# How Ready Is Your Business for AI? The Seven Dimensions That Decide It

Canonical URL: https://business.theaieducator.io/posts/how-ready-is-your-business-for-ai
Publication: Dan Fitzpatrick Insights
Author: Dan Fitzpatrick
Topic: AI Readiness and Results
Published: 2026-09-22T22:52:18.000Z
Modified: 2026-09-22T22:52:48.901Z

Your business is ready for AI when seven things are in place: purpose, permission, ownership, capability, protection, foundations and evidence. Here is a diagnostic question for each, what strong and weak look like in a small business, and why your readiness is your lowest score, not your average.

## In brief

A business is ready for AI when seven things are in place: purpose, permission, ownership, capability, protection, foundations and evidence. Score each one honestly. Your readiness is your lowest score across the seven, not your average, so find the weakest dimension and fix that first.

## Key takeaways

- The Seven Dimensions of AI Readiness are purpose, permission, ownership, capability, protection, foundations and evidence.
- Readiness is your lowest score across the seven, not your average, because AI fails through the weakest part of a business.
- Purpose, permission and ownership are leadership decisions, and no tool purchase or license can fix a low score on them.
- The UK's Information Commissioner's Office says senior management cannot delegate AI data protection issues to data scientists or engineering teams.
- US Census Bureau data published in May 2026 found AI use did not change significantly among firms with fewer than 20 employees between December 2025 and May 2026.
- Cisco's 2025 AI Readiness Index found its most AI-ready group has been about 13% of organizations for three years, and 95% of them track the impact of their AI investments.
- The most common mistake is fixing the dimension that is easiest to buy rather than the one that scores lowest.

Your business is ready for AI when seven things are in place: a purpose for it, permission people understand, an owner, the capability to use it well, protection for your data, the foundations it runs on, and evidence that it works. Score each one honestly. Your readiness is the lowest of the seven, not the average, because the weakest one is where AI will go wrong first. In most small and medium-sized businesses, that weak spot is not the technology.

Here is the awkward part. Many owners asking "are we ready?" are asking too late, because the team started without them. Walk through a typical small office: the office manager drafts supplier emails in ChatGPT. A sales lead tidies proposals in Microsoft Copilot. Someone in accounts has pasted a spreadsheet into a chatbot to see what would happen. The useful question is not whether AI has arrived. It is whether the business is ready for the AI it already has.

## What Are the Seven Dimensions of AI Readiness?

The Seven Dimensions of AI Readiness are the seven things an organization must have in place before its use of AI can be called ready rather than merely widespread: purpose, permission, ownership, capability, protection, foundations and evidence. Your readiness is your lowest score across the seven, not your average.

That definition is mine, and it is the basis of the free Workplace AI Readiness Check I built for leaders. It is my suggested way of thinking, not a published standard. I built it because readiness models written for large companies tend to open with data platforms and network infrastructure, and a 20-person firm with no data team finds little in them to act on. SMBs (SMEs in the UK and Europe) need questions an owner can answer in a leadership meeting without calling in a consultant.

The evidence says those questions are worth asking now. In the US, the Census Bureau reported in May 2026 that overall business AI use "hovered between 17% and 20%" between December 2025 and May 2026, and that AI use "increased among firms with at least 20 employees but didn't change significantly among firms with fewer than 20 employees" ([US Census Bureau, May 26, 2026](https://www.census.gov/library/stories/2026/05/ai-use-businesses.html)). An OECD survey of more than 5,000 SMEs, run in 2024 across seven countries including Canada, Germany and the UK, found that "generative AI is in use in 31% of SMEs" ([OECD, November 4, 2025](https://www.oecd.org/en/publications/generative-ai-and-the-sme-workforce_2d08b99d-en.html)). Official surveys ask whether a business uses AI. They cannot tell you whether it is using it well.

## Why Is Readiness Your Lowest Score, Not Your Average?

Readiness is your lowest score because AI fails through the weakest part of the business, and a strong score elsewhere does not cover for it.

Think of a three-legged stool. If one leg is two inches short, you do not have most of a stool. You have a stool that tips over the moment someone leans on it. An average would tell you the stool is fine. Sitting on it tells you the truth.

