Readiness is a sequencing decision
A maturity score can describe the organisation. Readiness must guide action. It should connect enterprise foundations to specific use cases so leaders can decide what starts now, what needs dependency work and what should wait.
That makes readiness a portfolio and sequencing discipline, not simply an assessment exercise.
Foundation 1 — Data
Assess availability, quality, ownership, lineage, access, privacy constraints and whether the data required for priority use cases is actually usable. Perfect enterprise data is not required; sufficient data for the intended use case is.
Foundation 2 — Leadership
Look for executive sponsorship, agreed business outcomes, decision ownership, investment logic and clarity on which functions are accountable for value. AI programmes struggle when everyone supports AI but nobody owns the result.
Foundation 3 — Systems
Assess architecture, integrations, security, deployment pathways, model access, operational resilience and the ability to move from pilot to production without creating unmanaged dependencies.
Foundation 4 — People
Examine business capability, technical capability, process ownership, change readiness, workflow redesign and whether users know where human judgement remains essential.
Foundation 5 — Governance
Assess privacy, security, model risk, human oversight, accountability, approval rules, monitoring and escalation. Governance should enable responsible scale, not arrive after scale has already happened.
Foundation 6 — Existing AI footprint
Map current pilots, embedded vendor AI, approved tools, shadow AI, contracts and production use cases. Enterprises often have more AI than leadership realises, which changes both risk and sequencing decisions.
Turn the six foundations into waves
Score readiness against the use-case portfolio. High-value use cases with strong foundations may become Wave 1. High-value use cases with significant gaps may require foundation work before Wave 2. Low-value or poorly governed ideas may belong on an explicit Do-Not-Start list.
The output should be a sequenced roadmap, not a longer backlog.