AI readiness checklist: is your company ready for AI?

In short: AI readiness tells you whether your company has what it takes to use artificial intelligence with a measurable return. It is assessed across five areas: data, processes, skills, budget and governance. The checklist in this article gives you a score from 0 to 30, shows where to start before you buy any tool and helps you see which EU AI Act rules apply to your project.

Key takeaways

AI readiness depends on data, processes and people, not on the tool you pick.
One weak area out of five can be enough to stall a project.
According to Istat and Eurostat, lack of skills is the main barrier to AI adoption, in Italy and across the EU.
In Italy in 2025, 15.7% of SMEs used AI against 53.1% of large companies, and the gap is widening.
Since 2 February 2025 the EU AI Act has required companies using AI to build staff AI literacy.
Before a pilot, check which of the AI Act's four risk levels your project falls into: chatbots and recruitment tools have their own rules.
Below 11 out of 30, fix the basics first; from 11 to 20, run a pilot; above 20, you can scale.

Why AI readiness matters now

According to Istat, Italy's national statistics office, in 2025 16.4% of Italian companies with at least 10 employees used at least one AI technology, up from 8.2% in 2024 and 5.0% in 2023. Across the EU, Eurostat puts the 2025 figure at 19.95%.

Growth is uneven, though. In Italy, AI use doubled among SMEs too, from 7.7% to 15.7%, but among large companies it rose from 32.5% to 53.1%: according to Istat, the gap between the two groups grew from about 20 percentage points in 2023 to 37 in 2025. Across the EU in 2025, 17% of small companies, 30.36% of medium-sized ones and 55.03% of large ones used AI; among the possible explanations, Eurostat points to the complexity of implementing these technologies, economies of scale and costs. These are exactly the factors a readiness assessment helps you keep under control.

More telling are the companies that considered AI and stopped. Among Italian firms that looked at AI without adopting it, the barriers cited were lack of skills (58.6%), unclear legislation (47.3%), unavailable or poor-quality data (45.2%), privacy concerns (43.2%) and high costs (43.0%). The EU picture is similar: among companies that had considered AI, 70.89% named lack of relevant expertise as a reason for not using it.

Almost none of these barriers is technical: they are about data, people, rules and resources. An AI subscription takes five minutes to activate; without these foundations it mostly produces costs.

What is AI readiness, and how is it different from AI fitness?

AI readiness is the degree to which a company has enough data, processes, skills, financial resources and internal rules to introduce artificial intelligence and get a measurable result from it. AI fitness is used as a synonym and borrows a physical-training metaphor: like an athlete, buying the equipment is not enough, you need regular training.

The metaphor is apt: readiness is never achieved once and for all, so reassess every six to twelve months. Nor is it the same as digital maturity: a company can run an ERP, a CRM and an advanced online store and still be poorly prepared for AI, if its data sits in systems that do not talk to each other.

In practice, a good assessment checks that three things are aligned: the technology, the people who will use it and the company's goals. Without the first, the tool does not fit your existing systems; without the people, nobody uses it; without a goal, it solves a problem nobody had.

Where does AI add value in a company?

Mostly in marketing and sales and in administrative processes. According to Istat, among Italian companies using AI, 33.1% apply it to marketing and sales, 25.7% to organising administrative processes and 20.0% to research and development or innovation. The most used technologies are extracting information from text documents (70.8%), generative AI for text, images, video or audio (59.1%) and speech recognition (41.3%).

Across the EU, according to Eurostat, 48.18% of retail companies using AI apply it to marketing or sales; in manufacturing the figure is 30.41%, followed by the organisation of business administration processes (27.05%).

Translated into typical use cases for an online store or a B2B company:

E-commerce: product descriptions and translations generated from a catalogue with complete attributes, an assistant answering questions on orders, delivery and returns, on-site search that understands customer queries.
B2B: a CRM that suggests to sales reps which customer to contact next or which offer fits best, draft quotes, data extraction from orders, tender specifications and delivery notes.
Both: summarising and routing support requests, classifying incoming email, analysing sales data for forecasts and reorders.

Every use case rests on at least one of the five checklist areas: CRM sales suggestions, for example, only work if customer and quote history is complete and up to date. More examples in the articles on AI in retail and e-commerce and on generative AI for business.

Which five areas should you assess?

Data, processes, skills, budget and governance. The table sums up the question to ask for each area, the sign of readiness and an example for an online store and for a B2B company.

Area	Key question	Sign of readiness	E-commerce example	B2B example
Data	Is the data you need collected, clean and accessible?	One reliable source for customers, products and orders	Catalogue with complete attributes and order history linked to the CRM	Customer records without duplicates and quote history in the CRM
Processes	Is the process you want to improve written down and measured?	Documented steps, known times and volumes	Returns handling with known average times	Quote workflow from request to delivery
Skills	Do the people who will use AI know how, and can they check its output?	An internal owner and recorded training	Support team able to correct the assistant's answers	Sales team able to judge an AI lead classification
Budget	Are there resources for upfront and recurring costs?	Estimated total cost and a payback target	Platform integration and API usage	ERP and CRM integration and internal testing hours
Governance	Are rules, responsibilities and risks clear?	Usage policy, an owner, privacy check	Rules on which customer data may go into an AI tool	Human approval before a generated quote is sent

For governance there is a free reference: the NIST AI Risk Management Framework, released in 2023 for voluntary use, organises AI risk management into four functions (govern, map, measure, manage). More in the article on scaling AI governance from pilot to production.

