AI readiness assessment for portfolio companies: what to score

What should an AI readiness assessment score?#

An AI readiness assessment should score whether a portfolio company's records and permissions can support AI work, because tools are easy to buy and usable records are not. Ten criteria cover the ground: four about the records, three about rights and privacy, and three about the company's capacity to act.

Each criterion uses a 0 to 3 scale. Zero means absent or unknown, one means partial, two means adequate with known gaps, and three means strong and evidenced. Keep the scale coarse on purpose: finer scales invite debate without changing any decision, and a value creation lead needs comparable answers across companies, not precision within one.

The ten-criterion scorecard#

The ten-criterion scorecard describes the two ends of each scale so assessors can place a company between them. Scores of one and two fall in between: some evidence, with gaps that are named in the notes column of your working sheet.

How to score consistently across companies#

Consistent scoring matters more than precise scoring, because the point is to compare companies and track change over the hold. The rules below keep scores honest when several people assess several companies, and they make the scorecard defensible when a portfolio CEO disagrees with a number.

• 1Score from evidence such as a system list, a contract review or a test export; opinions score as unknown.
• 2Score unknowns as zero until evidence arrives.
• 3Use the same assessor, or hold a short calibration session, across companies.
• 4Record the evidence and the date beside each score.
• 5Rescore after any system migration, acquisition or material contract change.

Where readiness scores usually go wrong#

Readiness scores usually go wrong in the same few ways, and nearly all of them inflate the total. Check for each one before a scorecard reaches an investment committee or a board pack, because an inflated score sends a company into a fit check or pilot it cannot finish.

• 1Counting company age as accessible history when a past migration dropped most of the records.
• 2Scoring connected systems from an integration diagram rather than from a shared ID that actually appears in the records.
• 3Treating a website privacy policy as evidence of privacy maturity.
• 4Scoring rights clarity from current terms while older versions still govern most of the archive.
• 5Letting company leadership score itself without attaching evidence.

Score bands and the next action for each#

Score bands turn a total into a next action, which is what makes the assessment useful in a portfolio review. Treat 20 out of 30 as a working pass threshold and adjust it once several companies have been scored.

Two gates override the total. A zero on rights clarity or on privacy maturity means no external licensing work starts until that criterion reaches at least two, even if the company scores well everywhere else. Internal pilots can still proceed under the company's own controls.

Internal AI readiness vs licensing readiness#

Internal AI readiness and licensing readiness draw on the same ten criteria but lean on different ones. An internal project such as quote support or ticket triage depends most on connected systems, export capability and a named owner. Licensing records to AI developers depends most on accessible history, record linkage, rights clarity and privacy maturity.

That difference explains why a company can be ready for one and not the other. A business with modern connected systems but little surviving history may suit internal pilots and not licensing, while a company with a deep archive in a retired system may be the reverse. Report both readings rather than a single verdict.

Illustrative: scoring two portfolio companies#

Illustrative: a value creation lead scores two fictional companies. The first, an electrical contractor on ServiceTitan, scores well on connected systems, linkage and export, because estimates, jobs, invoices and callbacks share job numbers. It scores zero on privacy maturity: no one has mapped where homeowner details sit across job notes, photos and call recordings.

The second, a B2B billing software vendor, scores high on history and linkage across Jira, GitHub and Zendesk, and its customer contracts were reviewed during a recent refinancing. Its weak point is export capability, since no one has pulled full Zendesk history with attachments.

The contractor clears the working threshold, but the privacy gate holds licensing back, so its next action is a data map. The software vendor moves to a metadata-only fit check while IT tests a full export.

How SourceX looks at the same questions#

The SourceX Enterprise Data Value Framework covers the licensing side of this scorecard. It is a qualitative SourceX methodology whose drivers include rights, recency, scale, data cleanliness and AI utility, with preparation cost and privacy burden reducing net value, so low scores on rights clarity or privacy maturity show up there too. A company that scores well can start with a fit check that collects metadata only, so nothing leaves the company.

If the company proceeds, the SourceX five-step transaction, Supply, Rights, Preparation, Approval and Delivery, turns the scorecard's gaps into specific tasks, and the SourceX Evidence Packet records how each one was resolved.