AI Readiness Assessment: How to Measure AI Maturity

An AI readiness assessment is a structured evaluation of how mature an organization is in its use of artificial intelligence. It examines five dimensions (data, skills, processes, governance and technology) and returns a picture of strengths, gaps and priorities.

Its purpose is to support decisions: where the company can invest with a good chance of success, what must be fixed first and which initiatives to postpone. An assessment that produces only a score, with no decisions following from it, has little value.

Why run an AI maturity assessment?

Many companies start from the tools: they buy licenses, launch pilots, then discover that data is not accessible, that people do not know how to use the tools or that nobody has set the rules. The assessment reverses the sequence and makes prerequisites visible before money is spent.

Three situations make it especially useful.

• Before a multi-year AI investment plan, to avoid funding use cases the organization is not ready to sustain.
• After a phase of widespread experimentation, when you need to move from isolated initiatives to a coordinated approach.
• When new regulatory obligations apply, to see how much of the required governance is already in place.

What are the five dimensions to assess?

The dimensions are interdependent: a high level in one does not make up for the absence of another. For each, concrete questions help.

Data

Data is the raw material of many use cases. Typical questions: does the relevant data exist and is it accessible? Is it complete and up to date? Are there clear owners? Are there rules on what can be fed into an AI system, also under the GDPR? The quality of permissions matters too: who can see which data, and which data must never leave the company perimeter.

Skills

This covers both specialist skills and broad familiarity with AI. Questions: do people know what they can and cannot ask a tool? Are there roles responsible for AI? Is there a training path? Article 4 of the EU AI Act on AI literacy, applicable from 2 February 2025, makes this dimension a regulatory issue as well: see AI literacy and Article 4 of the AI Act.

Processes

A poorly defined process is hard to improve with AI. Questions: are the candidate processes documented? Do they have repeated volumes and an owner? Are there baseline measures that allow you to assess impact? Without a baseline, you cannot show that anything was useful: the topic is developed in how to measure AI ROI.

Governance

This includes policies, responsibilities, an inventory of use cases and tools, risk management and regulatory oversight. Questions: is there a usage policy people can understand? Is there a use case register? Who decides whether a new tool can be adopted? Are the applicable obligations under the GDPR, NIS2 and the AI Act known? Further reading: how to write a company AI policy. A use case register, even a simple one, is a good indicator of maturity: whoever keeps it up to date knows what is happening in the departments.

Technology

This includes infrastructure, integrations, security and the tool landscape. Questions: are the tools in use known and assessed? Is there overlap? Are integrations with existing systems feasible? How are access and security managed? The choice among several vendors weighs on this dimension, and it should be driven by use cases, not brand recognition. Locally hosted models, if planned, also count, as does the ability to replace a tool without blocking processes.

How to run an assessment: the operational steps

1. Define the purpose and scope. The whole organization or some areas? Which decision must the outcome support?
2. Form a working group with IT, data, HR, legal and data protection, security and business representatives.
3. Choose a simple maturity scale, for example four levels from initial to managed, with observable descriptions for each.
4. Collect evidence. Existing documents, tool inventories, usage data, policies, training results.
5. Run interviews and questionnaires by department and role, in aggregate form, to capture what documents do not show.
6. Assign levels by dimension, justifying them with evidence, not impressions.
7. Identify the gaps and link them to concrete consequences: what cannot be done while that gap stays open.
8. Report the results in a short summary, with priorities and owners.

A useful rule: every level assigned must be defensible with a document or a data point. If it is not, the judgment is an opinion.

How to use the assessment results

The value lies in the decisions that follow. Translate each gap into an action with an owner, a deadline and an indicator that tells you whether it has been closed. Some typical uses:

• Sequence initiatives. Gaps in prerequisites (data, rules, skills) are addressed before the use cases that depend on them.
• Choose suitable use cases. With limited maturity, favor narrow, low-risk, measurable cases.
• Guide training. Skills gaps by department and role show where to concentrate learning paths.
• Set up governance. Policy, register and responsibilities are defined starting from the gaps that emerged.
• Set improvement targets with deadlines and owners, to be reviewed over time.
• Talk to leadership about investments, with evidence in place of intuition.

An assessment is a snapshot, and maturity changes. Repeat it at a defined interval, for example every 12 months, to verify progress. The adoption status, described in what AI adoption is and how to measure it, offers continuous feedback between one measurement and the next.

Mistakes to avoid

• Reducing it to a single score. An average across dimensions hides the gap that really blocks you.
• Assessing only technology. Bottlenecks are often data, rules or skills.
• Involving a single function. The result reflects its point of view.
• Optimistic self-assessment. Without evidence, answers tend to drift upward.
• Not following up. A report without an action plan loses value within weeks.
• Assessing people. The object is the organization: data on people should be read in aggregate by role or department.
• Seeking perfection before starting. A lean assessment, completed in a few weeks, is more useful than an exhaustive analysis that arrives when priorities have changed.

What are the limits of the approach?

An assessment remains an estimate, and it reflects the moment in which it is run: a reorganization, a change of vendor or a new rule can change the outcome within months. It also measures readiness to use AI, not the value that will result: for that you need impact measures on processes. Maturity scales are conventions, not universal standards, and comparing with other companies makes sense only if the criteria are similar. Judgments depend on the quality of the evidence collected. Use the assessment to guide internal choices, not as a certification.

Where Delphis fits

Delphis is a vendor-independent platform that connects spend, adoption, impact and regulatory obligations. On maturity, it supplies what the assessment needs as evidence: usage data by department and role, recorded use cases, training status and mapped regulatory gaps, all in aggregate form. The mapping is not legal advice. See the adoption and ROI page.