An AI readiness assessment checks whether your organization can use AI safely and profitably before you buy tools. It covers eight areas: goals and use cases, processes, data, systems, people, privacy and security, governance, and measurement. Below is a 24-question self-assessment your leadership team can score in about 20 minutes, with what to do at each score.
AI features now arrive as add-ons to the phone system, the CRM and the practice management software you already pay for. Staff are trying public chatbots on their own. The pressure to buy something is real, but buying before you know which problem you are solving risks licences nobody uses and client data going places it should not.
An AI readiness assessment fixes the order of operations. You score where the organization stands today across eight areas, find the gaps that would sink a rollout, and choose one use case worth piloting. Privacy belongs in that score from the first session, because Canadian privacy law already covers how organizations use generative AI.
The 24 questions below are the ones I ask in the first sessions with a new client, before any code is written. I’ve spent twelve years shipping software, starting as a healthcare software architect, where privacy, audit trails and data quality decide whether a system can go live at all. Score the questions with your leadership team, read what your total means, and leave with a ranked list of use cases and a pilot plan.
An AI readiness assessment is a scored check of whether your organization can adopt AI safely and get a measurable return from it. Do it before buying tools, because its output is a ranked list of use cases plus the gaps you need to fix first.
Buying a tool first means starting with an answer and hunting for a question. A vendor demo shows what the product can do. It cannot tell you whether your intake process is written down, whether your client records are clean enough to use, or who reviews the output before it reaches a client.
This AI readiness framework covers eight areas:
Organizational AI readiness here does not mean an enterprise data platform. It means your practice management system, CRM, phone system and inbox hold consistent information, can talk to each other, and have someone responsible for them.
You finish with three outputs: a total score that tells you your stage, a gap list by area, and a shortlist of use cases with an owner and a metric for each. The assessment covers internal operations. How AI assistants describe your organization to prospective clients is a separate question, covered in our guide to AI search optimization.
It should ask whether your goals, processes, data, systems, people, privacy controls, governance and measurement can support a real use case today. Score each of the 24 statements below 0 (no), 1 (partly) or 2 (yes), for a total out of 48.
Score what is true now, not what is planned. Give a 1 when a statement holds for some teams or systems but not all. Each area is worth up to 6 points, and the third column shows what a full score looks like so leaders score against the same standard.
| # | Statement | What a 2 looks like |
|---|---|---|
| 1 | We can name the three tasks that take the most staff time each week. | Leaders name the same three tasks without conferring |
| 2 | Each candidate use case has an owner and a measurable outcome (hours saved, calls answered, response time). | Every use case has a named owner and one metric |
| 3 | Leadership has agreed which problems AI should solve first. | A written priority list everyone signed off |
| # | Statement | What a 2 looks like |
|---|---|---|
| 4 | Our key processes are written down step by step. | A new hire could follow the document unaided |
| 5 | We know where work waits or gets re-typed between systems. | You can point to each delay and re-entry point |
| 6 | Exceptions and handoffs are clear: who decides when something unusual happens. | Every exception has a named decision-maker |
| # | Statement | What a 2 looks like |
|---|---|---|
| 7 | We know where client, case or customer information lives. | A list of every system that holds it |
| 8 | That information is reasonably clean and consistent. | Few duplicates, consistent names and fields |
| 9 | We can access or export it from the systems we already use. | Someone has actually exported a sample |
| # | Statement | What a 2 looks like |
|---|---|---|
| 10 | Our core tools (CRM, practice management, phone, email, booking) offer integrations. | Each tool has a documented API or connector |
| 11 | One person or partner owns those systems. | A named owner, internal or external |
| 12 | We do not run duplicate tools for the same job. | One tool per job and a single source of truth |
If question 10 scores low, our guide to connecting core systems with n8n workflows shows what an integration layer between existing tools can look like.
| # | Statement | What a 2 looks like |
|---|---|---|
| 13 | We know which AI tools staff already use. | You asked, and you have the list |
| 14 | At least one person per team is willing to pilot and give feedback. | A named volunteer in each team |
| 15 | We have set time aside for training. | Training hours are booked in calendars |
| # | Statement | What a 2 looks like |
|---|---|---|
| 16 | We know which information is personal, confidential or privileged and must not go into public AI tools. | Staff can give an example of each |
| 17 | We check how a vendor stores and uses our data before signing up. | A vendor review step that is actually used |
| 18 | System access uses individual accounts and multi-factor authentication. | No shared logins; multi-factor authentication on every core system |
| # | Statement | What a 2 looks like |
|---|---|---|
| 19 | We have a written AI use policy listing approved tools and uses. | Policy written, shared and acknowledged by staff |
| 20 | A person reviews AI output before it reaches a client or a decision. | Review is a written step in the workflow |
| 21 | One named person is accountable for AI tools and their risks. | That name appears in the policy |
| # | Statement | What a 2 looks like |
|---|---|---|
| 22 | We have a baseline for the metrics we want to improve. | Current figures recorded with a date |
| 23 | We have budget set aside for a pilot. | An amount approved, not just discussed |
| 24 | We have agreed what success looks like after 90 days. | A written target leadership agreed |
Your total out of 48 places you in one of three stages, and each stage has a specific next step. Read the total first, then the area scores, because a healthy total can hide one area that blocks every pilot.
| Score | Stage | Next step |
|---|---|---|
| 0 to 16 | Foundations first | Document key processes, clean up core data, write an AI use policy, and start with one low-risk tool |
| 17 to 32 | Ready to pilot | Pick one use case and run a pilot of 60 to 90 days with a baseline and weekly check-ins |
| 33 to 48 | Ready to scale | Connect AI to core systems, extend proven pilots to more teams, and review governance twice a year |
Treat any area scoring mostly zeros as a blocker, whatever your total says. A firm can score well on goals, systems and budget and still have no AI use policy and no idea which staff paste client details into public tools. That firm is not ready to pilot anything that touches client information, even if the scorecard total says otherwise.
