The short answer. AI readiness is the state of having five organisational foundations in place — governance, data, infrastructure, security and use case — such that a business can adopt AI tools safely, defensibly, and with measurable outcomes. It is an organisational property, not a technology one. The Arx Certa scorecard quantifies it in four minutes across 12 questions.
The five foundations that decide AI readiness
Every workable definition of AI readiness collapses to the same five foundations. A business that can confidently say yes to all five is ready. A business missing one or more is not — and which one is missing predicts which AI initiatives will fail and how.
Governance. A named owner, an approved AI usage policy, a process for approving new tools before they get used at scale, and a review cadence. Without governance, AI adoption diffuses through the organisation faster than any policy can catch up.
Data. Knowing where data lives, how it is permissioned, what state it is in, and what the audit trail looks like when AI tooling accesses it. AI projects fail more often because of the data underneath than because of the model.
Infrastructure. The cloud, identity, network and integration foundations that AI tools depend on. UK data residency, single sign-on, role-based access control, isolated tenants — the technical baseline AI needs to plug into.
Security. The security baseline updated for the AI threat surface — vendor security assessment, AI-aware DLP, monitoring of AI tool usage, incident response that covers AI-related events, and the ability to revoke AI tool access on demand.
Use case. The two or three things AI will be deployed against this year, with a named owner per use case and a measurable outcome. "We should be doing something with AI" is not a use case. "Reduce customer enquiry handling time by 30% in the legal admin team by end of Q3" is.
What AI readiness is not
AI readiness is not a technology purchase. It is not a license cohort. It is not a vendor relationship. A business can have Microsoft Copilot deployed across every desk and still score "Early" on readiness, because the licenses are not the readiness — the foundations underneath are.
It is also not a one-time certification. The five foundations evolve as the business changes, as AI tools evolve, and as the regulatory environment matures. A business that was ready in 2024 is not automatically ready in 2026; the bar moves.
The four readiness bands
Early (0–25/100). Foundations work has not started. AI tooling, if present, is shadow IT.
Emerging (26–50). Some foundations are in place — usually one of governance or data — but the others are not. AI adoption is happening but is not yet defensible.
Operational (51–75). All five foundations are partially in place. The business can deploy AI inside a defined perimeter and produce evidence of how it is being used.
Mature (76–100). All five foundations are mature. AI operates inside the same governance perimeter as every other regulated business activity. The firm could produce, on seven days' notice, an audit pack covering the last 12 months of AI use.
Who needs to know their AI readiness
Every UK business in 2026 where AI is on the leadership agenda, which by now is most of them. Particularly: regulated sectors (legal, accountancy, financial services, healthcare suppliers) where readiness has supervisory consequences; mid-market businesses where the gap between "AI being used by staff" and "AI being formally approved" is widest; and businesses about to procure their first enterprise AI tooling.
How to find out where your business sits
The Arx Certa AI Readiness Scorecard is the free four-minute version of this assessment. Twelve plain-English questions across the five dimensions above produce a 0–100 score, a band, and a personalised 30-day action plan. UK-specific, designed for leadership teams to take together.
Frequently asked
What does it mean for a business to be ready for AI?
It means the business has five organisational foundations in place — governance, data, infrastructure, security and use case — such that AI can be adopted safely and defensibly. It is not a technology purchase or a license; it is the foundations underneath. The Arx Certa scorecard quantifies it across 12 questions in four minutes.
Is AI readiness a one-time assessment or an ongoing thing?
Ongoing. The five foundations evolve as the business changes, as AI tools evolve, and as UK regulators clarify their expectations. A business that was ready in 2024 is not automatically ready in 2026. Most firms run the readiness check quarterly during active AI adoption, then annually once they reach the Mature band.
Why does AI readiness need to be measured before AI adoption?
Because the alternative is to discover gaps after deployment, which is more expensive and sometimes regulator-visible. Pre-adoption assessment lets a business sequence the foundations work first and the technology work second — which is the order that produces working AI rather than retrospective remediation.
Do small businesses need AI readiness assessment too?
Yes, but with lighter weighting on the formal-governance dimensions. A 10-person business is not running a formal data protection committee, but the underlying questions (who owns AI policy, where is sensitive data, what are we using AI for) still apply. The scorecard adjusts recommendations to business size.
How is AI readiness different from AI maturity?
Readiness is the assessment of whether a business can adopt AI safely; maturity is how comprehensively it has done so. A business can be ready (foundations in place) without being mature (extensive AI deployment). Readiness is the prerequisite; maturity is the outcome.
Related Arx Certa services
If the gaps the scorecard surfaces need outside help to close, these are the engagement types we run for UK firms:
- AI services — implementation reviews, AI policy work, vendor due diligence, and pilot scoping.
- Cybersecurity — UK GDPR, NCSC alignment, vendor risk assessment, audit-readiness.
- Database — the data foundations AI projects depend on.
- Infrastructure — cloud, identity, network and integration foundations.
Find out where your business sits
Take the free 4-minute Arx Certa AI Readiness Scorecard. Twelve questions, five dimensions, one quantified score, and a 30-day action plan tailored to where you actually are.
Get your AI readiness score →