Assess Your Organization in 7 Dimensions, Act on the Gaps
TL;DR:
This framework scores your AI readiness across 7 dimensions on a 1–5 maturity scale. You get a scoring template, a heatmap approach, and a 90-day action plan. The 2026 update adds standards-aware evidence: risk classification, ownership, controls, evals, and review cadence. The goal is to know where you are, decide where you need to be, and close the gaps that actually matter for your business.
The five-dimension readiness model still works — but “tool adoption” alone is no longer enough. Teams must score data governance, human review loops, and agent oversight alongside pilot success stories.
What we updated for 2026
Still true in 2026
Compare live tools anytime in our tool explorer.
This guide: AI readiness
A practical maturity framework for teams adopting AI responsibly.
Learn first (we do not repeat this here)
Go deeper after this course
October 2026 update: readiness now means standards-ready evidence
Treat the score as a management system input, not a vanity metric. Strong teams can map each AI use case to risk ownership, data lineage, evaluations, controls, incidents, and review cadence.
Reference baselines: NIST AI RMF, NIST Generative AI Profile, ISO/IEC 42001, and EU AI Omnibus.
This framework is for founders, CTOs, product leaders, and department heads who need to make informed decisions about AI adoption — not just pick tools, but build the organizational capability to use them well. It's also useful for consultants and advisors who need a structured assessment they can run with clients.
Founders & CEOs
CTOs & Tech Leads
Product Leaders
Consultants & Advisors
You do not need to certify against every framework before starting AI work. You do need a readiness model that can produce the same evidence mature frameworks ask for: governance, risk mapping, measurements, controls, and continuous improvement.
NIST AI RMF
Use Govern, Map, Measure, and Manage as the evidence loop behind your scores. Generative AI adds checks for provenance, pre-deployment testing, incidents, and misuse risk.
Primary sourceISO/IEC 42001
Treat readiness as an AI management system: policies, owners, objectives, processes, risk treatment, monitoring, and continual improvement.
Primary sourceEU AI Act + Omnibus
Classify use cases early. High-risk timelines shifted, but inventories, ownership, transparency, and risk evidence should be built before deadlines arrive.
Primary sourceEach dimension gets a score from 1 (Ad hoc) to 5 (AI-Native). The goal is to understand where you stand, where you need to be for your specific context, and which gaps are blocking progress. For regulated or high-impact use cases, collect evidence that can survive an audit: owner, risk class, data lineage, controls, eval results, approvals, incidents, and review dates.
Strategy & value — 2026 depth note
Without ROI hypotheses and executive ownership, pilots stay toys.
Clear AI vision aligned with business OKRs, prioritized use cases with ROI hypotheses, executive ownership and budget.
Data & governance — 2026 depth note
AI quality ceiling is your data floor — lineage and access control are prerequisites.
Data quality, accessibility, documentation. Data governance (owners, lineage, retention), privacy impact, provenance, and compliance with GDPR, AI Act, and sector rules.
Technology — 2026 depth note
API-first infra and LLMOps separate pilots from production.
Cloud + API-first infrastructure. MLOps / LLMOps (monitoring, rollback, versioning), evaluation harnesses, fallback paths, and security posture for AI workloads.
People & skills — 2026 depth note
Literacy across the org beats a lone hero team.
Role-based AI literacy across business, not just tech. In-house AI/ML/LLM engineering capability. Product managers who can own AI outcomes and safe-use boundaries.
Processes — 2026 depth note
Ideation → experiment → deploy → monitor must be repeatable.
Repeatable pipeline: ideation → risk triage → experiment → deploy → monitor. Integrated change management, training, vendor management, and build-vs-buy criteria.
Governance & ethics — 2026 depth note
RACI, risk registers, and human-in-the-loop policies scale trust.
AI governance board / RACI. Risk registers, impact assessments, model cards, incident logs, NIST AI RMF practices, ISO/IEC 42001 controls, and human oversight policies.
Adoption & scale — 2026 depth note
Usage in core workflows matters more than POC decks.
Actual usage of AI features in core workflows. Measurement of business impact (KPIs moved). Ability to scale successful patterns across teams.
Maturity levels — 2026 depth note
Level 5 isn’t mandatory — intentional maturity for your size and risk is.
