AI Readiness Assessment for Small and Mid-Sized Businesses
A practical AI readiness assessment for small businesses. 5-pillar framework with a 20-question scorecard, plus what to fix first if your stack isn't ready.
Key takeaways
58% of US small businesses now use generative AI, up from 40% a year earlier,1 but 44.7% of midsize businesses say their data is scattered across tools with no clear owner2
44.1% of midsize businesses don’t measure whether their AI is working at all, so they can’t tell which pilots are worth scaling2
For a small business, AI readiness is a structural problem you can audit in an afternoon. No strategy deck required, and no governance theater either
The 5 pillars worth measuring are Data, Integrations, Process, Tools, and People. The scorecard below turns each into 4 questions, about three minutes in all
Scoring 70 or higher (with every pillar at three-quarters of its weight or more) means you can start delegating bounded work to AI agents. Below that, fix the foundation first. An AI tool layered on a broken stack scales your existing problems faster than you can catch them
An agent that handles refunds over the weekend or drafts proposals overnight is one fewer queue your team has to clear by Monday.
The catch is that agents multiply whatever they sit on. A competent agent on clean data multiplies what your team can ship. The same agent on broken data multiplies the mistakes that reach your customers.
Take a composite case. A 30-person ecommerce company spends $30,000 on an AI demand-forecasting tool. Six months later, the team has quietly stopped using it. The recommendations were wrong often enough to break trust, and the founder can’t tell the board where the budget went.
That $30k is roughly a quarter of an operations hire’s annual salary. It’s gone, and the underlying problem is still there: an inventory system that doesn’t actually know what’s sitting in the warehouse.
The same trap catches a 20-person consultancy whose AI notetaker syncs Zoom summaries into a CRM that already has the same client filed under four contact records. The notes scatter across all four. The partners stop opening them within a month. The seat licenses renew anyway.
That’s the pattern that decides whether AI pays off at a small business or just burns budget. The cause is rarely the model. It’s almost always the data and systems underneath.
An AI readiness assessment, run before either purchase, would have caught both.
If you’re reading this and quietly wondering which of those two companies is yours, that’s the right question to be asking before your next software renewal.
The good news is that for a 20-to-200 person company, AI readiness is something you can check in an afternoon. This post gives you a five-pillar framework and a 20-question scorecard, with a band to act on and next steps for wherever you land.
The scorecard takes three minutes. Checking your answers honestly takes the afternoon. If you only want your score, skip straight to the scorecard.
What an AI readiness assessment actually measures
An AI readiness assessment (also called an AI readiness audit, checklist, or framework) is a structured look at the systems your AI plans will actually run on: the data, the integrations, the workflows, and the people who own them. It’s different from an AI strategy engagement, which sits a layer above and decides which use cases are worth pursuing.
The major enterprise frameworks (Microsoft, Cisco, Gartner, RSM) are built for organizations with hundreds of employees, dedicated AI committees, and Azure tenants. For a 20-person company that’s overhead you don’t need, and a committee that would mostly be you.
The framework below drops the enterprise scaffolding (“Model Management”, “AI Governance Committees”) and goes after the actual SMB failure mode instead: an AI tool sitting on top of systems that don’t talk to each other, with nobody watching when they quietly stop.
The 5-pillar SMB AI readiness assessment framework
The endpoint of AI readiness in 2026 is delegation. Can you hand a workflow to an agent and trust it to act on your systems for you, with a way to roll back when it gets something wrong?
Chatbots and copilots are the training wheels. Agents are the bike. The five pillars below are what let you take the training wheels off without landing on your face. Each one maps to a specific way SMB AI pilots fail.
Pillar 1: Data
Your data needs to be current and consistent before an agent can act on it. AI has no idea how your business works. It acts on whatever data you point it at.
Bad data costs more once the AI stops answering and starts doing. A chatbot retrieving the wrong fact is an annoyance. An agent acting on the wrong record is a refund issued to the wrong customer.
Try this: ask your CRM how many active customers you have, then ask your invoicing tool. If the numbers don’t match, your agent will happily use whichever one it finds first.
Say your CRM calls a customer “John Smith”, your invoicing tool has them as “J. Smith Ltd”, and your support desk has them as ticket #4471 with no name attached. No agent can reconcile that on the fly.
The fix is boring. For customers and for whatever you sell, your team agrees which system is the master, and the others copy from it.
Skip that, and John Smith is three different customers to an agent. It’ll update one of them and never mention the other two.
