Your business is ready for AI when seven things are in place: a purpose for it, permission people understand, an owner, the capability to use it well, protection for your data, the foundations it runs on, and evidence that it works. Score each one honestly. Your readiness is the lowest of the seven, not the average, because the weakest one is where AI will go wrong first. In most small and medium-sized businesses, that weak spot is not the technology.
Here is the awkward part. Many owners asking "are we ready?" are asking too late, because the team started without them. Walk through a typical small office: the office manager drafts supplier emails in ChatGPT. A sales lead tidies proposals in Microsoft Copilot. Someone in accounts has pasted a spreadsheet into a chatbot to see what would happen. The useful question is not whether AI has arrived. It is whether the business is ready for the AI it already has.
What Are the Seven Dimensions of AI Readiness?
The Seven Dimensions of AI Readiness are the seven things an organization must have in place before its use of AI can be called ready rather than merely widespread: purpose, permission, ownership, capability, protection, foundations and evidence. Your readiness is your lowest score across the seven, not your average.
That definition is mine, and it is the basis of the free Workplace AI Readiness Check I built for leaders. It is my suggested way of thinking, not a published standard. I built it because readiness models written for large companies tend to open with data platforms and network infrastructure, and a 20-person firm with no data team finds little in them to act on. SMBs (SMEs in the UK and Europe) need questions an owner can answer in a leadership meeting without calling in a consultant.
The evidence says those questions are worth asking now. In the US, the Census Bureau reported in May 2026 that overall business AI use "hovered between 17% and 20%" between December 2025 and May 2026, and that AI use "increased among firms with at least 20 employees but didn't change significantly among firms with fewer than 20 employees" (US Census Bureau, May 26, 2026). An OECD survey of more than 5,000 SMEs, run in 2024 across seven countries including Canada, Germany and the UK, found that "generative AI is in use in 31% of SMEs" (OECD, November 4, 2025). Official surveys ask whether a business uses AI. They cannot tell you whether it is using it well.
Why Is Readiness Your Lowest Score, Not Your Average?
Readiness is your lowest score because AI fails through the weakest part of the business, and a strong score elsewhere does not cover for it.
Think of a three-legged stool. If one leg is two inches short, you do not have most of a stool. You have a stool that tips over the moment someone leans on it. An average would tell you the stool is fine. Sitting on it tells you the truth.
Take a hypothetical 25-person recruitment agency that scores itself out of five. Purpose 4: everyone knows AI is for drafting job ads and candidate summaries. Capability 4: the consultants are fluent. Foundations 4 and evidence 3. Permission 3 and ownership 3. Protection 1: consultants paste résumés, with names, addresses and salary histories, into personal chatbot accounts, and nobody has checked where that data goes. The average is a respectable 3.1. The readiness score is 1, and it is the only number that matters, because a single data incident will cost that agency more client trust than every drafted ad has earned.
Research on bigger organizations points the same way. Cisco's AI Readiness Index, a survey of "over 8,000 AI leaders across 30 markets and 26 industries," found that its most prepared group, which it calls Pacesetters, has been "about 13% of organizations for the last three years." They are not strong in one area and weak in the rest. Cisco reports that 99% have a defined AI roadmap (against 58% overall), 91% have a change-management plan (against 35%), and 95% track the impact of their AI investments, a rate it calls "three times higher than others" (Cisco, October 14, 2025). Cisco surveyed people whose job is AI, a role few small firms have, so treat this as a pattern rather than a benchmark. My reading of it: the organizations that get value from AI are the ones without a short leg.
How Do You Score Each of the Seven Dimensions?
Score each dimension by answering one plain question honestly, then compare your answer with what strong and weak look like in a business your size. The first three dimensions are leadership questions. They are the three questions of my Readiness Test: "The Readiness Test is three questions an organization must be able to answer consistently, from the top to the front line, before it can call itself AI ready: What is AI for here? What may I do with it? Who decides when it goes wrong?"
1. Purpose
Ask: Could you name the two or three jobs AI is for in this business, and would your team name the same ones?
Strong: The owner says "first drafts of quotes, summarizing supplier contracts and answering routine customer emails," and the front desk gives the same list. People know what AI is not for as well.
