Leadership and readiness
AI readiness assessment for mid-size companies: what it covers
By SourceX Editorial · Updated
Short answer
An AI readiness assessment for a mid-size company reviews five areas (strategy, data, systems, people and governance) and should produce a ranked list of use cases, gaps and owners rather than a slide deck. Most assessments skip one question worth adding: whether the company's records could be licensed to AI developers, which needs rights, privacy and inventory checks.
Key takeaways
- A useful AI readiness assessment covers strategy, data, systems, people and governance, and names an owner for every gap.
- The data area should test accessible history, linkage, export routes and retention settings, not just data quality.
- Internal adoption readiness and data licensing readiness ask different questions and need different checks.
- A first pass can run on interviews, admin consoles and metadata without moving any files.
- Be wary of proposals that recommend tools before anyone has inventoried the records.
What an AI readiness assessment is for#
An AI readiness assessment is for deciding where AI can help the business and what has to change first, in an order the company can actually execute. For a COO, the deliverable is a short list of decisions with owners, not a maturity score.
Mid-size companies sit in an awkward spot. They have enough systems and history for AI to matter, but rarely a dedicated data team, so the assessment has to be honest about effort. A good one respects that operations keep running while it happens and that department leads have day jobs.
The five areas a good assessment covers#
A good assessment covers five areas: strategy, data, systems, people and governance. Each area should end in something concrete the leadership team can approve or reject.
Ask the assessor to show sample outputs from each area before signing. If the examples are generic, the final report will be too.
| Area | What it examines | What it produces |
|---|---|---|
| Strategy | Business goals, pain points by department and where AI could change cost, speed or quality | A ranked list of use cases, each with a sponsor |
| Data | Which records exist, how far back they go, how they link and whether they can be exported | A record inventory with gaps and fixes |
| Systems | ERP, CRM, helpdesk, field service and collaboration tools, integrations and vendor AI features | A system map and a list of integration or vendor blockers |
| People | Skills, workload, appetite for change and who would own each use case | Named owners, training needs and a realistic capacity view |
| Governance | Policies on AI tool use, privacy, security, vendor terms and approvals | A short AI use policy and an approval path for new uses |
What the data area should check in an operating company#
The data area should check the records that run daily operations, how much accessible history they hold and whether they connect, because that is where most AI use cases succeed or stall. Data quality scores alone miss the bigger problems.
These checks need interviews and admin-console reviews, not data science. A COO can usually get first answers from department leads and the IT lead in ordinary working sessions.
- Systems of record by department: ERP, CRM, helpdesk, field service, WMS or TMS, QMS and project tools.
- Accessible history in each system, including anything lost in past migrations.
- Linkage: whether a request, a decision and an outcome share IDs across systems.
- Free-text fields: where people write notes and whether those notes are consistent enough to use.
- Retention and auto-delete settings that are quietly shortening history.
- Export routes: API, bulk export or database access, and any vendor limits on them.
The question most assessments skip: could your records be licensed?#
Most AI readiness assessments skip the question of whether the company's records could be licensed to AI developers, because they focus on adopting AI internally. The checks overlap, but licensing adds rights, privacy and buyer-fit questions that adoption work never asks.
Adding a licensing lens costs little when the inventory is already being built. It also prevents a common mistake: switching on a vendor AI feature whose terms allow training on company records, which can narrow licensing options later.
| Question | Internal adoption assessment | Data licensing readiness assessment |
|---|---|---|
| Main goal | Use AI inside the business | Decide whether records could be licensed to AI developers |
| Inventory focus | Data needed for the chosen use cases | Record families, accessible history, volume and format |
| Rights focus | Vendor terms for AI features | Customer contracts, vendor export terms, employee notices and confidentiality |
| Privacy focus | Access controls for internal tools | Exposure of personal details and how they would be removed |
| Output | A use case roadmap | A fit view by record family and a list of rights and privacy blockers |
How to run an assessment without stalling operations#
An assessment runs without stalling operations when it relies on interviews, admin-console reviews and metadata instead of data pulls. Files and samples come later, and only for use cases that survive the first pass.
Keep the interviews short and specific. Ask each department lead which decisions eat the most time, which records they open to make them and what they wish they could find faster. Those three answers produce better use cases than a general survey about interest in AI.
- Name an internal lead, usually the COO, and one contact per department.
- Interview department leads about their daily problems and the systems they rely on.
- Have IT list every system, its admin owner, its retention settings and its export options.
- Have counsel or a privacy lead list known contract, privacy and vendor-term constraints.
- Rank use cases and record families, then pick a small number to validate with real data.
- Review results with leadership and assign an owner and next step to each decision.
Red flags in an assessment proposal#
The clearest red flag in an assessment proposal is a tool recommendation that arrives before any inventory of records. The other warning signs are easy to spot once you know them, and most come down to outputs nobody can act on.
A strong proposal, by contrast, names the systems it will review, the people it will interview, the decisions it will ask leadership to make and who will own each follow-up once the assessor has gone.
- Deliverables described as insights or a maturity score, with no named decisions.
- Every department treated as one data lake, ignoring how records actually link.
- No review of vendor terms, customer contracts or privacy obligations.
- Fees tied to a follow-on implementation the assessor also expects to sell.
- No owner assigned to each gap, which means nothing changes after the readout.
Illustrative: a 3PL assesses its readiness#
Illustrative: a fictional third-party logistics provider runs warehouses on a WMS, plans freight in a TMS and closes the books in NetSuite. The COO commissions an AI readiness assessment after customers start asking for faster exception handling.
The data review finds years of exception records, such as short shipments, damaged goods and missed delivery appointments, each with free-text resolution notes and a link to the order. That supports an internal triage assistant. The licensing lens adds a caution: several shipper contracts restrict use of shipment data beyond providing services, so those records would need a rights review before any license discussion.
Leadership approves two tracks. Operations builds the internal assistant under existing contracts, while counsel reviews shipper agreements to see which exception records, if any, could be licensed in prepared form.
Where SourceX fits next to an AI readiness assessment#
SourceX fits on the licensing side of an AI readiness assessment rather than the internal-adoption side. Its guided intake asks about systems, record families, history and known restrictions, and the fit check collects metadata, not files.
Record families that look promising are reviewed against the SourceX Enterprise Data Value Framework and, if the company chooses to proceed, move through the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The company approves every step, and records are licensed rather than sold outright.
Frequently asked questions
Who should lead an AI readiness assessment in a mid-size company?
The COO is often the right lead because the assessment touches every department and ends in operating decisions. The CEO sponsors it, the CTO or IT lead owns the system and data review, and counsel or a privacy lead covers governance. Outside advisers can help, but an internal owner keeps it grounded.
Do we need outside consultants for an AI readiness assessment?
Not always. Many companies can run the first pass internally with a clear scope and the five areas above. Outside help is most useful for system reviews, vendor term analysis and comparing use cases with peers. If you hire help, insist on named deliverables and owners.
What should we prepare before the assessment starts?
A list of systems with admin owners, a current org chart, the main customer and vendor contract templates, any existing AI or acceptable-use policy and a list of known pain points by department. Having these ready shortens interviews and keeps the assessment focused on decisions.
How often should a company repeat the assessment?
Repeat it after events that change your records or systems, such as an acquisition, a major system migration or retirement, or a new AI policy. Between those events, a lighter periodic review of use cases, retention settings and vendor terms keeps the findings current.
Does the assessment require sharing data with the assessor?
Not at the start. Strategy, systems, people and governance can be assessed through interviews and documents, and the data area can begin with metadata such as system names, date ranges and record counts. Samples should be shared only later, under confidentiality terms, for specific use cases.
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.