Databases grow barnacles whether anyone’s watching or not. Duplicates pile up. Archived contacts get treated as live ones because nobody marked them inactive.
Let an agent loose on that and every stale record turns into a real action: an email to an archived contact, a renewal nudge to a customer who churned a year ago.
Then there’s the monthly report. If pulling last month’s numbers into one place means exporting from five tools and stitching the spreadsheets together by hand, somebody on your team is doing that assembly every month. We call that human middleware.
An agent hits the same wall, except there’s nobody to do the stitching for it. The moment it needs a cross-system picture (which orders are actually at risk, which client is genuinely overdue), it either acts on a partial view or stops cold.
SAS and IDC’s 2026 survey of 1,600 midsize businesses found 44.7% describe their data as scattered across tools with no clear owner. Only 11.8% say theirs is well organized and accessible for AI use.2
Research on larger companies points the same way. Gartner predicts that through 2026, organizations will abandon 60% of AI projects that aren’t supported by AI-ready data. Its survey of 248 data management leaders found 63% either don’t have or aren’t sure they have the right data practices for AI.3 A later Gartner survey of 782 infrastructure and operations leaders found that among those who’d hit setbacks, 38% named poor data quality or limited data availability as a direct cause of AI project failure.4
Forget the data lake. Data that’s consistent and current is enough for an agent to act on safely.
Pillar 2: Integrations
Integrations are the pipes between your systems. When one leaks, the agent downstream can’t tell, and a quiet failure turns into a fast, confident error.
First, check the pipes exist at all. In plenty of small businesses, the pipe is a person with two tabs open. The average mid-sized business now runs 50 to 70 SaaS applications,5 and 38% of SMB knowledge workers name copying data between platforms as their most time-consuming repetitive task.6
A Zapier or Make workflow is often the right first integration. The limits show up at three predictable points: volume that exceeds task quotas, errors with no retry path, and any flow critical enough that a silent failure breaks something downstream. We covered the trade-off in a separate piece on the limits of low-code integrations.
When a sync fails this morning, do you hear about it before a customer complains, or from the complaint? For most small businesses, it’s the complaint. The integration layer runs invisibly until it stops, and then it stays invisible for a few hours more.
When the alert does fire, does it tell you which record failed and why, or just that something broke? A generic “Zap failed” email leaves you investigating. Compare it with this:
Invoice INV-2291 didn’t sync to Xero. The client record in HubSpot has no billing email.
That one you can fix before your coffee goes cold.
Without that kind of detail, AI errors that start in stale or missing data are very hard to trace back to the integration that fed them.
Pipeline monitoring catches the loud failures (runaway cost, a broken sync) but not slow drift on edge cases, so monitoring an agent also means reading a sample of what it produces. The EU AI Act’s Article 26 (delayed to December 2027) makes the same point in law, putting monitoring duties for high-risk systems on the deployer rather than the vendor.7
And somebody has to own the pipes: one person, internal or external, who can answer “is the integration between A and B healthy right now?” without investigating first. In a small business that’s usually the integration partner, or the operations director who wired the systems together in the first place. If nobody owns it, the first alert you get is the customer email.
Pillar 3: Process
AI can automate a workflow that exists as a clear, repeatable process. It can’t automate one that lives in someone’s head and changes depending on who’s handling it that day.
If a new hire can’t run your fulfillment or onboarding process end to end from a written document, what you have is folklore. It lives with whoever’s been there longest, and no AI rollout can read your team lead’s mind.
The same task also needs to get done the same way whoever’s handling it. If Sarah refunds a damaged item on the spot and Tom waits for a photo, that’s two refund policies. An agent will end up following one of them, and nobody will have decided which.
We’ve lived this one. On a GPS-locked field service app we built, the on-device photo check is only reliable because every photo arrives with a GPS lock and a visit ID already attached, whoever took it.
Then there are the exceptions every real workflow collects. They either get logged somewhere the whole team can see, or they live in the head of whoever handled them last.
Say your fulfillment or client-onboarding process has a few that only Sarah knows about: upgrading shipping for VIP-flagged accounts, billing one grandfathered client at last year’s day rate. AI won’t discover those rules. It’ll run the standard path and leave you the angry emails the next morning.
Before AI touches a workflow, you need to know in numbers what it costs today, such as the hours it eats each week and how often it goes wrong. Without that before-number, nobody can say whether the AI made things better, and the six-month review comes down to opinion. In the same SAS and IDC survey, 44.1% don’t measure the impact of their AI at all.2
With an agent, there’s one more question: can you undo what it just did? A process is agent-ready only when the irreversible actions (a sent email, a posted invoice) are kept out of the agent’s reach, and the reversible ones have a documented rollback that doesn’t need an engineer.
