The short answer. Evaluate any free AI readiness tool against eight questions: who built it (credibility), what regulators is it aligned to (UK fit), how many dimensions does it assess (depth), is the output actionable (action plan vs score-only), what data is captured (privacy), is it UK-specific (vs US-imported), what's the bias toward the vendor's services (honesty), and does it produce evidence that can be retained (artefacts). A tool that scores well on all eight is worth taking; a tool that scores poorly on three or more is a sales-qualification quiz.
The eight questions, in priority order
1. Who built it? A free AI readiness tool from a known UK consultancy, a recognised industry body (techUK, CBI, sector association), or a regulator is credible by default. A free tool from a vendor selling a single AI product is selling that product through the assessment, and the questions tend to skew toward the gaps the product fills.
2. What regulators is it aligned to? A UK-built tool should reference UK GDPR, ICO guidance, NCSC frameworks, and the relevant sector regulator (SRA, FCA, ICAEW, CQC). A tool that mentions GDPR generically and EU AI Act extensively is probably an EU-focused tool repackaged for UK audiences — usable, but mis-weighted.
3. How many dimensions does it assess? Single-dimension tools (governance-only, policy-only) are useful diagnostics for their dimension but inadequate as readiness assessments. Multi-dimension tools (covering governance, data, infrastructure, security, use case) produce a complete picture. Five dimensions is the standard floor.
4. Is the output actionable? A score alone is not actionable. A score plus a band plus a 30-day action plan tailored to the lowest-scoring dimensions is actionable. The action plan is the leverage; the score is the diagnostic that produces it.
5. What data is captured? Some tools capture extensive personal data and business data via the questions themselves. Read the privacy notice; check whether business data shared during the assessment becomes vendor training data; check the retention period. Free tools paid for by lead capture are common; free tools paid for by extensive data capture are less common but worth screening for.
6. Is it UK-specific? Same point as question two, applied at the assessment level. UK readiness has UK regulatory weighting. A US-built tool will surface the wrong priorities (e.g. SOC 2 emphasis over UK GDPR, US federal posture over UK sector regulators).
7. What's the bias toward the vendor's services? Does the recommended next step always involve buying the vendor's product, or is most of the action plan customer-executable? A good free tool tells the business what to do; a sales-qualification quiz tells the business what to buy.
8. Does it produce evidence that can be retained? A free tool that produces an exportable PDF report is the right shape — the business retains evidence of the diagnostic, can rerun later, can compare. A free tool that produces only an on-screen result is less useful operationally.
Tools worth taking
Arx Certa AI Readiness Scorecard. UK-built. ICO/NCSC-aligned with sector overlays. Five dimensions. Score plus band plus 30-day plan. Email-gated for report, no signup to start. UK-specific throughout. Action plan is mostly customer-executable. PDF report retainable.
ICO AI and data protection toolkit. Regulator-built. UK GDPR-aligned. Single dimension (data protection) but the gold standard for that dimension. Score-style output. UK-specific by definition. No vendor bias.
NCSC AI security guidance and self-assessment. Government-built. Security-dimension focus. Highly credible. Less of an interactive tool than a structured guide.
Tools to be cautious with
Without naming specific vendors, watch for: AI-vendor-branded readiness quizzes whose action plan is "buy our product"; consultancy-branded quizzes that produce a score but no action plan; US-built quizzes ported to UK domains; quizzes that capture company financial data as inputs.
The honest disclaimer
This page is published by Arx Certa, which builds and operates a free AI readiness scorecard. We have applied the same eight questions to our own tool above. The criteria are stable; the tools available change. Re-evaluate the landscape every 6-12 months.
Frequently asked
Are all free AI readiness tools just lead-magnets?
Most are; some aren't. The eight questions above are the screen. Tools built by independent consultancies, by industry bodies, or by regulators tend to be substantive. Tools built by AI vendors as part of their sales funnel tend to be lead-qualification with a readiness coat of paint.
How long should a free AI readiness assessment take?
Three to six minutes is the right range for an individual to take it. Under three minutes typically means the assessment is too shallow to produce a useful picture. Over ten minutes typically means it is doing the work of a paid engagement for free, which is suspicious. Four minutes is the Arx Certa target.
Should the free assessment have an email gate?
Defensible to have one — running a free tool at scale costs money, and lead capture is the operating model that makes it sustainable. The question is when the gate sits. Best practice: no gate to start, gate on report retrieval. Worst practice: gate before showing the result.
Can a free assessment be the basis of a board paper?
It can be a useful input to a board paper, not a substitute for one. The board paper context (sector exposure, specific use cases, financial implications) needs to be added by the business or by an engagement. The scorecard PDF is structured to be quotable in a board paper, not to be the paper itself.
What if our score is very different on different free tools?
Expected, because different tools weight different dimensions differently. The pattern that matters is consistency across multiple tools on a specific dimension — if four tools all flag data readiness as your weakest area, that signal is real regardless of the score variation.
Related Arx Certa services
If the gaps the scorecard surfaces need outside help to close, these are the engagement types we run for UK firms:
- AI services — implementation reviews, AI policy work, vendor due diligence, and pilot scoping.
- Cybersecurity — UK GDPR, NCSC alignment, vendor risk assessment, audit-readiness.
- Database — the data foundations AI projects depend on.
- Infrastructure — cloud, identity, network and integration foundations.
Take the Arx Certa scorecard and see how it does
The free Arx Certa AI Readiness Scorecard is built on the eight criteria above. 4 minutes, five dimensions, UK-specific, retainable PDF report.
Get your AI readiness score →