AI Readiness Assessment: A One-Hour Scorecard for Small Businesses

What is an AI readiness assessment?

An AI readiness assessment is a scored check of eight things AI depends on: clean data, lead and call tracking, a CRM people actually use, written processes, a named owner, privacy rules, time and budget, and one clear first job for AI. It tells you whether to buy, fix or wait.

Most owners skip this step because the tools are cheap and the demos are good. Then the chatbot answers with last year's prices, the AI follow-up emails go to a CRM full of duplicates, and nobody can say whether any of it produced a customer. The tool was never the problem. The business was not ready to feed it, check it or measure it.

The U.S. Census Bureau's Business Trends and Outlook Survey put business AI use at 19.8% nationally as of May 3, 2026. Firms with 250 or more employees were at 37%, while fewer than 20% of firms with four or fewer employees reported using AI. Small firms are not behind because they lack access to ChatGPT. They are behind because nobody has time to get the basics in shape, and that is exactly what this assessment surfaces.

How to run a one-hour AI readiness assessment

Block one hour, gather the two or three people who run sales, operations and the books, and score each area together with evidence on screen. Ten minutes to pull reports, forty to score, ten to pick the first move.

The evidence rule matters more than the scoring scale. Nobody scores from memory. If someone says "we track every call," open the call report. If someone says "the CRM is up to date," open the last 20 contacts and check them. Owners almost always score themselves a point higher than the evidence supports, and the gap between what you believe and what the screen shows is the most useful thing you will learn all week.

What to pull before the hour starts

• Your last 30 days of leads from every source: web forms, calls, texts, email, walk-ins, referrals.
• Your phone system's report of answered and missed calls for the same 30 days.
• A list of every app you pay for, from your card statements, not from memory.
• Any written process you have: a checklist, an intake script, a pricing sheet, a training doc.
• Your marketing spend by channel for the last three months.

How the hour runs

1. Minutes 0 to 10: put the reports on one screen. Agree who breaks ties (usually the owner).
2. Minutes 10 to 50: score the eight areas in order, five minutes each. Write the evidence next to each score.
3. Minutes 50 to 60: total the score, check the two knockout areas, read your band below and agree on one first move with a name and a date beside it.

Do not try to fix anything during the hour. The point is a clear picture. Fixes come after, in the order the score tells you.

The AI readiness assessment scorecard: 8 areas, 24 points

Score each area 0, 1, 2 or 3 using the descriptions below, then add them up. A 3 means you could hand this area to an AI tool tomorrow; a 0 means AI would make the current mess faster.

Two rules sit on top of the total. First, a 0 in privacy and security or in a clear first use case is a knockout: fix it before any rollout, even if the rest of your score is high. Second, if lead and call tracking scores 0 or 1, any AI aimed at sales or marketing will be impossible to judge, so treat it as a near-knockout for those projects.

Print the table, or copy it into a spreadsheet with a column for evidence. Re-run the same AI readiness assessment every quarter and keep the old scores. The trend line is more useful than any single number.

How to score each area honestly

Each area has one quick test you can run during the hour. If the test fails, the score is 1 or lower, whatever anyone believes.

1. Data quality and where it lives

Open your customer list and pick 20 records at random. Count how many have a correct phone, email, service or product, and the date of the last contact. Under 12 of 20 is a 1. Then ask where else customer information lives. If the honest answer includes "Mike's phone" or "the shared inbox," you are not at 3 yet. AI tools only see what is in the system you connect them to.

2. Lead and call tracking

Take last month's ten newest customers and try to name the channel each came from: Google Ads, Maps, organic search, referral, social. If you can name fewer than seven, score 1. Calls are where most small businesses lose the trail, because phone leads often never touch a form. Our guide to AI lead generation explains why this matters before you automate anything.

3. CRM use

Check the last ten deals or jobs. Were they all entered in the CRM, with the right stage, before the job happened? A CRM that is updated after the fact cannot trigger AI follow-up at the right moment. If you are still choosing one, start with CRM for small business, then read how AI inside a CRM changes what the system can do.

4. Documented processes

Pick the task you most want AI to help with. Is there a written version of how it should be done, with an example of a good result? If not, the AI will invent its own process, and you will not like it. Writing a one-page process with two examples is often the single highest-value step in the whole assessment.