Pillar 4: Tools
This is the pillar most small businesses underweight, because each tool usually gets picked for one department’s reasons rather than for how it fits the rest of the stack.
Every new tool means more pipes, and every pipe is one more thing that can leak. Two CRMs competing for the same customer data recreate the Pillar 1 problem one level up. We covered the wider sprawl problem in our piece on SaaS sprawl and how many tools is too many.
Portability is the one that bites later. Could you export your full history from your main tools today, without extra fees or outside help? A platform that keeps your data behind paid exports or proprietary formats caps what any future AI project can do, because an agent can’t use data it can’t reach.
The riskiest tools are the ones nobody picked.
Picture a marketing manager summarizing client contracts in a personal ChatGPT account, and a salesperson pasting prospect lists into a free Claude tier to draft outreach. That’s shadow AI (staff using AI tools the company never approved), and it’s how company data quietly leaves the building.
Nobody’s being malicious. They’re trying to get through their inbox.
If you haven’t checked which AI tools your team is actually using with company data in the last 12 months, that’s an unmeasured risk sitting under every other pillar. The fix is one or two approved AI tools (with the right data terms), made easier to reach for than a personal login.
Then tell your team, in writing, which company data can go into which AI tools. The first line practically writes itself:
Client contracts never go into a personal ChatGPT account.
Writing it forces the vendor check too, because you can’t approve a tool until you know whether it trains on your prompts and outputs. On business plans the answer is usually no. On free and personal ones it’s usually yes, and the toggle is buried.
One page is plenty. Nobody reads the 40-page version.
Pillar 5: People
At SMB scale, AI needs four named owners. Don’t panic: that’s four jobs, and they usually land on one or two people you already employ.
Someone has to own the workflow itself. That’s one named person accountable for the workflow you point AI at, with a clear number that tells them whether it’s paying back.
“Everyone in operations” behaves like nobody. “AI will help productivity” isn’t a number. The owner decides when AI output goes live or gets pulled, and answers for it.
Someone else has to check the output. AI failure at SMB scale is sneaky. The typical one is a perfectly plausible answer that routes an order to the wrong supplier, or files a meeting summary under the wrong client because the CRM has two contacts with the same surname. The checker is the person who can spot that in three seconds, because they know what right looks like.
Leadership owns the bandwidth question. The unglamorous data cleaning and integration work before any AI rollout costs real team hours, and someone senior has to clear that time rather than assume it’ll fit around everyone’s day job.
In the SAS and IDC survey, 33.9% of midsize businesses say their employees don’t have the time or capacity to learn new tools, and 38.6% point to leaders who aren’t engaged and don’t explain the plan.2 Both sit with leadership. Neither is solved by hiring an AI specialist.
And scope is the one everybody forgets. Your team needs to have agreed, in writing, which tasks an agent can run on its own, which need a human to approve each action, and which stay human-only.
Without that, scope creep is silent and constant. The tool brought in to draft email replies starts answering customer questions. The one meant to suggest invoice categories starts approving them. For agents, the same agreement names who holds the off switch and how much each agent is allowed to spend.
The good news: you already employ everyone this pillar needs. The bad news: they’re busy. A team running flat out today won’t have the headspace to check AI properly. They’ll rubber-stamp the output, and that’s how AI mistakes reach your customers.
The 20-question AI readiness checklist and scorecard
Score yourself across all five pillars below. Twenty yes-or-no questions, about three minutes, weighted out of 100. The ones that wreck a deployment when missed (data consistency, monitoring, a human who can catch a wrong output, agreed autonomy boundaries) count for more.
You can score the whole business in one go, or one workflow at a time. One workflow is usually more useful. A business with a messy CRM and a clean order pipeline is ready for AI in one place and not the other, and a single overall score hides that.
To score a workflow, pick the one you’d hand to AI first and answer every question for that workflow only. Then hit Reset and try the next.
One rule: if a statement is only partly true (synced between two systems out of three, written down but a year out of date), mark it no. Partial readiness behaves like no readiness once AI is layered on top.
Answer Yes or No for each statement.
How to choose an AI readiness assessment provider
If you bring in outside help, the market is uneven. The big consultancies (Deloitte, EY, Accenture) build for enterprise budgets. At the cheap end, the “assessment” is often a sales pitch in a lab coat. Six questions will tell you which kind you’re looking at (and yes, ask us all six too).