Weak: "We should be using AI more." Enthusiasm without a target produces a dozen private experiments and no shared gain.
One move: Pick the three most repetitive writing or admin jobs in the business and write them on one page as "what AI is for here." My guide to how a small business should start using AI covers how to choose them.
2. Permission
Ask: If a member of staff wanted to paste a client email into a chatbot tomorrow morning, would they know whether they are allowed to?
Strong: A short written policy lists the approved tools, the information that must never go into them and the person to ask when unsure. Staff have read it and can repeat the red lines.
Weak: Silence. Some staff read silence as "no" and use AI quietly on their phones. Others read it as "anything goes." Both are worse than a clear answer.
One move: Write a one-page AI use policy and talk it through at the next team meeting. Here is what a small business AI policy needs to cover.
3. Ownership
Ask: When AI gets something wrong, whose phone rings?
Strong: One named person, often an operations manager rather than the most technical person, owns AI use. They have time on the calendar to do it and the authority to say yes or no to a new tool.
Weak: "IT deals with it," which in a small firm often means an outside provider who has never seen how you use AI, or the keenest junior, who has the enthusiasm but not the authority.
The UK's data regulator puts the responsibility at the top. The Information Commissioner's Office (ICO) says of AI risks: "You cannot delegate these issues to data scientists or engineering teams. Your senior management, including DPOs, are also accountable for understanding and addressing them appropriately and promptly" (ICO, last updated December 11, 2024). A small business rarely has a data protection officer. That makes the owner's signature matter more, not less.
One move: Name the owner in writing and put a 30-minute monthly review in their calendar.
4. Capability
Ask: Could the people who use AI most show you how they check its work?
Strong: People use AI on their own real tasks, know which outputs to verify and which to trust, and swap what works with colleagues. Someone can explain why a draft was wrong, not just that it was.
Weak: One training session last year, three enthusiasts and a quiet majority who tried it once, got a bland answer and gave up.
The UK government's SME Digital Adoption Taskforce names "capability, cost and awareness" as the barriers businesses face, and its 2026 update restates the ambition "for the UK's SMEs to be the most digitally capable and AI confident in the G7" (GOV.UK, June 26, 2026). Capability is the barrier an owner can do most about this month.
One move: Replace generic training with an hour where each person brings one real task and leaves having done it with AI. More on AI training that works for small business teams.
5. Protection
Ask: Do you know which client, staff and financial information went into an AI tool this month?
Strong: Staff use approved tools on business accounts, not personal ones, with the data settings checked. Everyone knows the red lines: no client personal data, no HR files, no unreleased financials, unless the tool has been approved for them.
Weak: Nobody knows, because nobody has asked. In a small firm this is often the shortest leg, precisely because it is nobody's job.
In the UK, the ICO's guidance for organizations using AI to process personal data is blunt: "In the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals' rights and freedoms, and will therefore trigger the legal requirement for you to undertake a DPIA" (ICO, last updated December 11, 2024). A DPIA is a data protection impact assessment: a written check of the risks before you start. The ICO also says that, because of the Data (Use and Access) Act, the guidance "is under review and may be subject to change" (ICO, September 22, 2025). In the US, start by checking what your client contracts and confidentiality terms say about sharing client information with third-party software.
One move: Ask the team, with an explicit promise of no blame, which AI tools they use and what they put into them. You cannot protect what you cannot see.
6. Foundations
Ask: Is the information AI would need stored somewhere your team can reach, in a state you would trust?
Strong: One current version of each template, product sheet and standard reply, in a shared folder with sensible names. Business accounts, working licenses and multi-factor authentication on every login.
Weak: The best proposal lives in one person's inbox. There are five versions of the terms and conditions. AI drafts from whichever one it is shown, and confidently repeats the old errors.
The OECD's December 2025 paper for the G7 lists four prerequisites for SME adoption: connectivity; data, algorithms and compute; skills; and finance (OECD, December 9, 2025). For a small firm, "data" mostly means tidy files, not a data warehouse.