Fix blockers in this order: privacy and security, then governance, then data. Those three decide whether a pilot can go live at all. The other areas decide how well it performs once it does.
A foundations score is not a failure. It means the groundwork that makes AI useful has not been done yet, and much of it is worth doing even without AI: written processes, cleaner records, fewer duplicate tools. Our walkthrough of how to map and automate a business process is a practical place to start.
While you build those foundations, pick one low-risk tool, such as an approved AI assistant for internal drafting that never sees client data. Staff learn under the new policy, and you learn what support they need before a real pilot.
Canadian privacy law already covers how your organization uses generative AI. Canada's federal, provincial and territorial privacy commissioners published principles for generative AI on December 7, 2023, and they apply to organizations using the tools, not only to the developers that build them.
The Office of the Privacy Commissioner of Canada states that while generative AI may pose novel privacy risks, these tools "do not occupy a space outside of current legislative frameworks." The principles address organizations developing, providing or using generative AI. In practice, the firm whose staff paste a client file into an AI assistant is in scope, not just the vendor.
The principles are:
Law firms, clinics and other regulated professions should also check their regulator's confidentiality rules before any client or patient information goes near an AI tool. Your regulator is the authority on what applies to your profession, so put that check into your vendor review (question 17).
This is why privacy and governance are scored questions in this assessment rather than an appendix. I came up through healthcare software, where privacy, audit trails and data quality decide whether a system can go live. We apply the same test to AI: questions 16 to 21 should hold before a pilot touches personal information.
Start with a repetitive task that has a clear owner and an outcome you can count. The examples below sit at the front door of each organization type: calls, bookings, intake and follow-up.
| Organization type | Example first use cases | Questions to check first |
|---|---|---|
| Law firms | Answering intake calls; first drafts of routine documents, with lawyer review | 16, 20 |
| Clinics | Booking, reminders, front-desk calls | 7, 16, 18 |
| Multi-location service businesses | Call answering, quote follow-up | 6, 10, 11 |
| B2B firms | Proposal first drafts, CRM data entry | 8, 9, 20 |
The third column matters as much as the second. An AI readiness assessment for law firms has to put privileged information and lawyer review ahead of speed. A clinic's booking automation depends on knowing where patient information lives and locking down access. A multi-location business needs clear handoffs and one owner for systems, or each location ends up configuring its own version.
An AI receptionist that answers and logs calls is often the fastest first win. Call volume and missed calls are easy to baseline, the task is clearly bounded, and every call lands in a system you can review.
Two of our law firm clients, CLG Injury Law and Costin & Associates, run an AI receptionist connected to their CRM that answers and logs calls around the clock. We also build custom automation for legal workflows such as case management. For a worked example from the region, see how mid-size Atlantic law firms use automation, and for the service itself, our AI receptionists and automation services.
Run it as one two-hour leadership session: everyone scores alone, you compare, then you rank use cases and choose one. Finish by defining a pilot with a baseline, a weekly review and a dated go or no-go decision.
This is the roadmap-first approach we use with clients. We map how work actually flows today, find where it waits or gets re-typed, decide what to automate first and what to leave alone, and turn that into a phased plan with a pilot, a baseline and a go or no-go point.
| Low effort | High effort | |
|---|---|---|
| High impact | Pilot first | Plan for a later phase |
| Low impact | Do it only if it is nearly free | Drop it |
| Step | Check |
|---|---|
| Book a two-hour leadership session | Everyone, including the systems owner, has accepted |
| Score alone first | Every sheet is complete before discussion |
| Compare and agree scores | One agreed score per statement and a total |
| List candidate use cases | Each has an owner and a measurable outcome |
| Rank on impact and effort | Every candidate sits in one quadrant |
| Pick one use case | One use case, one owner, one metric in writing |
| Record the baseline | Current figures captured with a date before launch |
| Set the pilot window | Start and end dates of 60 to 90 days in the calendar |
| Review weekly | Standing check-in held and notes kept |
| Decide go or no-go | Written decision to scale, adjust or stop |
Assessments fail when they become a formality before a purchase someone has already decided on. Watch for these five mistakes, each of which maps to questions in the scorecard.
Each fix is cheap compared with unwinding a rollout that went live without it. Score the five questions tied to these mistakes again at the end of your pilot to confirm they still hold.
An AI readiness assessment puts decisions in the right order. Score the 24 statements, read your stage, fix privacy and governance blockers first, then put one use case through a pilot with a baseline, weekly reviews and a go or no-go decision. Canadian privacy law already applies to how you use these tools, so treat the policy, the human review step and the named owner as part of readiness, not paperwork for later.
If your total says you are ready to pilot, or you would rather have the two-hour session run by the team that wrote these questions, we can turn your result into a phased roadmap with a pilot your leadership can judge on outcomes.
