AI Readiness Checklist: 20 Points for Mid-Market Leaders

This AI readiness checklist is a 20-point self-assessment for Australian mid-market leaders who want an honest answer to one question before spending anything: is our organisation actually ready to deploy AI safely and profitably? Work through the five groups below — data and systems, use cases, governance and risk, people and adoption, and commercial return — tick the items that are genuinely true today, and use the scoring guide at the end to read your result. It takes about fifteen minutes and it is deliberately blunt.

Most AI projects in the mid-market do not fail on the model. They fail because the data was not ready, the use case was never going to pay back, or nobody owned the risk. This checklist is the public version of the deeper diagnostic we run in our AI Readiness Audit. Score yourself honestly; a low score is useful information, not a verdict.

Group 1 — Data and systems

AI runs on your data, not on the vendor's demo data. If this group scores low, everything downstream is at risk. This is the single most common reason pilots fail.

• We know where the relevant data lives. For a candidate process, we can name the systems, files and databases that hold the data an AI system would need — without a three-week discovery exercise.
• The data is accessible, not locked in PDFs or a founder's inbox. The information can be reached programmatically or exported cleanly, rather than trapped in scanned documents, screenshots or one person's head.
• The data is reasonably clean and consistent. Fields mean the same thing across records, duplicates are manageable, and we are not relying on free-text notes that only a few staff can interpret.
• We have a system of record we trust. There is an authoritative source for the key data, rather than four spreadsheets that disagree with each other.

Group 2 — Use cases

Readiness is not abstract. It attaches to a specific workflow. A firm can be ready for one process and hopelessly unready for another.

• We have a specific process in mind, not "AI generally". We can name the workflow — quote drafting, invoice triage, workpaper review — rather than gesturing at the category.
• The process is high-volume or high-cost. The workflow happens often enough, or ties up enough senior time, that automating even part of it is worth the effort.
• The process is rule-bound or document-heavy. It involves reading, classifying, extracting or drafting against known patterns — the work AI is genuinely good at — rather than novel judgement calls every time.
• We can define what "good" looks like. We could hand a new employee the task and grade their output, which means we can measure an AI system against the same bar.

Group 3 — Governance and risk

This is where regulated Australian firms are most exposed and most often underprepared. If AI touches customer decisions, this group is not optional.

• We know which regulations apply. We understand our obligations under the Privacy Act 2026, and where relevant APRA CPS 230, before we deploy — not after an incident.
• We can explain automated decisions. Where AI would influence a decision about a person, we can meet the automated-decision transparency requirements and the APP 11 security obligations that come with it.
• Someone owns AI risk. A named person or committee is accountable for approving, monitoring and, if needed, switching off an AI system.
• We keep a human in the loop where it matters. For consequential decisions, there is a defined point of human review rather than blind acceptance of the model's output.

Group 4 — People and adoption

An AI system nobody uses returns nothing. Adoption is a readiness question, not an afterthought.

• Leadership sponsors this, visibly. A senior sponsor is willing to back the work publicly and hold the line when the first results are imperfect.
• The affected team has been involved, not surprised. The people whose work changes have been consulted, and the framing is augmentation of their work rather than a quiet plan to remove it.
• We have someone who can own the tool internally. After handover, a capable internal owner can run, monitor and adjust the system rather than depending on an external party indefinitely.
• We have realistic expectations. Leadership understands AI will be wrong sometimes and needs guardrails, rather than expecting flawless output from day one.

Group 5 — Commercial and ROI

If you cannot describe the payback, you are not ready to fund it. This group keeps the exercise honest.

• We can estimate the current cost of the process. We know roughly what the workflow costs today in hours, salaries or error rework — the denominator for any return calculation.
• We have a budget owner. Someone can actually approve spend and is expecting to, rather than hoping AI will be free.
• We have checked R&D Tax Incentive eligibility. Where the work involves genuine technical experimentation, we understand the 43.5% refundable offset may apply to eligible activities and have factored it into the business case.
• We would still proceed if the payback took a year. We are funding a capability, not chasing a one-week miracle, and the appetite matches the timeline.

How to score yourself

Give yourself one point for each item that is genuinely, provably true today — not "we could get there" or "someone probably knows". Add them up out of 20.

• 16–20 — Ready. You have a fundable, defensible case. The value now is sequencing: picking the right first workflow and building it with governance from the start. A short audit sharpens the plan; you likely do not need one to know you can proceed.
• 10–15 — Nearly there. The foundations exist but there are real gaps — usually in data cleanliness or governance ownership. This is exactly the band where a two-week diagnostic pays for itself, because it tells you what to fix first and in what order.
• Below 10 — Not yet, and that is fine. Deploying AI now would most likely produce an expensive, sceptical pilot. The useful move is to fix the highest-scoring gaps — commonly data accessibility and a named risk owner — before spending on a build.

A low score is not a failure. Finding it out in fifteen minutes, or in a two-week audit, is far cheaper than discovering it nine months into a stalled project.

Frequently asked questions

Is this the same as your paid AI Readiness Audit? No. This checklist is the public, self-serve version. The audit goes far deeper: evidence-based scoring, a prioritised use-case shortlist, a governance gap analysis mapped to the relevant Australian regulations, and an R&D Tax Incentive eligibility memo — delivered fixed-fee in two weeks by senior practitioners. For the full picture of what that involves, see what an AI readiness audit actually is.

What if we score well on everything except data? That is the most common pattern we see, and it is the right thing to fix first. A strong use case sitting on inaccessible or inconsistent data will not work regardless of the model.

How often should we redo this? Whenever the context changes materially — a new candidate process, a new regulation taking effect, or after you have closed the data and governance gaps a previous run surfaced.

---

If your score lands in the "nearly there" band — which is where most mid-market firms sit — the fastest way forward is a two-week AI Readiness Audit: fixed-fee, senior-led, ending in decision-grade artefacts you can put in front of a board. We will also share a downloadable version of this checklist so you can score your leadership team before you book.