One move: Take one job from your purpose list and tidy only the documents that job needs. Do not start a company-wide clean-up. It will never finish.
7. Evidence
Ask: Could you show me one number that has changed because of AI?
Strong: For one or two jobs, you know the before and after: time to first draft of a quote, hours spent on weekly reporting, customer response time. The owner reviews them monthly and drops what is not working.
Weak: "People say it saves time." Maybe it does. Without a number, AI is the first budget line cut in a bad quarter, and the first habit dropped in a busy week.
One move: This week, time one task once the old way and once with AI. Write both numbers down. If AI is used widely but nothing has changed, read why small businesses are not getting value from AI yet.
The Mistake I See Most Often
The mistake I see most often is fixing the dimension that is easiest to buy rather than the one that is lowest.
Across the business teams I train, the pattern repeats. A leadership team senses that AI is not landing, so it buys licenses, tries a new tool or books a demo. Those are foundations and capability purchases. Meanwhile the lowest score is permission or ownership, which no invoice fixes. It takes an owner deciding, in writing, what AI is for and who answers for it. I have worked with organizations as different as Hyve Group, NCFE and the North East Local Enterprise Partnership, and the first question I bring to any leadership team is the same: which leg is shortest? More often than not, the answer is a decision nobody has made yet.
The fix is unglamorous. Find the lowest score and spend the next month on that alone. When it rises, the lowest score moves somewhere else, and that becomes next month's work. Readiness is not a certificate. It is the habit of finding the short leg.
What to Do This Week
This week, score the seven dimensions, circle the lowest and make one move on it; a 20-person business can do all of that without a data team or a new budget line.
- Score yourselves separately. Ask three or four people, including one person who does not manage anyone, to answer the seven questions above from one to five. Do it alone, not in a meeting.
- Compare the spread. Where the owner scores a 4 and the front line scores a 2, you have found a gap in communication as well as in readiness.
- Circle the lowest dimension. Not the most interesting one. The lowest.
- Make its one move. Each dimension above has a move a small team can finish in days.
- Tell the team what changed. A readiness fix nobody hears about does not change behavior on Monday morning.
- Schedule a rescore for 90 days out. Readiness drifts as tools, people and clients change.
Find Your Shortest Leg
If you want to know where your business stands before you spend another month experimenting, take the free Workplace AI Readiness Check. It takes 21 questions and about eight minutes, scores all seven dimensions and shows you the one thing to fix first.
If your lowest score turns out to be purpose, permission or ownership, that is a leadership decision rather than a training gap, and it is what my AI strategy and governance work with leadership teams is built for.
Sources and further reading
- "Large Firms With at Least 20 Employees Biggest AI Users," US Census Bureau, May 26, 2026. https://www.census.gov/library/stories/2026/05/ai-use-businesses.html
- "Generative AI and the SME Workforce: New Survey Evidence," OECD Publishing, November 4, 2025. https://www.oecd.org/en/publications/generative-ai-and-the-sme-workforce_2d08b99d-en.html
- "AI adoption by small and medium-sized enterprises," OECD Discussion Paper for the G7, December 9, 2025. https://www.oecd.org/en/publications/2025/12/ai-adoption-by-small-and-medium-sized-enterprises_9c48eae6.html
- "Cisco AI Research: The Most AI-ready Companies Outpace Peers in the Race to Value," Cisco Newsroom, October 14, 2025. https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2025/m10/cisco-ai-research-the-most-ai-ready-companies-outpace-peers-in-the-race-to-value.html
- "What are the accountability and governance implications of AI?", Guidance on AI and data protection, Information Commissioner's Office, last updated December 11, 2024. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/
- "About this guidance," Guidance on AI and data protection, Information Commissioner's Office, last updated September 22, 2025. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/about-this-guidance/
- "SME Digital Adoption Taskforce: 2026 update," GOV.UK, June 26, 2026. https://www.gov.uk/government/publications/sme-digital-adoption-taskforce-2026-update/sme-digital-adoption-taskforce-2026-update
Dan Fitzpatrick is The AI Educator: a Forbes contributor, keynote speaker and bestselling author who has trained more than 150,000 people across 30+ countries.
