The Mid-Market AI Readiness Checklist (25 Points)

AI readiness is not a feeling — it's a checkable state across five areas: whether your data is usable, your systems are integrable, your people are prepared, your processes are documented, and your governance exists before you need it. This checklist scores all five in about fifteen minutes.

Each point below is one sentence plus a "how to verify" line, so a non-technical reader can actually run this checklist against their own organization without a consultant in the room — that's deliberate; it doubles as a usable pre-check before our free AI readiness benchmark.

Data readiness (5 points)

1. Your core systems export data via API, not just CSV. Verify: ask IT whether your ERP/CRM has a documented, callable API — not a nightly export job.
2. Customer and transaction records use consistent identifiers across systems. Verify: pick one customer, trace their ID through three systems — same ID, or three different ones?
3. You know where your source-of-truth data lives for your top three processes. Verify: ask two people from different teams the same question; do they name the same system?
4. Historical data exists to establish a "before" baseline. Verify: can you pull 90 days of volume/cost data for the process you'd automate first?
5. Sensitive data is classified, not just "handled carefully." Verify: is there a written data-classification policy, or is it tribal knowledge?

Systems readiness (5 points)

1. Your core business systems have modern APIs (REST/GraphQL), not just a UI. Verify: check the vendor's developer docs — does one exist?
2. You have a sandbox or staging environment for at least one core system. Verify: ask "can we test against this without touching production?"
3. Single sign-on or a service-account pattern exists for machine access. Verify: is there a way to grant an automated system scoped access without sharing a human's login?
4. Your systems can be monitored — logs and error states are visible somewhere. Verify: if a nightly job failed last night, would anyone find out before a customer complained?
5. No critical process depends on a system with no vendor support or update path. Verify: is there a system nobody wants to touch because "nobody knows how it works anymore"?

People readiness (5 points)

1. There's an executive sponsor who will show up to the kickoff and the week-4 review, not just approve the invoice. Verify: name them right now — if you can't, that's the answer.
2. The team closest to the process being automated is included from week one, not told after the fact. Verify: has anyone on that team been asked a question yet?
3. At least one person owns "AI/automation" as part of their job, even informally. Verify: if a vendor called about a new automation, who would they be routed to?
4. Your team has realistic expectations — "augment," not "replace everyone by Q3." Verify: ask three people what they think this project will do; compare answers.
5. There's budget and time allocated for training the team that will operate the system, not just building it. Verify: is there a line item, or is training assumed to happen "somehow"?

Process readiness (5 points)

1. The target process is actually documented — a real process map, not tribal knowledge. Verify: ask for the document. Does it exist and is it current?
2. You can state the process's current cost and cycle time in numbers. Verify: "how long does this take" and "what does it cost" — can anyone answer both?
3. Exceptions and edge cases are known and roughly quantified, not just "sometimes weird stuff happens." Verify: what percentage of cases are exceptions? If nobody knows, that's a gap.
4. The process has a clear definition of "done" / success. Verify: what does a correctly completed instance of this process look like, written down?
5. There's an existing escalation path for when this process goes wrong today. Verify: if this process fails right now, who finds out and what do they do?

Governance readiness (5 points)

1. Someone has thought about what an automated system should NOT be allowed to do unsupervised. Verify: is there any written boundary, even a short one?
2. You have a plan for auditing what an AI system did, after the fact. Verify: if asked "why did the system do X," could you answer from logs?
3. You know which regulations (data residency, industry-specific rules) apply to this process. Verify: has anyone in legal/compliance been asked?
4. There's a rollback plan if the automation needs to be paused or reversed. Verify: could you turn it off cleanly tomorrow if you needed to?
5. Vendor/model risk has been considered — what happens if a vendor changes pricing or shuts down a model. Verify: is there a fallback, or is this a single point of failure?

Scoring rubric — what does your score actually mean?

| Score | Band | What to do next | |---|---|---| | 0–8 | Not yet ready | Fix foundational data/process gaps before any agentic pilot — an automation built on undocumented processes will just automate the confusion. | | 9–17 | Conditionally ready | Pick ONE well-scoped process where you scored strongest and pilot there; use the pilot to close remaining gaps. | | 18–25 | Ready | You're a strong candidate for a structured pilot-to-scale program now — the gaps that remain are refinements, not blockers. |

This checklist is deliberately the content backbone of our free AI readiness benchmark — the benchmark scores you against this exact framework in about ten minutes and gives you category-level feedback instead of just a single number. If your score points to real gaps, our AI readiness assessment is the expert-led, two-week version of this same exercise.