Take a hypothetical 25-person recruitment agency that scores itself out of five. Purpose 4: everyone knows AI is for drafting job ads and candidate summaries. Capability 4: the consultants are fluent. Foundations 4 and evidence 3. Permission 3 and ownership 3. Protection 1: consultants paste résumés, with names, addresses and salary histories, into personal chatbot accounts, and nobody has checked where that data goes. The average is a respectable 3.1. The readiness score is 1, and it is the only number that matters, because a single data incident will cost that agency more client trust than every drafted ad has earned.

Research on bigger organizations points the same way. Cisco's AI Readiness Index, a survey of "over 8,000 AI leaders across 30 markets and 26 industries," found that its most prepared group, which it calls Pacesetters, has been "about 13% of organizations for the last three years." They are not strong in one area and weak in the rest. Cisco reports that 99% have a defined AI roadmap (against 58% overall), 91% have a change-management plan (against 35%), and 95% track the impact of their AI investments, a rate it calls "three times higher than others" ([Cisco, October 14, 2025](https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2025/m10/cisco-ai-research-the-most-ai-ready-companies-outpace-peers-in-the-race-to-value.html)). Cisco surveyed people whose job is AI, a role few small firms have, so treat this as a pattern rather than a benchmark. My reading of it: the organizations that get value from AI are the ones without a short leg.

## How Do You Score Each of the Seven Dimensions?

Score each dimension by answering one plain question honestly, then compare your answer with what strong and weak look like in a business your size. The first three dimensions are leadership questions. They are the three questions of my Readiness Test: "The Readiness Test is three questions an organization must be able to answer consistently, from the top to the front line, before it can call itself AI ready: What is AI for here? What may I do with it? Who decides when it goes wrong?"

### 1. Purpose

**Ask:** Could you name the two or three jobs AI is for in this business, and would your team name the same ones?

**Strong:** The owner says "first drafts of quotes, summarizing supplier contracts and answering routine customer emails," and the front desk gives the same list. People know what AI is not for as well.

**Weak:** "We should be using AI more." Enthusiasm without a target produces a dozen private experiments and no shared gain.

**One move:** Pick the three most repetitive writing or admin jobs in the business and write them on one page as "what AI is for here." My guide to [how a small business should start using AI](https://business.theaieducator.io/posts/how-should-a-small-business-start-using-ai) covers how to choose them.

### 2. Permission

**Ask:** If a member of staff wanted to paste a client email into a chatbot tomorrow morning, would they know whether they are allowed to?

**Strong:** A short written policy lists the approved tools, the information that must never go into them and the person to ask when unsure. Staff have read it and can repeat the red lines.

**Weak:** Silence. Some staff read silence as "no" and use AI quietly on their phones. Others read it as "anything goes." Both are worse than a clear answer.

**One move:** Write a one-page AI use policy and talk it through at the next team meeting. Here is [what a small business AI policy needs to cover](https://business.theaieducator.io/posts/does-a-small-business-need-an-ai-policy).

### 3. Ownership

**Ask:** When AI gets something wrong, whose phone rings?

**Strong:** One named person, often an operations manager rather than the most technical person, owns AI use. They have time on the calendar to do it and the authority to say yes or no to a new tool.

**Weak:** "IT deals with it," which in a small firm often means an outside provider who has never seen how you use AI, or the keenest junior, who has the enthusiasm but not the authority.

The UK's data regulator puts the responsibility at the top. The Information Commissioner's Office (ICO) says of AI risks: "You cannot delegate these issues to data scientists or engineering teams. Your senior management, including DPOs, are also accountable for understanding and addressing them appropriately and promptly" ([ICO, last updated December 11, 2024](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/)). A small business rarely has a data protection officer. That makes the owner's signature matter more, not less.

**One move:** Name the owner in writing and put a 30-minute monthly review in their calendar.

### 4. Capability

**Ask:** Could the people who use AI most show you how they check its work?

**Strong:** People use AI on their own real tasks, know which outputs to verify and which to trust, and swap what works with colleagues. Someone can explain why a draft was wrong, not just that it was.

**Weak:** One training session last year, three enthusiasts and a quiet majority who tried it once, got a bland answer and gave up.

The UK government's SME Digital Adoption Taskforce names "capability, cost and awareness" as the barriers businesses face, and its 2026 update restates the ambition "for the UK's SMEs to be the most digitally capable and AI confident in the G7" ([GOV.UK, June 26, 2026](https://www.gov.uk/government/publications/sme-digital-adoption-taskforce-2026-update/sme-digital-adoption-taskforce-2026-update)). Capability is the barrier an owner can do most about this month.