Apply this same scale to each of the 7 dimensions. Most organizations are not at the same level across all dimensions — and that's expected. The heatmap of scores is more useful than a single average.
Experiments in silos, no clear strategy, no governance.
Some pilots, basic data/infra, informal ownership.
Documented strategy, governance basics, 2–3 use cases in production.
Shared platform, MLOps in place, AI embedded in key processes.
AI is core to products/operations, continuous optimization, measurable value, incident learning, and strong governance.
Important
Maturity levels are timeless; the tooling is not
For each dimension, rate 1–5 and capture evidence. Be honest — the value of this exercise is in the gaps it reveals, not in a high score.
Evidence:
Gaps:
Actions (next 90 days):
Overall AI Readiness Score
Average of all 7 dimension scores. Useful as a headline metric, but the dimension-level detail is where the action is.
Heatmap View
Plot all 7 dimensions on a radar chart or color-coded grid. Strengths and weaknesses become immediately visible.
AI READINESS ASSESSMENT — [Organization Name] — [Date]
Use case / portfolio scope: [team, product, or company-wide]
Business owner: [name / role]
Technical owner: [name / role]
Risk class: [minimal / limited / high-risk / prohibited / unknown]
Primary evidence folder: [link]
═══════════════════════════════════════════
DIMENSION 1: STRATEGY & VALUE
Score: ___ / 5
Evidence:
-
-
Gaps:
-
-
Actions (next 90 days):
-
-
═══════════════════════════════════════════
DIMENSION 2: DATA & GOVERNANCE
Score: ___ / 5
Evidence:
-
-
Gaps:
-
-
Actions (next 90 days):
-
-
═══════════════════════════════════════════
DIMENSION 3: TECHNOLOGY & ARCHITECTURE
Score: ___ / 5
Evidence:
-
-
Gaps:
-
-
Actions (next 90 days):
-
-
═══════════════════════════════════════════
DIMENSION 4: PEOPLE & SKILLS
Score: ___ / 5
Evidence:
-
-
Gaps:
-
-
Actions (next 90 days):
-
-
═══════════════════════════════════════════
DIMENSION 5: PROCESSES & OPERATING MODEL
Score: ___ / 5
Evidence:
-
-
Gaps:
-
-
Actions (next 90 days):
-
-
═══════════════════════════════════════════
DIMENSION 6: GOVERNANCE, RISK & ETHICS
Score: ___ / 5
Evidence:
-
-
Gaps:
-
-
Actions (next 90 days):
-
-
═══════════════════════════════════════════
DIMENSION 7: ADOPTION & SCALE
Score: ___ / 5
Evidence:
-
-
Gaps:
-
-
Actions (next 90 days):
-
-
═══════════════════════════════════════════
OVERALL SCORE: ___ / 5 (average)
STANDARDS / COMPLIANCE FOLLOW-UP:
- NIST AI RMF evidence gaps:
- ISO/IEC 42001 management-system gaps:
- EU AI Act / GDPR / sector-rule follow-up:
TOP 3 PRIORITIES (weakest dimensions):
1.
2.
3.
NEXT REVIEW DATE: [set 6 months from now]To turn this framework into a working assessment, follow these six steps. The first pass can be completed in a single afternoon with the right people in the room; evidence collection can continue afterward.
7 dimensions × 5 questions each (Likert 1–5). Use the questions from each dimension above, or adapt them to your context.
Before scoring maturity, tag each AI initiative by business owner, data sensitivity, EU AI Act risk class, user impact, and whether a human decision point exists.
Include leadership, tech leads, and 1–2 individual contributors per area. Different perspectives reveal blind spots.
Average scores per dimension, build a heatmap. Where do leadership and ICs disagree? That's where the real gaps are.
Define concrete 90-day actions for each. Don't try to fix everything at once — focus on the dimensions that are blocking your most important AI initiatives.
AI readiness is not a one-time assessment. As you scale AI usage, your needs change. Re-assess regularly to stay intentional.
Buying tools before defining use cases. You end up with expensive infrastructure and no clear business impact. Strategy & Value must come before Technology & Architecture.
A beautiful AI roadmap that nobody can execute. If your People & Skills score is 1 and your Strategy score is 4, the strategy is fiction.
