AI readiness assessment for small and mid-size businesses

The assessment scores six dimensions with three or four questions each. We built them from three published frameworks, read on their own pages on October 28, 2026, and kept only what a business of 5 to 200 people can act on this quarter.

• Cisco AI Readiness Index. Six pillars (Strategy, Infrastructure, Data, Governance, Talent and Culture) measured on 49 indicators (Cisco methodology). Its first edition surveyed 8,161 business leaders at organizations with 500 or more employees (Cisco 2023 report), so its Infrastructure pillar is about compute, networks and power. A small business rents all of that as software, so our tools questions ask about the AI assistant, the apps and who holds the logins.
• Microsoft AI Readiness Assessment. Seven pillars, from Business Strategy to Model Management, in a multiple-choice assessment on Microsoft Learn (Microsoft). We left out Model Management: training and running your own models is not where a 5 to 200 person business starts.
• NIST AI Risk Management Framework. A voluntary framework released on January 26, 2023, built on four functions: Govern, Map, Measure and Manage (NIST). Our risk questions are the small-business version of its categories (AI RMF Core): written rules (Govern 1.2), the laws that apply to your data (Govern 1.1), what goes into outside AI tools (Govern 6), and a person who checks output and knows what to do when it goes wrong (Measure 3, Manage 4).

The processes dimension is our own addition. None of the three frameworks asks it on its own, but for a small team it decides where AI pays off first: a task that is repeated, timed and done the same way each time is one you can hand to AI and check.

Every answer is worth 0 to 3 points, from "not in place" to "in place and owned". That follows the way Cisco scores each indicator, from no deployment to full deployment.

1. 01

   Answers

   Each of the 19 is worth 0, 1, 2 or 3 points

2. 02

   Dimensions

   Points as a share of the maximum, from 0 to 100

3. 03

   Overall

   The plain average of the six dimensions

4. 04

   Level

   Cisco's cut-offs, capped when risk is under 31

5. 05

   Steps

   3 to 5, picked from your weakest dimensions

• Equal weights. Cisco's 2023 report weights its pillars (Infrastructure 25%, Data 20%, Strategy, Governance and Talent 15% each, Culture 10%). Those weights fit large companies that build their own AI infrastructure, so we weight our six dimensions equally.
• Levels. The cut-offs are Cisco's: 0 to 30, 31 to 60, 61 to 85 and 86 to 100. The number is not comparable with Cisco's benchmark: the questions are different, and we collect no answers, so there is no average to compare with.
• One cap. If your risk, privacy and policy score is under 31, your level stops at Building foundations, whatever the overall score says. Automating before you have data rules is the mistake that is most expensive to undo.
• Steps. Your three weakest dimensions always get a step, and up to two more do when they score under 75. A dimension at 50 or below gets its basic step, above 50 the next one. Equal scores go in this order: risk, strategy, data, processes, people, tools. A risk score of 50 or less always makes the list.

We ran three made-up businesses through the assessment's own scoring code on October 28, 2026, answering each question the way such a business plausibly would, and logged every answer with the reason for it. This is one of them: Northfield Goods, an invented online store with 25 people on Shopify.

the-aischool.com/ai-readiness-assessment

The store picked middle answers for most questions, but staff paste customer emails into ChatGPT to draft replies, nobody checks it, and AI product descriptions sometimes go live unread. So risk scores 33 and its policy step comes first, even though the overall score reaches the third level:

1. Write a one-page AI policy this week (risk, privacy and policy: 33)
2. Name an AI champion and share what works (people and skills: 56)
3. Turn your goals into a one-page AI plan (strategy and goals: 67)
4. Score your tasks and launch the top one (processes worth automating: 67)
5. Pick one automation platform and map your apps (tools and systems: 67)

The other two test businesses came out like this:

Did the steps make sense? For the clinic, patient data meets free tools with only a spoken rule, so a policy, a goal, training and one business-plan assistant come before any automation; its five steps cover every dimension except processes. The accounting firm already has rules, documents and procedures, and its gap is people: seniors are worried about quality, so it gets three steps, with people first. These answers were invented, so the run tests whether the rules pick sensible steps, not how real businesses score.

The level tells you what kind of work comes next. The steps in your result tell you where to start.

0 to 30: Getting started

AI is not part of how the business works yet, which is a normal place to start. Spend the next 30 days on three things and buy nothing else yet:

• One assistant for the whole team, on a business plan if anyone handles customer data.
• One page of rules: approved tools, what never goes in, who checks output.
• Five timed tasks, so you can prove later what AI changed.

31 to 60: Building foundations

Some people use AI, but goals, documents or rules are missing, so results depend on who is using it. Fix your two weakest dimensions before you automate anything a customer will see, and give AI work one named owner.

61 to 85: Ready for first workflows

The basics are in place. Pick one repeated task, build it as a workflow with a person approving every output, and measure it for a month before you start the next. The AI automation guide's worksheet helps you pick the task.

86 to 100: Ready to scale

Goals, data, people and rules are in place. Add automations one at a time, review each one every quarter, and get a second opinion on anything that touches money, health or client records.

Each next step in your result links to one of these guides. They go deeper than the assessment can:

• AI for small business: a 90-day plan: one assistant, one workflow, then one automation, with the costs and a policy checklist.
• AI automation for small business: list your repeated tasks, score them by payoff and launch your first three.
• AI training for employees: a 30-day plan by role, the data traffic light and how to measure the result.
• How to become an AI consultant: the one-page AI opportunity audit, if you run assessments like this for clients.
• The best AI automation tools: Zapier, Make, n8n and seven more, with real prices, for when your apps are ready to connect.

Disclosure: The AI School sells AI courses, now in early access. Our AI automation course covers the workflows this assessment points to. The assessment itself is free, asks for no contact details and links only to free guides.