Answer in brief
An AI readiness assessment is a structured review of where a company loses time, what data and people the fix would need, and which risks come with it. It ends in a short ranked list of first uses with effort attached. NIST, the OECD and the EU supply the vocabulary; the work itself is mapping your own processes.
What an AI readiness assessment looks at in a small company
An ai readiness assessment answers one plain question: where would AI save this company real time, and what would it take to get there safely. It is a review, not a certificate. Nobody awards a pass mark. The result is a short document that says which tasks are good candidates, which are not, and what each would need in data, people and care.
Public frameworks give the review its vocabulary. NIST, the US standards body, published its AI Risk Management Framework on 26 January 2023 and describes it as intended for voluntary use. The OECD adopted its AI Principles in 2019 and updated them in 2024. A small company does not need to adopt either in full. It borrows the questions they ask and applies them to its own handful of processes.
Step one: map the processes that eat hours
NIST's framework has four functions: govern, map, measure and manage. Its own page says the actions are not a checklist and not necessarily an ordered set of steps, and that most users begin with map. Map, in NIST's words, sets the context: the intended uses of a system and its potential impacts, which supports a first decision on whether to go ahead at all. The same order suits a company.
Start with a table of the recurring tasks in each department. For every task write who does it, how often, how long it takes, what comes in and what goes out. Ask the people who do the work, because managers describe the process and staff describe what actually happens. A week of notes from three or four people is usually enough to see the pattern: repeated copying between systems, answers retyped for the tenth customer, reports rebuilt by hand.
Step two: look at the data each task would need
A task is only a candidate if the information it needs exists in a usable form. For each one, note where that information lives: a shared drive, a mailbox, a spreadsheet, someone's head. Note whether it is current, whether two sources disagree and who has the right to see it. A process that depends on knowledge nobody wrote down needs documenting before any tool can help.
Personal data deserves its own column. If a task touches customer or staff records, mark it and treat it as a separate question for your lawyer or data protection adviser, because the answer depends on your country and your contracts. The assessment does not decide that. It makes sure the question is asked before a tool is chosen and not after.
Step three: sort the risks before you sort the tools
The European Commission describes the AI Act as a risk-based framework with four levels. Systems that threaten safety or rights are banned. Uses in areas such as employment, education and essential services are classed as high risk and carry strict obligations. Chatbots and similar systems fall under transparency rules, because people must know they deal with AI. The Commission says that most AI in use today, such as spam filters, carries minimal risk and has no specific rules.
That ladder is a handy filter, not a legal opinion. Mark each candidate task with the level it might touch: drafting internal summaries is far from screening job applicants. The OECD principles add the questions to ask on each one: is the output explainable, is the system robust and secure, and who is accountable when it is wrong. Where a task could affect a person's job, credit or access to a service, the answer is a specialist's review before anything is built.
Step four: pick the first five uses and rank them
Score every candidate on five plain questions. How many hours a month does the task take across the team. How costly is a mistake. Is the data ready. How sensitive is the risk class from step three. Can a person check the result quickly. A task with many hours, cheap mistakes, ready data and easy checking goes to the top; a task with few hours and costly mistakes goes to the bottom, however fashionable it sounds.
Keep five and drop the rest for now. Five is enough to fill a quarter of work and few enough to finish. Write each one as a sentence a colleague could test: summarise incoming enquiries into three lines and a category, so a person can answer in under a minute. If you cannot write the test, the use is not yet defined well enough to build.
Step five: estimate effort honestly and include the checking
For each of the five, estimate three kinds of effort: building it, checking it and keeping it running. The first is what vendors quote. The second is what teams forget, although NIST states that systems should be tested before deployment and regularly while in operation. The third is the ongoing price of change, since prompts, documents and tools all move. A use that saves four hours a week and needs three hours of weekly review is not a saving.
Write the effort as ranges and name what would change them. Do not invent savings you cannot support, and do not promise them to yourself. Add one line per use on what happens if it fails: who notices, how quickly and what the fallback is. NIST's manage function covers exactly this: responding to, recovering from and communicating about incidents.
Then decide an order. Usually the first use is cheap, low-risk and easy to check, because an early success teaches the team how to work with the tool. A clear no is also a result. Dropping a use after the review costs an afternoon; discovering it halfway through a build costs a project.
Where self-made assessments go wrong
The most common failure is starting from a tool instead of a task: a team picks a product, then looks for something to do with it. The second is a wish list with no ranking, which becomes a backlog nobody finishes. The third is asking only managers, so the map misses the real work. The fourth is skipping the data and risk columns because they feel like paperwork.
NIST notes that its framework is under revision and that its companion playbook is optional and not a compliance checklist, a useful reminder that no document replaces judgement. A second pair of eyes helps for a practical reason: an outsider asks why a step exists, and half the savings are found in that question.
What to prepare before ordering an AI audit
Prepare a short list of the ten tasks your team grumbles about most, with a rough weekly time for each. Name one person per task who knows how it really runs. Decide which systems hold the data and who may open them. Bring any rules you already follow on client data. This is an afternoon of work, and it makes the audit sharper and the quote exact.
VITON13 Studio sells this work as a package called AI audit: where it saves hours. You receive a map of your main processes, the top five opportunities each with its effort, tools and risks, and a suggested order to start in. Before payment, the studio describes the first two opportunities in full, so you can see the level of detail on your own business.
The fixed price is $53, and the work takes 3–5 working days. The audit does not promise savings, because they depend on how you run and what you decide to build; it gives you a ranked, costed list to decide from. The package page and the free-draft page show the exact terms.
Practical checklist
- List the ten tasks that take the most hours and give each a rough weekly time.
- Ask the people who do the work, not only managers, how each task really runs.
- For each task note where the data lives, how current it is and who may open it.
- Mark any task that touches personal data or decisions about people for a specialist's review.
- Rank the candidates and write the first five as a sentence someone can test in a week.
Questions and answers
Is an AI readiness assessment the same as an AI audit?
In practice the words overlap. Both mean a structured review of processes, data and risks that ends in a ranked list of uses. Some providers also use audit for checks of an AI system already running, so ask what the deliverable is.
Do I need to follow the NIST framework?
No. NIST describes the framework as intended for voluntary use and not a checklist. A small company can borrow its map, measure and manage questions without adopting it formally or seeking any certification.
Does the EU AI Act apply to my small business?
It can, if you use AI systems in the EU. The Commission says it applies to providers and deployers and sorts uses by risk, with most everyday uses in the lowest class. Check your own case with a lawyer.
How long does an assessment take?
The mapping can be done in days if the people who know the work are available. Most of the time goes into talking to them and checking where data lives, not into analysis. A rushed map misses the tasks that matter.
What if the assessment finds nothing worth automating?
That is a legitimate result. A review that shows the hours are small, the data is not ready or the risk is too high saves you from building something that would not pay back. Revisit it when the work or the tools change.