What is an AI readiness assessment and does my company need one?
An AI readiness assessment is a structured review of whether your data, access permissions, security controls, policies and people are prepared for AI tools. It finds over-shared files, unmanaged AI use and missing governance before rollout, then ranks practical use cases. Any company about to license Copilot or ChatGPT broadly, or handling regulated data, should do one first.
Why readiness comes before licenses
AI assistants are only as safe as the environment they connect to. Microsoft states that Copilot surfaces any organizational data a user has at least view permission to. If years of casual sharing have left payroll, HR or research folders open to everyone, an AI assistant makes that exposure searchable in seconds.
A readiness assessment finds those problems while they are cheap to fix, and it gives leadership a clear view of where AI will actually save time.
What a good assessment covers
- Data and permissions: over-shared SharePoint, OneDrive and Teams content, stale guest access, and whether sensitivity labels exist.
- Identity and devices: multi-factor authentication, single sign-on for AI tools, and managed devices.
- Shadow AI: which AI tools employees already use, and on which accounts.
- Policy and governance: whether an acceptable-use policy and an accountable owner exist.
- Regulatory scope: health data, export-controlled or CUI data, and GxP records that need special handling.
- Use cases: a ranked list of workflows where AI saves real time, with the data each one needs.
What you get at the end
Expect a short findings report, a prioritized remediation list, a recommended tool choice and a pilot plan. Mapping findings to the four functions of the NIST AI Risk Management Framework (Govern, Map, Measure, Manage) gives the report a structure that boards and customers recognize.
The most valuable output is usually the permissions clean-up list. It protects you whether or not you ever deploy AI.
A good report also says what not to do yet. Some workflows depend on data that is too sensitive, too messy or too regulated for a first pilot, and naming them early stops enthusiastic teams from connecting AI to the wrong systems.
How long and what drives the effort
Effort scales with the number of users, how much content lives in Microsoft 365 or Google Workspace, how many systems hold regulated data, and whether you already have data classification. A small company with tidy permissions moves quickly; a company with years of open sharing and regulated data needs more remediation time than assessment time.
Cost follows the same drivers. Assessments are usually scoped as a fixed project, while remediation is priced by the work it uncovers, such as permission clean-up, labeling and identity changes. Ask any provider to separate the two so you can compare quotes fairly.
Common follow-up questions
Can we skip the assessment and just start a pilot?
You can pilot with a small group on low-risk data, but check permissions on anything the pilot can reach first. Pilots that connect AI to an unreviewed file estate are where most accidental exposure happens.
Is an AI readiness assessment the same as a security assessment?
It overlaps but is narrower in some places and wider in others. It focuses on data access, AI-specific vendor terms, governance and use cases, and it borrows the identity and device checks from a standard security review.
What framework should the assessment follow?
NIST's AI Risk Management Framework is the most common neutral reference and is voluntary. For generative AI specifically, NIST publishes AI 600-1, a Generative AI Profile released July 26, 2024, which lists risks to check.
LAN Service Group runs AI readiness assessments for small and mid-size businesses, covering Microsoft 365 permissions, identity, shadow AI, governance and regulated data, and then delivers the remediation and pilot.
Talk to LAN Service Group (888) 281-7243