A Practical AI Readiness Checklist for Small Businesses

Score each statement 0, 1 or 2: zero means no; one means partly or informally; two means yes with evidence. The maximum score is 50. Complete the checklist for one use case, not “AI across the business.”

Process and value

1. We can name the exact task and its trigger.
2. We know current volume, cycle time and error/rework rate.
3. We know who receives and uses the output.
4. We can explain why AI is preferable to a form, rule or ordinary workflow.
5. The expected benefit is large enough to measure.

Data and examples

1. We have representative normal and edge-case examples.
2. Required fields are available and sufficiently consistent.
3. We know which inputs contain personal, confidential or regulated information.
4. We have authority to use the information for this purpose.
5. Retention, deletion and export requirements are understood.

Ownership and workflow

1. One business owner is accountable for the outcome.
2. A knowledgeable employee can test output quality.
3. Exceptions have a named destination.
4. The human approval point is explicit.
5. We can operate temporarily if the AI or vendor is unavailable.

Privacy, security and risk

1. Vendor data-use and model-training terms have been reviewed.
2. Access uses named accounts, least privilege and strong authentication.
3. Sensitive information is removed or minimized where possible.
4. We have considered inaccurate, biased or harmful outputs.
5. An incident or material error has an escalation path.

Testing and change

1. Acceptance criteria are written before configuration.
2. A test set includes ordinary, edge and deliberately poor inputs.
3. We can run beside the current process before replacing it.
4. Staff affected by the change will participate in testing and training.
5. There is a stop, rollback and post-pilot review decision.

Interpret the score

Worked example: customer email triage

An illustrative 14-person GTA service company scores 37. It has a measurable inbox backlog, a clear service coordinator and good historical emails. It loses points because customer messages include addresses and account details, vendor terms have not been reviewed, and nobody has defined how low-confidence cases will be handled.

The right next move is not launch. It is to remove unnecessary fields, review the vendor arrangement, create confidence thresholds, route exceptions and assemble a labeled test set. Those actions may take a week and dramatically improve the quality of the pilot.

NIST organizes AI risk work around govern, map, measure and manage. Canada's privacy commissioners emphasize necessity, proportionality, transparency, data minimization and meaningful safeguards. The checklist translates those principles into small-business operating questions; it does not replace a privacy impact assessment or legal review.

Readiness is evidence, not enthusiasm

A company becomes pilot-ready when it can show a stable process owner, a usable baseline, accessible data, defined exceptions and a person authorized to stop the workflow. A team saying “we use ChatGPT all the time” is not evidence of operational readiness. A clean sample of 100 historical cases with known outcomes is.

Do not scale a decision you cannot defend

Naval Ravikant describes leverage as a force multiplier for judgment. That is useful and dangerous. If the business cannot explain why a request receives a particular category, priority or response, AI can distribute the inconsistency faster and more confidently.

Classify the data before selecting the tool

Separate public, internal, confidential and highly restricted information. Identify personal information, financial records, employee data, customer contracts and regulated material. Then determine what may enter a vendor system, where it is stored, how long it remains and how it can be deleted. The pilot should use the least sensitive data capable of proving the workflow.

A practical readiness gate

Missing one required item does not mean the company is “bad at AI.” It identifies the preparation project. For customer-email triage, that might mean exporting 100 resolved messages, agreeing on five categories, recording current handling time and naming the person who reviews uncertain cases. That small package is more valuable than a company-wide AI strategy deck.

This checklist is general operational guidance. Privacy, employment, sector and provincial requirements vary; obtain qualified advice where appropriate.