- Is the framework public, with cited methodology? You should be able to verify the sources, even if the provider layers their own scoring on top. Opaque proprietary frameworks make the recommendations hard to audit later.
- What’s the deliverable? A score on its own doesn’t tell you what to do on Monday. You want a prioritized roadmap with rough costs and clear next steps, in writing.
- Fixed fee or hourly? SMBs need predictable costs. A fixed-fee engagement scoped against a written brief is fairer than an hourly one that can drift.
- Who actually does the work? A senior engineer or operations practitioner reading your stack is worth more than a junior consultant with a templated questionnaire.
- What happens after? Some providers hand off and disappear; others use the assessment as the front end of an open-ended consulting engagement. The honest version: stay involved if asked, stand back if not.
- Will they show you a redacted past assessment? A good provider can share what an output actually looks like without breaking confidentiality.
This is what our Integration Audit is built to do: a written diagnosis with a costed roadmap at a fixed fee. We also wrote separately about why small businesses often need an integration partner for the work that comes after.
What to do after your assessment
The right next step depends on the score and on which pillars are weakest.
Your total sets the band, but your weakest pillar caps it, because an agent inherits whichever foundation is missing. A table with one short leg wobbles, however good the other legs are. So a high total with one broken pillar still reads as foundation phase, and that’s the honest signal.
If you landed in foundation phase (under 35, or one pillar dragged you here): Something in the foundation is the bottleneck, usually data or integrations. The forecasting company from the opening would have landed here, with Data and Integrations alone sinking it.
Pick the one revenue-critical workflow that hurts most today (order to fulfillment, or quote to invoice) and fix it properly, connections included, before adding AI. We wrote up an AI-powered Xero and Linnworks workflow that cut Royal Mail compensation claims from 20 minutes to about two. It only works because the data pipeline underneath is clean. Start there.
If you landed in assistive-AI ready (35 to 69, or one pillar held you here): Deploy assistive AI (chatbots, copilots, suggest-and-approve patterns) on the highest-scoring workflow that touches revenue, with a human reviewing the output. Hold off on handing work to an agent until the lower-scoring pillars catch up, or the agent inherits the gaps you haven’t fixed yet. Run the second pilot only once the first beats the before-number you took at the start.
If you landed in agent-ready (70 or higher, with every pillar at three-quarters of its weight or more): You can start delegating bounded work to agents that act on your systems, not just running assistive AI with human review. The hard question shifts from “are we ready” to “which workflow can an agent own end-to-end safely”.
For each candidate, name what the agent can do without approval, what needs human approval per action, and what stays human-only. Make sure each agent has scoped credentials, an audit trail per action, a documented rollback path, an enforced budget cap, and a named owner who can stop it within minutes.
Pick the workflows with the cleanest data and the loudest complaints. Keep monitoring in place so a misbehaving agent shows up as an alert within the hour, not on next month’s bill.
One limit worth saying out loud. The framework catches the structural gaps that most often stall SMB AI projects. It doesn’t cover the compliance rules specific to your industry, or every quirk of the workflow you point AI at first. Those need a case-by-case look.
The view behind all this is in our manifesto. When systems don’t talk, people end up carrying the data between them. AI just makes the cost of that human middleware visible faster, because an agent has nobody to lean over and ask.
Frequently Asked Questions: AI Readiness Assessment
- What is an AI readiness assessment?
- An AI readiness assessment is a structured look at whether your data, systems, processes, tools, and team can support AI tools reliably. It measures the operational systems your AI plans will actually run on. It's different from an AI strategy engagement, which decides which use cases are worth pursuing.
- How do I assess if my business is ready for AI?
- Run the 20-question scorecard in this post, for the whole business or one workflow at a time. It measures your business across five pillars (Data, Integrations, Process, Tools, People), weights questions by severity out of 100, and bands the result: under 35 means fix the foundation first, 35 to 69 means you can run assistive AI on one workflow, 70 or higher means you can start delegating bounded work to agents. Any single weak pillar caps the band regardless of the total, so a high score with one broken pillar still reads as foundation phase.
- How long does an AI readiness assessment take for a small business?
- The self-scorecard in this post takes about three minutes. A more detailed external assessment for a 20 to 200 person business typically runs 1 to 3 weeks (interviews, stack walkthrough, written deliverable). Anything longer is usually overscoped.