5. People and ownership

Name the person who will check AI output every week for the first 90 days. If the answer is "everyone" or "me, when I get a chance," score 1. The owner does not need to be technical. They need time, authority to change the process and the habit of reading the output.

6. Privacy and security

Ask staff, without blame, what they have pasted into free AI tools this month. Then check whether your key accounts (email, CRM, payments) use multi-factor login. If customer data is going into free tools with no rules, score 0. That is a knockout, and it is fixable in a week.

7. Budget and time

Write down the monthly amount and the weekly hours you will commit for 90 days. Both numbers need to be real. The hours matter more than the money: most AI projects that stall at small businesses stall because nobody had time to review output, not because a subscription was too expensive.

8. A clear first use case

Finish this sentence: "We want AI to help with ____, which happens about ____ times a week, takes about ____ minutes each time, and we will know it worked when ____." If you can fill every blank with a number, you score 3. If you can't fill any, score 0.

What does your AI readiness score mean?

Your total puts you in one of four bands, and each band has one first move. Do the first move before buying anything new.

A knockout overrides the band. A business that totals 18 but scores 0 on privacy is in "foundations first" for anything touching customer data until the rules are written.

Notice that the bands move from helping people to replacing steps. That order is deliberate. Assistants that draft for a person are forgiving: a bad draft gets fixed before anyone sees it. Automations that act on their own are not forgiving, so they need the tracking, the clean data and the owner in place first.

A worked example (hypothetical)

Picture a 14-person plumbing company. Customer records live in the CRM and in two technicians' phones (data: 1). Form leads are tracked, calls are not (tracking: 1). The office uses the CRM daily, but technicians don't (CRM: 2). The booking script is written; the estimate process isn't (processes: 2). The office manager will own it with five hours a week (people: 2). There is no written AI policy and staff use free chatbots for estimates (privacy: 0). There is a modest budget for 90 days (budget: 2). The goal is "faster follow-up on unbooked estimates," with a known count of 40 a month (first use case: 3).

Total: 13, "ready for assistants," but privacy scored 0, so the first move is a one-page AI use policy that keeps customer details out of free tools. Second move: add call tracking so the follow-up project can be measured. Then AI-drafted follow-ups for unbooked estimates, sent by the office manager. In 90 days, re-score. If tracking reaches 2, automating the follow-up becomes a fair test.

Which AI use cases fit your readiness level?

Match the use case to your band. Low-readiness businesses should start with tasks where a person reviews every output; high-readiness businesses can automate tasks that touch customers directly.

The minimum score is our working rule of thumb, not a law. The point is the order. If you're at 11, an after-hours voice agent is not off-limits forever; it is just not your first project. For the phone side, our guide to the AI receptionist for small business covers the setup in detail, and AI workflow automation covers the multi-step jobs.

How an AI readiness assessment lines up with NIST and SBA guidance

This scorecard is a small-business translation of the NIST AI Risk Management Framework and the SBA's AI guidance for small businesses. You don't need to read either cover to cover, but it helps to know what they ask of you.

NIST released the AI RMF 1.0 on January 26, 2023, for voluntary use, and added a Generative AI Profile (NIST AI 600-1) on July 26, 2024. The framework organizes the work into four core functions: Govern, Map, Measure and Manage. Here is how they map to the eight areas:

The SBA's advice is shorter and very practical. It says AI is relatively new, so start small. It warns against feeding sensitive data or proprietary information into AI tools, advises that a person assess all the messages and outreach AI generates, and suggests considering a public statement that discloses how your business uses AI. It also suggests a consultation with your attorney if you have one. Every one of those points shows up in the scorecard above.

For the privacy area, the FTC's long-standing guide, Protecting Personal Information: A Guide for Business, still gives the simplest checklist: take stock, scale down, lock it, pitch it and plan ahead. Apply it to AI tools exactly as you would to any vendor that touches customer data. None of this is legal advice; regulated businesses such as medical, legal and financial practices have extra rules and should check them with counsel.

Where AI goes wrong, and the readiness gap behind each failure

Almost every AI failure we see in small businesses traces back to a low score in one of the eight areas. The guardrail is to fix that area, not to swap tools.

The last row is the one owners underestimate. AI tools do not announce that they have stopped working. A form changes, a field is renamed, an integration token expires, and the follow-up simply stops. A weekly test, done by a person or a scheduled check, catches it in days instead of months.