AI readiness checklist: how do you calculate your score?

For each statement, give 0 points if it is not true, 1 if it is partly true, 2 if it is fully true. Each area is worth up to 6 points, for a total of 30. Answer with one specific process in mind: the fifteen statements can be discussed in a single meeting.

Data

Customers, products and orders (or quotes) live in connected systems, not in separate spreadsheets.
Every key data set has a clear owner, and duplicates are cleaned up regularly.
Data can be exported or read via API, and your privacy notice covers the intended use.

Processes

The target process is described step by step, including who does what.
You know its current times, volumes and error rates, in other words its baseline.
The process is repetitive and frequent enough to justify the effort.

Skills

There is an internal owner with time set aside for the project.
Users of the tool have basic, recorded training on AI and its typical errors.
The team already uses the CRM, ERP or e-commerce platform consistently.

Budget

You have estimated the total cost: licences, API usage, integration, internal hours, maintenance.
There is a dedicated budget for at least a three-month pilot.
You have set a financial target and a date to check it.

Governance

There is a written rule on which AI tools may be used and which data must never be entered.
It is clear who approves AI output before it reaches a customer or supplier.
Whoever handles privacy has reviewed vendors, data transfers and legal bases.

How should you read your score?

The total tells you which stage you are in; the score per area tells you what to fix first.

Score	Level	What to do
0-10	Foundations needed	No AI on core processes yet. Clean up data, document one process and write a usage policy; keep generative AI for low-risk individual tasks.
11-20	Ready for a pilot	Pick one process, measure the baseline and run an 8-12 week pilot with KPIs set in advance.
21-30	Ready to scale	Extend to other processes, integrate AI with your CRM, ERP or store, and formalise regular reviews.

One rule beats the total: any area at 2 out of 6 or less is your priority. With 22 points but 1 in data, the pilot will stall on data.

Are there official tools to assess digital maturity?

Yes, and they complement this checklist: they measure a company's overall digital maturity, while the checklist measures readiness for one specific AI project. For a company in the EU, and in Italy in particular, there are two public references.

The European Commission's Digital Maturity Assessment. Launched in 2024 with the network of European Digital Innovation Hubs (EDIHs), it is open to all companies and freely available in 32 languages. It assesses six criteria: digital business strategy, digital readiness, digital skills improvement, data management, automation and intelligence, and green digitalisation. After the test, your local EDIH can give tailored advice.

Selfi4.0 and Zoom4.0 from Italy's Punti Impresa Digitale. The digital business points run by Italian Chambers of Commerce offer Selfi4.0, an online questionnaire you fill in on your own that returns a short digital maturity report, and Zoom4.0, a guided assessment based on interviews with staff and management, run by the chamber's Digital Promoter.

The table shows where the six EU criteria fit into the checklist in this article.

Digital Maturity Assessment criterion	Where it appears in the checklist
Digital business strategy	Budget (financial target and review date) and Processes (choosing a process with a visible cost)
Digital readiness	Data (connected systems, API access) and Skills (consistent use of CRM, ERP or platform)
Digital skills improvement	Skills (internal owner, recorded training)
Data management	Data (quality, owners, duplicates) and Governance (privacy and vendors)
Automation and intelligence	It is what the pilot is about: the checklist tells you whether and where to start
Green digitalisation	Not covered: outside the scope of readiness for a single AI project

A sensible order is to use a public tool first for the big picture, then this checklist on the chosen process, which leads straight to a decision: fix the basics, run a pilot or scale.

What does the EU AI Act require on skills?

Training, not certificates. Article 4 of the AI Act requires providers and deployers of AI systems, including companies using third-party tools, to take measures for the AI literacy of the staff involved. According to the European Commission, the obligation has applied since 2 February 2025, and national authorities have enforced it since 2 August 2026.

Following the Digital Omnibus amendments, in force since mid-July 2026, the obligation remains but no specific "sufficient" level is mandated. No certificate is needed: an internal training record is enough to document it, which is the "recorded training" item in the checklist.

Which AI Act risk level does your project fall into?

For most business uses, minimal risk, which carries no specific obligations. The AI Act defines four risk levels, and placing your project in the right one before the pilot saves you from discovering obligations halfway through. The examples in the table are those given by the European Commission.

Level	Examples	What it means
Unacceptable risk	Harmful manipulation, social scoring, emotion recognition in the workplace	Banned. Eight prohibited practices have applied since February 2025, the ninth from December 2026.
High risk	CV-sorting software for recruitment, credit scoring for access to a loan, safety components of products	From 2 December 2027, strict obligations: risk management, data quality, traceability, documentation, human oversight.
Transparency risk	Chatbots, AI-generated content, deepfakes	People must know they are interacting with a machine, and some content must be labelled. Rules in force since August 2026.
Minimal or no risk	Spam filters, AI-enabled video games	No specific AI Act rules; the staff AI literacy obligation still applies.