- Do I need to hire a consultant or can I do this myself?
- You can run the self-scorecard yourself. External help is worth paying for when you want an outside view on priorities, a written deliverable for the board, or when the internal team is too close to the systems to assess them honestly.
- How much does an AI readiness assessment cost?
- Self-assessment costs nothing beyond your time. Our own Integration Audit is a fixed fee that depends on stack complexity, runs 1 to 3 weeks, and includes a costed roadmap.
- What is the difference between an AI readiness assessment and an AI strategy?
- Readiness measures whether the foundation can support AI. Strategy decides which use cases are worth pursuing. The two meet in the middle, because readiness is always readiness for something. That's why the scorecard works best one workflow at a time. What goes wrong is strategy with no readiness check: you pick a use case that looks good on paper, then discover the data underneath can't support it.
- Can I skip the assessment and go straight to AI tools?
- You can, and plenty of businesses do. The risk is spending $30,000 on a tool the team quietly abandons six months in, because the data underneath wasn't clean enough to act on. Three minutes with the scorecard is cheap insurance against that.
- How often should I redo my AI readiness assessment?
- Once a year is usually enough at SMB scale, unless you go through a stack-changing event (a platform migration, a major acquisition, a tooling overhaul). Re-run after any of those.
- My score is low. What should I fix first?
- Your lowest pillar tells you what's broken, and the workflow that touches the most revenue tells you where to fix it first. Inside that workflow, start with the Process. Once it's written down and done the same way every time, it tells you which Tools you need, and the Data and Integrations work follows. In practice, many SMBs pick Tools first and shape Process around them.
SaaS Glue fixes the workflows your team carries by hand, including the connections between the systems underneath them. If you’d rather not run the diagnosis alone, our Integration Audit does the same work for a fixed fee. Drop us a line with a short note about your stack, and we’ll tell you honestly whether we’re the right fit.
References
1 US Chamber of Commerce, Empowering Small Business: The Impact of Technology on US Small Business (August 2025). Nationwide survey of US small businesses conducted by Teneo Research for the Chamber Technology Engagement Center. Available at: https://www.uschamber.com/technology/empowering-small-business-the-impact-of-technology-on-u-s-small-business
2 IDC for SAS, AI for SMBs: Closing the Readiness-Reality Gap (May 2026). Methodology: survey of 1,600 SMB leaders in 28 countries, November to December 2025, at organizations with 100 to 499 employees (100 to 999 in the US). Available at: https://www.sas.com/content/dam/sasdam/documents/20260302/ai-for-smbs-closing-the-readiness-reality-gap-full-report.pdf
3 Gartner, Lack of AI-Ready Data Puts AI Projects at Risk (press release, February 2025). Methodology: Q3 2024 survey of 248 data management leaders. Available at: https://www.gartner.com/en/newsroom/press-releases/2025-02-26-lack-of-ai-ready-data-puts-ai-projects-at-risk
4 Gartner, AI Projects in I&O Stall Ahead of Meaningful ROI Returns (press release, April 2026). Methodology: survey of 782 infrastructure and operations leaders, November to December 2025. Available at: https://www.gartner.com/en/newsroom/press-releases/2026-04-07-gartner-says-artificial-intelligence-projects-in-infrastructure-and-operations-stall-ahead-of-meaningful-roi-returns
5 Productiv / Zylo SaaS Management Index, aggregated in CloudZero and Sellers Commerce 2025 SaaS reports. Methodology: aggregated SaaS spend telemetry from thousands of customer environments. Available at: https://www.cloudzero.com/blog/saas-statistics/
6 Zapier, The 2021 State of Business Automation (April 2021). Methodology: online survey of 2,000 US knowledge workers at small and mid-sized businesses (fewer than 250 employees), fielded March 2021. Manual data entry (copying and pasting between platforms, databases, documents, or systems) was the most-cited category of repetitive work at 38%. Available at: https://zapier.com/blog/state-of-business-automation-2021/
7 European Union, AI Act, Article 26 (Obligations of Deployers of High-Risk AI Systems) (2024). Establishes deployer duties for human oversight, automated event logging with a minimum six-month retention window, and monitoring of high-risk AI systems. The Digital Omnibus on AI (adopted June 2026) moved the application date for stand-alone high-risk systems from 2 August 2026 to 2 December 2027, and to 2 August 2028 for AI built into regulated products. Available at: https://artificialintelligenceact.eu/article/26/ and https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-omnibus-vii-deadline-delay-20260/