What we'd do first: a 30/60/90-day plan after your AI readiness assessment

Spend the first 30 days on the lowest-scoring area, the next 30 on a small pilot, and the last 30 measuring and deciding. Here is the plan we'd follow for a business scoring in the middle bands.

For businesses in the "foundations first" band, stretch days 1 to 30 to days 1 to 60. For "ready to build" businesses, the pilot can be a scoped custom build; our guide to custom AI solutions covers how to decide between building, buying and configuring.

The Monday-morning version

1. Book the hour and invite the two or three people who know the numbers.
2. Pull the five reports listed above.
3. Score the eight areas with evidence, check knockouts, read your band.
4. Put one first move on the calendar with a name next to it.
5. Put the next quarterly re-score on the calendar too.

What we've built, and what each build needed first

Every AI system we've built for ourselves or a client depended on the same readiness basics: tracked leads, structured data, an approved playbook and a person who reviews the output. Four examples show how.

UnifiedIQ: tracking before intelligence

Problem: we could not run AI on client marketing until every lead was traced.

What we built: UnifiedIQ, our own platform, where 29 AI agents across eight departments watch each client's website, Google presence, calls, CRM and ads. Forms from 8 popular form plugins, its own form builder, GoHighLevel forms, calls and taps on the phone number land in one inbox with their source attached. Spam and job seekers are sorted out, and every Monday a test lead checks each form still works.

What a person still does: Adam and the team set strategy and approve everything that goes out. Nothing goes out under a client's name without a person approving it. That weekly test lead is the "tool dies quietly" guardrail from the table above, built into the system.

Form to CRM in seconds

Problem: AI follow-up is useless if the lead arrives in the CRM late, untagged or with answers in the wrong fields.

What we built: a hand-off from the website form into the client's GoHighLevel CRM. The lead lands as a contact, tagged, with the visitor's answers in the right fields, within seconds, so the client's own CRM automations fire. In an October 2026 test it took about 3 seconds. With the CRM connected, booked and won jobs can be sent back to Google Ads so bidding chases buyers, not clicks.

What a person still does: the business owns the conversation once the lead engages. Their lead email shows the contact and answers only; our team gets a separate copy with the full source.

A live call assistant that started with a playbook

Problem: a South Florida wellness practice's front desk handled the same objections on every call: price, insurance questions, fear, "let me think about it."

What we built: a live call assistant, piloted in 2026, that suggests responses during the call from a playbook the practice approved, then drafts the call notes for the CRM.

What a person still does: runs the call. The AI only suggests, and on insurance the approved line is "we'll verify your benefits," never a promise of coverage. The written playbook came first. Without it (area 4, documented processes) there would have been nothing safe to suggest.

HuntReserve: structure first, then automation

Problem: hunting outfitters needed bookings, waivers and inquiries in one structured system, without paper waivers.

What we built: a custom CRM and booking platform with 9 drag-and-drop pipeline stages, digital waivers (zero paper waivers), a form builder that records the page each inquiry came from, a customer portal and automated reminders.

What a person still does: works the pipeline and talks to the hunters. The reminders only work because every booking sits in a clear stage. See the HuntReserve case study.

Do it yourself, or bring in help?

Run the AI readiness assessment yourself first; it is free and takes an hour. Bring in help when the score points to work you lack the time or skills to do, usually tracking, CRM cleanup or a custom build.

Here is how we'd split it. If your gaps are policy, ownership and a first use case, you can close them yourself with this guide. If your gaps are tracking and attribution, a marketing audit finds where leads are leaking and what is not being measured, so any AI you add later can be judged on real numbers. If you score in the middle bands and want a sequenced plan for which AI projects to run, in what order, tied to revenue, that is what our consulting and strategy engagements produce.

When the score says "ready to build," our custom AI tools and intelligent workflows teams build on the systems you already use, and analytics and reporting keeps every number sourced. Businesses in our home markets can also see AI software development in New Jersey and AI software development in Broward County.

Questions to ask anyone selling you an AI readiness assessment

• Will you look at our actual data and reports, or only interview us?
• Does the result name one first move with an owner, or a long list of tools?
• How will we measure whether the first project worked?
• Are you also selling the tool you'll recommend? If so, how do you handle that conflict?
• Will we get the scorecard so we can re-run it ourselves next quarter?

For the bigger picture on where AI pays off first, read AI for small business. If your team is already using chat tools day to day, ChatGPT for small business covers the rules and prompts that keep that safe.

AI readiness assessment questions, answered