**One move:** Replace generic training with an hour where each person brings one real task and leaves having done it with AI. More on [AI training that works for small business teams](https://business.theaieducator.io/posts/ai-training-for-small-business-teams).

### 5. Protection

**Ask:** Do you know which client, staff and financial information went into an AI tool this month?

**Strong:** Staff use approved tools on business accounts, not personal ones, with the data settings checked. Everyone knows the red lines: no client personal data, no HR files, no unreleased financials, unless the tool has been approved for them.

**Weak:** Nobody knows, because nobody has asked. In a small firm this is often the shortest leg, precisely because it is nobody's job.

In the UK, the ICO's guidance for organizations using AI to process personal data is blunt: "In the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals' rights and freedoms, and will therefore trigger the legal requirement for you to undertake a DPIA" ([ICO, last updated December 11, 2024](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/)). A DPIA is a data protection impact assessment: a written check of the risks before you start. The ICO also says that, because of the Data (Use and Access) Act, the guidance "is under review and may be subject to change" ([ICO, September 22, 2025](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/about-this-guidance/)). In the US, start by checking what your client contracts and confidentiality terms say about sharing client information with third-party software.

**One move:** Ask the team, with an explicit promise of no blame, which AI tools they use and what they put into them. You cannot protect what you cannot see.

### 6. Foundations

**Ask:** Is the information AI would need stored somewhere your team can reach, in a state you would trust?

**Strong:** One current version of each template, product sheet and standard reply, in a shared folder with sensible names. Business accounts, working licenses and multi-factor authentication on every login.

**Weak:** The best proposal lives in one person's inbox. There are five versions of the terms and conditions. AI drafts from whichever one it is shown, and confidently repeats the old errors.

The OECD's December 2025 paper for the G7 lists four prerequisites for SME adoption: connectivity; data, algorithms and compute; skills; and finance ([OECD, December 9, 2025](https://www.oecd.org/en/publications/2025/12/ai-adoption-by-small-and-medium-sized-enterprises_9c48eae6.html)). For a small firm, "data" mostly means tidy files, not a data warehouse.

**One move:** Take one job from your purpose list and tidy only the documents that job needs. Do not start a company-wide clean-up. It will never finish.

### 7. Evidence

**Ask:** Could you show me one number that has changed because of AI?

**Strong:** For one or two jobs, you know the before and after: time to first draft of a quote, hours spent on weekly reporting, customer response time. The owner reviews them monthly and drops what is not working.

**Weak:** "People say it saves time." Maybe it does. Without a number, AI is the first budget line cut in a bad quarter, and the first habit dropped in a busy week.

**One move:** This week, time one task once the old way and once with AI. Write both numbers down. If AI is used widely but nothing has changed, read [why small businesses are not getting value from AI yet](https://business.theaieducator.io/posts/why-small-businesses-are-not-getting-value-from-ai).

## The Mistake I See Most Often

The mistake I see most often is fixing the dimension that is easiest to buy rather than the one that is lowest.

Across the business teams I train, the pattern repeats. A leadership team senses that AI is not landing, so it buys licenses, tries a new tool or books a demo. Those are foundations and capability purchases. Meanwhile the lowest score is permission or ownership, which no invoice fixes. It takes an owner deciding, in writing, what AI is for and who answers for it. I have worked with organizations as different as Hyve Group, NCFE and the North East Local Enterprise Partnership, and the first question I bring to any leadership team is the same: which leg is shortest? More often than not, the answer is a decision nobody has made yet.

The fix is unglamorous. Find the lowest score and spend the next month on that alone. When it rises, the lowest score moves somewhere else, and that becomes next month's work. Readiness is not a certificate. It is the habit of finding the short leg.

## What to Do This Week

This week, score the seven dimensions, circle the lowest and make one move on it; a 20-person business can do all of that without a data team or a new budget line.

1. **Score yourselves separately.** Ask three or four people, including one person who does not manage anyone, to answer the seven questions above from one to five. Do it alone, not in a meeting.
2. **Compare the spread.** Where the owner scores a 4 and the front line scores a 2, you have found a gap in communication as well as in readiness.
3. **Circle the lowest dimension.** Not the most interesting one. The lowest.
4. **Make its one move.** Each dimension above has a move a small team can finish in days.
5. **Tell the team what changed.** A readiness fix nobody hears about does not change behavior on Monday morning.
6. **Schedule a rescore for 90 days out.** Readiness drifts as tools, people and clients change.

