AI readiness assessment

A structured check of how prepared an organization is to adopt AI safely and get value from it. This one asks 33 questions across 8 areas: strategy, data, security, people, governance, risk, regulatory compliance, and monitoring and incident response. Each answer maps to a maturity level, and the result shows where you are strongest, where you are weakest and what to do next.

Readiness asks whether you can adopt AI: strategy, data, skills and security. Governance maturity asks whether you control it: policy, accountability, risk management, compliance and monitoring. In practice they overlap, so this assessment scores both and reports them as separate areas.

Initial, Developing, Defined, Managed and Optimizing. The scale follows the five-level structure of the SEI Capability Maturity Model (1993), whose levels are Initial, Repeatable, Defined, Managed and Optimizing; we call level 2 Developing. Defined means documented practices that apply across the organization. Managed adds metrics. Optimizing adds continuous improvement driven by those metrics.

No. NIST AI RMF 1.0 is organized into four functions (GOVERN, MAP, MEASURE, MANAGE) with categories and subcategories, and it describes Current and Target Profiles rather than levels or tiers. This tool uses the subcategories as reference points for its questions, and a separate maturity scale for scoring. NIST says the July 2025 White House AI Action Plan tasked it with revising the framework, with no published timeline.

Each area’s level is the average of its answers, rounded down. The overall level is the average of the area averages, rounded down and capped at one level above your weakest area, so one strong area cannot hide a missing one. “Not sure” counts as level 1. You see an overall level once every area has at least one answer.

No, but it points the same way. Many questions cite ISO/IEC 42001 clauses or Annex A controls, such as the AI policy (clause 5.2), AI system impact assessment (6.1.4) and supplier controls (A.10.3). For a clause-by-clause gap analysis use our ISO/IEC 42001 checklist, and for certification you need an accredited certification body.

Article 4 requires providers and deployers of AI systems to take measures to support the AI literacy of their staff and others using AI on their behalf. The Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since July 27, 2026, softened the wording: organizations do not have to guarantee any specific level of literacy for each person. The duty itself remains.

There are 33 multiple-choice questions, with no sign-up and no email. Scoring runs in your browser, and your answers are saved only in your browser so you can come back later. Nothing is sent to us.

Start with the first few next steps: they target your lowest answers and the most foundational practices, such as an AI inventory, an AI policy and a named owner. Each step links to a free tool, guide or vendor list on this site. If you want outside help, compare AI governance consultants and audit firms.

Our suggestion is at least once a year and after major changes, such as a new AI use case, a new law or a serious incident. ISO/IEC 42001 asks top management to review the management system at planned intervals (clause 9.3).