Running 10 AI experiments that never graduate to production. If Adoption & Scale is consistently low, your operating model likely lacks a clear experiment → pilot → scale pipeline.
Deploying AI in production and then asking about ethics, compliance, and risk. Governance should be part of the pipeline from day one, not a checkbox after launch.
Most vendor assessments are designed to surface gaps that their product solves. This framework is tool-agnostic — it assesses organizational capability, not product fit. The output is a prioritized action plan, not a purchase recommendation.
That's normal for organizations early in their AI journey. Start with Strategy & Value (define clear use cases) and People & Skills (build basic AI literacy). Don't invest in infrastructure until you know what you're building and who will build it.
No. Level 5 (“AI-Native”) is appropriate for companies where AI is core to the product or business model. A 50-person SaaS company might aim for Level 3–4 in most dimensions. The right target depends on your context, not on an abstract ideal.
Every 6 months is a good cadence. AI capabilities and organizational needs change fast. A semi-annual review keeps your strategy intentional and prevents drift.
Yes, as a readiness layer. It does not replace a legal assessment, certification audit, or formal risk management program, but it creates the inventory, ownership, evidence, and gap list those programs need. Use it before formal compliance work so teams know which controls and documents already exist.
Yes, but calibrate your expectations. A startup doesn't need formal governance boards or enterprise MLOps. Focus on Strategy & Value (are you building the right thing?), Data & Governance (is your data clean enough?), and People & Skills (can your team execute?). The other dimensions become important as you scale.
Tools that can support your AI adoption journey — from analytics to automation.
AI research, productivity, and conversation—smarter thinking, deeper insights.
Clear answers from reliable sources, powered by AI.
Your trusted AI collaborator for coding, research, productivity, and enterprise challenges
The AI that actually does things.
Open-source workflow automation with native AI
The world’s most accurate AI translator
Once your organization is ready, structure the prompts that drive AI tool effectiveness.
Start LearningComplete this quiz to test your understanding of AI readiness assessment and organizational maturity.
Loading quiz...
AI readiness is not about tools — it's about organizational capability across strategy, data, technology, people, processes, governance, adoption, and evidence that can support risk management.
Use the 7-dimension, 5-level framework to score where you are, map high-impact use cases to risk classes, identify the gaps that matter most, and define concrete 90-day actions for your weakest dimensions.
The right maturity level depends on your context. Re-assess every 6 months, focus on 2–3 priorities at a time, and remember: the value is in the conversation the scores start, not in the scores themselves.
Know these before you go further.
AI can be confidently wrong. Models fabricate facts, invent citations, and state incorrect figures without any signal that they're guessing — a phenomenon called hallucination. Real case: AI tools have cited non-existent academic papers that look entirely plausible.
What this means for you
Always verify AI-generated facts, statistics, and sources before sharing or publishing them. Treat AI output as a first draft, not a finished product.
AI models learn from human-generated data — and inherit the biases embedded in it. Amazon's internal hiring algorithm, for example, was found to systematically penalize resumes containing the word 'women's'. Image generators routinely reinforce demographic stereotypes.
What this means for you
Question who is represented in the AI's training data. Test outputs across different groups, roles, and regions before deploying AI in hiring, healthcare, or customer-facing contexts.
Anything you type into a public AI tool may be stored, logged, reviewed by staff, or used to train future models — depending on the provider's policy. Many enterprise data breaches in 2024–2025 originated from employees pasting confidential information into AI chat interfaces.
What this means for you
Never enter client names, passwords, health data, financial records, or proprietary source code into public AI tools. Ask yourself: 'Would I be comfortable if this appeared on the internet?'
Research from Springer Nature (2024) shows that over-reliance on AI dialogue systems gradually degrades users' own reasoning and writing abilities. When AI handles all your first drafts, the skill atrophies — just as GPS use has measurably reduced people's spatial memory.
What this means for you
Use AI as an assistant, not a replacement for your judgment. Regularly challenge yourself to draft, decide, or solve without AI first — then use AI to refine.
AI-generated content may reproduce copyrighted text, images, or code without attribution. Legal rulings on AI and copyright are still evolving in the US, EU, and UK — and the rules differ significantly by country and use case.
What this means for you
For commercial use, check your AI provider's content policy on IP ownership. Disclose AI involvement where your industry, employer, or platform requires it.