool instead of a problem. Good first candidates share three traits: they repeat daily or weekly, they follow rules a person could write down, and delay or error costs money.

Examples from the kinds of businesses we work with:

A plumbing or electrical company where inbound estimate requests wait hours for a reply.
A property manager whose maintenance requests are re-keyed from email into a work-order system.
A distributor whose invoices are built by hand from order confirmations.

Then write a target. NIST's guidance on AI risk uses the idea of profiles: describe your current state, describe the target state, and treat the difference as your gap list. In plain terms, "new leads get a personal-sounding reply within five minutes, and a follow-up on day two and day five" is a target. "Use AI for sales" is not.

Score 3 if you have one process, a baseline (how long it takes now, how often it fails) and a target.

2. Data: know where it lives and who can see it

You don't need a data warehouse. You need to know where the information for your chosen process lives, whether it is reasonably accurate, and what is sensitive. Customer contact details, payment information, employee records and anything covered by a contract confidentiality clause need rules before they go near an AI tool.

A quick test: pick 20 recent customer records and check them. How many have a duplicate, a missing phone number or a wrong status? If it's more than a few, a CRM cleanup comes before automation, because automation multiplies bad data at speed.

Score 3 if you can name the system of record for customers, jobs and invoices, and spot-checks show it is mostly right.

3. Systems: do your tools talk to each other?

Count the tools involved in one job from first call to final payment. If a person copies data between three of them, that is both your best automation opportunity and your biggest readiness hurdle. Many small businesses also pay for overlapping subscriptions nobody reviewed. Consolidating tools often saves money before any AI is switched on.

Score 3 if the core systems (CRM, scheduling, accounting) share data automatically or you have a plan to connect them.

4. People: adoption is a change problem

A Department of Energy report on AI adoption in utilities makes a point that holds in any workplace: adoption is largely about people and change management, and staff who fear replacement will quietly work around the new system. Say plainly what the AI is for, which tasks it takes off people's plates, and which decisions stay human.

Plan for training time. An hour-long demo is not training. Staff need to practice on their own real work.

Score 3 if your team has been told the purpose, someone is responsible for rollout, and training time is on the calendar.

5. Policy: write the rules before the tools spread

This is the area readiness checklists most often skip, and it is where small businesses have the most immediate exposure. If employees are pasting customer emails or contract terms into a free chatbot today, you already have an AI usage problem. The next section covers what to write.

Score 3 if a written policy exists, staff have signed it, and someone reviews it on a schedule.

6. Measurement: decide how you'll know it worked

Pick two numbers per project: one operational (response time, hours per week, error rate) and one financial (cost per invoice, revenue from recovered leads). Capture the baseline now. Without a before number, every result becomes an opinion.

Score 3 if baselines are recorded and someone will report on them monthly.

Reading your score

Total (of 18)	What it means	What to do
0 to 6	Early. Tools would stall.	Write the policy, pick a use case, clean up data.
7 to 12	Partly ready.	Fix your two lowest areas, then run one small pilot.
13 to 18	Ready for a scoped build.	Choose the first process and set the target and budget.

Look at the lowest single score, not just the total. A business scoring 3 everywhere except policy still has a gap that can hurt it.

AI usage policy for a small business

An AI usage policy is different from a governance framework. A framework settles who owns risk. A usage policy tells staff, day to day, what they may and may not do. One responsible-use policy template lists the core clauses: approved and prohibited tools, data handling, human review and sign-off, disclosure, and accountability. It also recommends reviewing the policy at least annually, which is the minimum given how quickly tools change.

For a company of 10 to 250 people, one page is enough. Cover these points:

Approved tools. Name them. Anything else needs a manager's okay.
Data that never goes in. Customer personal information, payment data, employee records, passwords, and anything under a confidentiality agreement.
Human review. A person checks anything AI-drafted before it reaches a customer, a contract or a financial record.
Disclosure. Say when you will tell customers AI was involved, and when staff must tell you.
Owner and review date. One named person answers questions and updates the policy.

The National Cybersecurity Alliance makes the same case for a written acceptable use policy and warns against trusting AI output without verification. If your business handles regulated data (health, financial, or children's information), have your attorney read the draft before you roll it out. That step is not optional in those cases.

Don't copy an enterprise framework wholesale. NIST's AI Risk Management Framework is voluntary and written for organizations of every size, and its profile approach lets a smaller business apply it to one use case, such as invoice automation or customer data handling, instead of the whole company.

Common AI uses versus integrated systems

Most small businesses begin with the easy wins: drafting content, scheduling posts, summarizing meetings. AI social media tools for local businesses are a typical example, and they need little preparation because they sit apart from your core operations.

The harder and more valuable work sits inside operations: lead routing, proposals, invoicing, scheduling, reporting. That work touches customer data and several systems at once, which is why readiness matters there and barely matters for a caption generator. The SBA gap in complex implementations, mentioned above, is this difference showing up in the data.

What to do with a low score

A low score is a work plan, not a verdict. A sensible order:

Write and circulate the usage policy this week.
Choose the single process with the clearest cost and write its target.
Fix the data that process depends on.
Connect or consolidate the two or three tools involved.
Run a pilot for 30 to 60 days against your baseline.
Review monthly, and only then add a second process.

Budget realistically at the same time. Our write-up on what AI automation actually costs a small business gives the numbers without a pitch.

Our perspective: readiness is a loop, not a certificate

We get asked for a readiness score all the time, and we understand why. A number feels safe. But the businesses that struggle with AI are rarely the ones that scored low. They are the ones that treated the assessment as a gate to pass, bought a tool, and walked away.

In our experience with owner-led companies in the Southeast, the real work is finding the specific, costly inefficiency, such as leads that go cold over a weekend or invoices that wait for someone to have time, and building the fix into the way the team already works. Then you keep measuring. That is why every engagement of ours starts with a diagnostic, why we stay on after the build, and why clients get a monthly report showing operating costs and savings. If a system can't show its value in dollars, it hasn't earned its place.

We also don't mark up tools or lock you into a vendor. Your assessment should leave you with options, not a dependency.

— Greyson

Want a specialist to run it?

If you'd rather not do this alone, we start with a diagnostic that maps where your time and money leak, and our Blueprint turns that into a build plan, from $1,500 one-off. You can also start with our free AI readiness assessment or the AI integration checklist. If you're in the Carolinas, see how we work with Charlotte businesses or across South Carolina.

FAQ

How do you measure AI readiness?

Score the business on use case, data, systems, people, policy and measurement, then compare how your chosen process runs today with the target you want. The gaps between the two are your readiness gaps. Repeat the check every few months, since tools and your own processes change.

Do I need an AI usage policy if only a few people use AI?

Yes. A few people using AI on their own is the situation a policy exists for, because customer data can leak without anyone noticing. A one-page policy covering approved tools, forbidden data and human review is enough to start.

How long does an AI readiness assessment take?

A self-assessment like the one above takes a few hours if you have your systems and processes in mind. A consultant-led assessment takes longer, since it involves interviewing staff and observing the work itself, but it produces a prioritized plan instead of a score.

Is my business too small for AI?

Not necessarily. SBA data shows firms with under five employees use AI at rates close to large companies. What matters is having one repeatable, costly process to fix, not headcount.