Most organizations know they are behind. Very few can say precisely what they are behind on, which makes it hard to invest deliberately.

This scores you across twelve dimensions — policy, security review, data, deployment, integration, evaluation, ownership, cost, inventory, and regulatory mapping — and places you on the stage your weakest load-bearing dimensions actually support.

Answer honestly rather than aspirationally. A flattering result is worth nothing to you.

01 / 12

How do people in your organization use AI tools today?

1Personal accounts, no policy — we know it happens 2A few sanctioned pilots are running 3Approved tools, with a published policy 4An approved platform, inside real workflows 5A governed platform with usage visibility

Is there an AI acceptable use policy?

1No 2In draft 3Published 4Published and technically enforced 5Published, enforced, and reviewed on a cycle

Is there a defined security review path for AI systems?

1No — and it has already blocked something 2Ad hoc, handled case by case 3A defined process exists 4Defined, including AI-specific threat modeling 5Security enters at design, with standing controls

Do you have AI in production with real users?

1No 2Pilots and demos only 3One system live 4Several live in core workflows 5A managed portfolio on shared infrastructure

Is the data AI would need accessible, structured, and permissioned?

1We do not know 2Scattered, and permissions are unclear 3Identified, but work is needed 4Accessible with entitlements modeled 5Maintained pipelines with measured quality

Where does inference run?

1We are not certain 2Public API, no formal review 3Approved API with a DPA, or private cloud 4Private or on-premise for sensitive workloads 5Deliberate routing by data classification

Do AI systems connect to your systems of record?

1No 2Read-only, users copy results out manually 3Reads from one system 4Reads and writes to systems of record 5Integrated across the estate, with reconciliation

How do you know the output is good enough?

1We do not measure it 2Demonstrations and anecdote 3Manual spot checks 4An evaluation set with agreed thresholds 5Continuous evaluation in production, with alerting

Who owns an AI system after it launches?

1Nobody in particular 2The project team, informally 3A named owner 4An owner with runbooks and on-call 5A platform team with service levels

Can you say what AI costs you, and where?

1No 2Total invoice only 3By vendor 4By team or use case 5Per use case, with anomaly alerting

Do you have an inventory of AI systems and their risk classification?

1No 2An informal list someone keeps 3A spreadsheet inventory 4An inventory with risk classification 5Maintained, with audit evidence attached

Are your AI regulatory obligations mapped to controls?

1Not considered yet 2Aware of them, not mapped 3Mapped for one framework 4Mapped, with controls assigned to owners 5Evidence collected continuously

Press 1–5 to choose · ← → to move

Your result

Where you are

Get the full breakdown

Your score across all twelve dimensions, your three weakest, and what specifically to do about each — plus the recommended next step for your stage.

Name *

Work email *

Organization *

Industry *

Role *

One-time — we send the breakdown, not a newsletter. We do not sell, share, or broker contact information. Protected by reCAPTCHA (privacy, terms).

Want this done properly?

The AI Readiness Assessment goes considerably further: your data, infrastructure, security constraints, and candidate use cases evaluated in depth, delivered as a prioritized roadmap with a recommended architecture — and it is yours whether or not you engage us to build it.

Request an AI Readiness Assessment Discuss Your AI Roadmap

Direct response from an engineer. Typically within one business day.

Stage	What it looks like	Blocker to the next stage
0 Shadow	AI is already in use through personal accounts, without policy or visibility.	A policy and a sanctioned alternative — banning without providing does not work.
1 Experimental	Sanctioned pilots are running.	An architecture and security position that lets something actually ship.
2 Governed	Policy exists, an approved platform exists, security has a review path, and at least one system is live.	Integration depth — AI sitting adjacent to work rather than inside it.
3 Integrated	AI is inside core workflows, integrated with systems of record, and measured against business outcomes.	Operational maturity — evaluation, lifecycle, and cost attribution at portfolio scale.
4 Operated	A managed platform, portfolio governance, continuous evaluation, cost attribution, and a defined lifecycle.	—

Where is your organization, actually?

Where you are

Get the full breakdown

Five stages

Want this done properly?