For an online store, a customer-facing assistant falls under transparency risk: customers must know they are talking to an automated system. For a B2B company the sensitive area is usually HR, because software that filters CVs is high risk; more in the article on AI in HR and compliance automation. For unclear cases, the Commission runs the AI Act Service Desk.

What changes for an online store and for a B2B company?

The areas that tend to be weak are different. Two hypothetical scenarios, with illustrative numbers:

E-commerce. A homeware store with 3,000 products wants an AI assistant to answer questions on stock, delivery and returns. It scores 17, but data sits at 2 out of 6: product pages are incomplete and order status is updated by hand. Before the assistant, it needs a complete catalogue and a link between the platform (Shopify or WooCommerce) and shipping, or the assistant will confidently give wrong answers. It also needs a notice telling customers they are talking to an automated system.

B2B. A 40-person component manufacturer wants AI-generated draft quotes. It scores 21, but governance is at 2: nobody checks prices and terms before sending, and some sales reps paste confidential customer data into free chatbots. A usage policy and human approval come first, the pilot second. On AI value inside real operations, see the article on enterprise AI and agentic AI in ERP systems.

How to apply it in your company: first steps

List the AI tools already in use, including free ones people have signed up for on their own: overlapping subscriptions and company data in the wrong places often turn up.
Fill in the checklist with three people: management, whoever runs your systems, whoever runs the process. Gaps between scores are telling.
Pick a process with a visible cost and high frequency: customer support, lead qualification, product content, quotes. See the article on business process automation.
Place the project in its AI Act risk level: if it touches recruitment or talks to customers, the obligations go into the plan from day one.
Bring the weakest area to at least 4 out of 6 before the pilot, with an owner and a deadline for each missing item. If skills are the weak spot, draw up a training plan for the people who will use the tool and record it.
Set 3-5 KPIs with a baseline measured over at least four weeks. The method is explained in the article on how to measure AI ROI.
Repeat the assessment at the end of the pilot and then every six months.

If budget is the weak spot, check incentives in the article on Italian grants for digitalisation and AI. More articles are in the AI for business section, and the systems I build to connect data, processes and AI are described in my solutions.

How can you tell whether readiness is improving?

With a few indicators, tracked at every new assessment:

Score per area, not just the total: the weakest area must go up.
Share of trained staff among people using AI tools, taken from the training record.
Processes documented with a baseline: how many are ready for a pilot.
Real adoption: how many people actually use the tool introduced by the pilot, and how often, after the first three months.
Pilot results against the baseline: time, errors, costs or sales, according to the KPIs set at the start.
Link to business goals: every active AI project has a financial target and an owner.
Time from idea to pilot: if it gets shorter, the company is adapting faster.

Mistakes to avoid

Starting from the tool. You end up looking for a problem to justify what you have already paid for.
Piling up tools without an inventory. Overlapping subscriptions, scattered data and nobody who knows what is actually used.
Assessing yourself alone. Management overrates data and skills; the people doing the work see the gaps.
Looking only at the total. A high score with one area at 1 out of 6 is a project that will stall right there.
Ignoring the risk level. A CV filter or a customer-facing chatbot carries obligations that an internal automation does not.
Forgetting recurring costs. API usage, maintenance and human review add up every month.

Frequently asked questions (FAQ)

What is AI readiness?

AI readiness is a company's ability to use artificial intelligence with a measurable result. It is assessed across five areas: data, processes, skills, budget and governance. It tells you whether to start a pilot or fix the basics first.

What is the difference between AI readiness and AI fitness?

None in substance: AI fitness is a synonym borrowing the physical-fitness metaphor, which stresses that readiness must be maintained with regular check-ups.

How long does it take to get a company ready for AI?

It depends on the weakest area. Writing a usage policy or training the team usually takes weeks, while cleaning up data spread across several systems can take months.

Do you need a big budget to start with AI?

No, but you need a complete one. A pilot on a single process can be inexpensive, as long as licences, API usage, integration, internal hours and maintenance are all counted. The real risk is underestimating recurring costs.

Does the EU AI Act require companies to train staff who use AI?

In substance, yes. Article 4 of the AI Act, applicable since 2 February 2025, requires companies that use AI systems to take measures for the AI literacy of the staff involved. No certificate is needed: according to the European Commission, an internal record of training is enough to document it.

Are there free tools to assess digital maturity?

Yes. The European Commission's Digital Maturity Assessment is open to all companies and freely available in 32 languages; in Italy, the Chambers of Commerce's Punti Impresa Digitale offer the Selfi4.0 online questionnaire and the guided Zoom4.0 assessment. They measure overall digital maturity: for a single AI project, add a checklist on the chosen process.

Is an e-commerce chatbot a high-risk AI system?

Usually not: it falls under transparency risk. Since August 2026, people must be told they are interacting with a machine. High-risk systems include, among others, software that sorts CVs for recruitment or assesses access to credit.

Sources

To run this assessment with someone who knows the systems to connect, book a free diagnosis.