AI Readiness Assessment: How to Score It Honestly and Plan a Roadmap

Commission an AI readiness assessment only when you can name the decision it has to support. A useful one scores five areas from evidence (data, people, process, governance and technology), applies them to each candidate use case, not to the organisation as a whole, and turns the result into a ranked list and a 12 to 24 month roadmap. If you cannot yet name one workflow that AI should change, skip the assessment for now and start with that workflow.

Do you need an AI readiness assessment yet?

An assessment pays off when it settles a real choice: where to spend a limited budget, which department goes first, or what to tell a board that wants a plan. Without one, it tends to produce a maturity number nobody acts on.

We recommend starting with one workflow instead of a broad assessment when the organisation has no AI in daily use at all. A single measured workflow teaches you more about your data, approvals and people than a questionnaire, and gives a later assessment real evidence. The trade-off is reach: one workflow will not tell you where the next five should come from, so plan the assessment for after the first result. Our ENABLE Sprint follows this route with one team and one to three real workflows.

What should an AI readiness assessment measure?

The five dimensions overlap with the SDAIA framework, which divides the same ground differently. The Saudi Data & AI Authority (SDAIA) AI Adoption Framework (version 2, May 2025) groups adoption into directions (strategy and governance), enablers (data, infrastructure and human capacity) and outcomes (applications and impact). SDAIA calls it a guidance framework and says it sets no detailed technical standards, though it files it among its regulatory documents. It is not a law; laws it cites, such as the Personal Data Protection Law, still apply. The May 2025 text also says SDAIA's National Center for AI is developing a maturity index for AI adoption in government entities; Saudi government bodies should check whether it has been published before fixing their own scoring.

• Data: can the use case get the data it needs, with permission, at a quality you have checked on a real sample? For Arabic work this includes scanned documents, mixed Arabic and English text and dialect in customer messages.
• People: is there a named business owner with time set aside, a group of users willing to test, and a sponsor who will clear blockers?
• Process: is the workflow written down as it runs today, with a baseline (current time, volume and error rate) to compare against and a clear point where a person checks the AI output?
• Governance: are the tools approved, is there an AI use policy, who approves a new use case, and have data protection and sector rules been checked for this data? Include tools staff already use without approval (see our guide to finding and governing shadow AI).
• Technology: do users sign in securely to an approved platform, can it reach the source systems, are use and outputs logged, and is there budget for running costs?

Legal obligations depend on the country, the sector and the data involved. This guide is general information, not legal advice; confirm what applies with counsel.

The AI readiness scorecard

Score each dimension from 0 to 3 for each use case. The levels describe evidence, not opinion, so two scorers working separately tend to land close together.

Six rules that keep the score honest

1. Evidence for every 2 or 3: a document, a log, a screen or a demonstration. An interview answer alone earns at most a 1.
2. Unknown counts as 0 until someone checks it.
3. Use the lowest dimension, not the average. A use case with excellent technology and no usable data is not ready; averaging hides the blocker.
4. Score per use case first. An organisation can be ready for drafting internal emails and not ready for credit decisions.
5. Add a second scorer from outside the sponsoring team, and record disagreements instead of splitting the difference.
6. Write the next step for every score: what would move it up one level, who owns that work and by when. These lines become the roadmap.

How do you turn the score into a ranked use-case list?

Readiness alone does not rank use cases: a ready use case that saves little stays low on the list. Score value separately from 1 to 5 (time saved, errors or risk reduced, service improved) using the process baseline, and note how risky the data and the decision are. The core of the NIST AI Risk Management Framework (AI RMF 1.0, January 2023) is voluntary, but its Map function covers both sides: MAP 3.1 calls for potential benefits to be examined and documented, and MAP 3.2 does the same for potential costs, including non-monetary costs from AI errors.

• Wave 1, start now: value 4 or 5, every dimension at 2 or above, and risk you can control with the approvals you already have.
• Wave 2, fix first: value 3 or above, but one or two dimensions at 1; ready use cases with value 3 also wait here. The gap work goes on the roadmap with an owner.
• Park: any dimension at 0, or a high-risk decision with no human review designed yet.
• Drop: value 1 or 2, whatever the readiness.

What should a 12 to 24 month AI roadmap contain?

The SDAIA framework recommends linking each initiative to measurable indicators, reviewing initiatives every quarter, and preparing a timeline that covers planning, launch, expansion and evaluation, with responsibilities and resources for each stage. A shape that follows that advice:

1. Months 0 to 3: put minimum governance in place (approved tools, a named approver and an AI acceptable use policy), and start Wave 1 with a recorded baseline.
2. Months 3 to 9: measure Wave 1 against its baseline, extend what works across the department, and close the gaps that hold Wave 2 back.
3. Months 9 to 18: build Wave 2, and decide who owns AI across the organisation once several use cases run at the same time.
4. Months 18 to 24: re-score every dimension, retire use cases that missed their indicators and choose the next set.

Put a stop rule beside each item: the indicator, the date and what happens on a miss. A roadmap without stop rules tends to keep funding pilots that never reach daily work.

Two illustrative examples from Jordan and the Gulf

A family-owned retailer in Amman (illustrative). It has about 150 staff, a finance team that spends days each month matching supplier invoices to delivery notes, and no AI in daily use. A full assessment would mostly record zeros. We would start with the invoice workflow instead: record how long matching takes today, test an approved tool on a month of redacted invoices and measure the result. That first workflow fills in the data, process and technology scores with real evidence; a lighter assessment can follow later.

A regional insurer in Riyadh (illustrative). Five departments have each asked for AI budget, customer records hold personal data, and the board wants a two-year plan. Here the assessment earns its cost. Scoring per use case puts Arabic email sorting in Wave 1, holds tender drafting back for a data clean-up and parks fraud scoring until an approval route for automated decisions exists.

How to start

If you need a ranked list and an investment case, our AI Readiness & Workflow Diagnostic is a fixed-scope diagnostic that scores maturity, ranks use cases and ends in an investment case and a 12 to 24 month roadmap. The AI strategy page explains when that route fits. If you are not sure which route applies, book the free AI Exposure Scan, a 45-minute conversation that ends in a written next step. More on the Governance Lab page.

Related lab: Governance Lab ↗