## Find Your Shortest Leg

If you want to know where your business stands before you spend another month experimenting, take the free [Workplace AI Readiness Check](https://theaieducator.io/workplace-ai-readiness?utm_source=business.theaieducator.io&utm_medium=referral&utm_campaign=how-ready-is-your-business-for-ai). It takes 21 questions and about eight minutes, scores all seven dimensions and shows you the one thing to fix first.

If your lowest score turns out to be purpose, permission or ownership, that is a leadership decision rather than a training gap, and it is what my [AI strategy and governance work](https://theaieducator.io/ai-strategy-and-governance?utm_source=business.theaieducator.io&utm_medium=referral&utm_campaign=how-ready-is-your-business-for-ai) with leadership teams is built for.

## Sources and further reading

- "Large Firms With at Least 20 Employees Biggest AI Users," US Census Bureau, May 26, 2026. https://www.census.gov/library/stories/2026/05/ai-use-businesses.html
- "Generative AI and the SME Workforce: New Survey Evidence," OECD Publishing, November 4, 2025. https://www.oecd.org/en/publications/generative-ai-and-the-sme-workforce_2d08b99d-en.html
- "AI adoption by small and medium-sized enterprises," OECD Discussion Paper for the G7, December 9, 2025. https://www.oecd.org/en/publications/2025/12/ai-adoption-by-small-and-medium-sized-enterprises_9c48eae6.html
- "Cisco AI Research: The Most AI-ready Companies Outpace Peers in the Race to Value," Cisco Newsroom, October 14, 2025. https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2025/m10/cisco-ai-research-the-most-ai-ready-companies-outpace-peers-in-the-race-to-value.html
- "What are the accountability and governance implications of AI?", Guidance on AI and data protection, Information Commissioner's Office, last updated December 11, 2024. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/
- "About this guidance," Guidance on AI and data protection, Information Commissioner's Office, last updated September 22, 2025. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/about-this-guidance/
- "SME Digital Adoption Taskforce: 2026 update," GOV.UK, June 26, 2026. https://www.gov.uk/government/publications/sme-digital-adoption-taskforce-2026-update/sme-digital-adoption-taskforce-2026-update

*[Dan Fitzpatrick](https://theaieducator.io/about) is The AI Educator: a Forbes contributor, keynote speaker and bestselling author who has trained more than 150,000 people across 30+ countries.*


## Frequently asked questions

### How do I know if my business is ready for AI?

Your business is ready for AI when it can show seven things: a clear purpose for AI, permission staff understand, a named owner, the capability to use it well, protection for data, working foundations and evidence of results. Score each from one to five. Your readiness is the lowest score, not the average.

### What is an AI readiness assessment?

An AI readiness assessment is a structured check of whether a business has what it needs to use AI well, not just whether staff use it. Dan Fitzpatrick's free Workplace AI Readiness Check asks 21 questions in about eight minutes, scores seven dimensions and shows the one thing to fix first.

### Why is AI readiness the lowest score and not the average?

Because AI fails through the weakest part of a business. A firm with a clear purpose and skilled staff but no data protection will still suffer the data incident. An average hides that gap. The lowest score points straight at it, which is why it is the number to act on first.

### Does a small business need a data team to be ready for AI?

No. For a small or medium-sized business, readiness depends more on leadership decisions than on data infrastructure: what AI is for, what staff may do with it and who owns it. Foundations matter too, but for a small firm that mostly means tidy, current files and secure business accounts.

### What is the first step to becoming AI ready?

The first step is finding your lowest-scoring dimension. Ask three or four people, including someone who manages no one, to score the seven dimensions separately, then compare. Spend the next month improving only the lowest score, then rescore, because the weakest dimension moves as you fix it.

### Who should own AI in a small business?

One named person should own AI use, with time set aside and the authority to approve or refuse tools. It is often an operations manager rather than the most technical person. In the UK, the ICO says senior management stay accountable for AI data protection risks and cannot delegate them.

### How often should a business check its AI readiness?

Check AI readiness about every 90 days. Readiness drifts as tools, staff and clients change, and fixing one weak dimension usually exposes the next. A quarterly rescore using the same seven questions turns readiness into a habit rather than a one-off certificate that goes stale.

---
Source: [How Ready Is Your Business for AI? The Seven Dimensions That Decide It](https://business.theaieducator.io/posts/how-ready-is-your-business-for-ai)
Publisher: [The AI Educator](https://theaieducator.io)