An AI readiness checklist for small businesses
Most automation projects that fail were doomed before the first line was built. This ai readiness checklist for small businesses is the set of checks we run in a first conversation: six conditions that predict whether a build will land, what a not-ready answer looks like, and the cheap fixes that change it.
What makes a business ready to automate?
Six things: a process someone can describe consistently, data the automation can actually reach, a named owner, enough volume for the arithmetic to work, tolerance for a human review step, and basic security hygiene. None of them involves AI expertise, and most can be established in a week or two of ordinary management effort.
| Checklist item | Why it matters | Quick test |
|---|---|---|
| Documented process | You cannot automate what nobody can describe consistently | Ask two people to walk through it; do they describe the same steps? |
| Accessible data | An automation can only act on data it can reach | Can the key system export a spreadsheet or offer an API? |
| A named owner | Unowned automations degrade silently after handover | Who checks the error queue in week twelve? Name them now |
| Real volume | Payback needs repetition; rare tasks never repay a build | Minutes per occurrence × occurrences per month — would you notice the time back? |
| Tolerance for review | Early output needs a human check before it reaches customers | Is someone willing to approve drafts for the first month? |
| Security basics | Automation concentrates account access; weak hygiene concentrates risk | Two-factor authentication on, shared passwords gone, offboarding checklist exists |
Why does the documented process come first?
Because inconsistency is invisible until you try to automate it. When two people do "the same" task with different rules, a human absorbs the difference; software cannot. Writing the process down as it is actually done — not as the manual says — takes an afternoon and surfaces the exceptions that would otherwise surface mid-build, at many times the cost.
What does "not ready" look like?
The process lives in one person's head. The data sits in a system with no export and no API. Nobody can say who owns the automation after handover. Leadership expects unsupervised perfection from day one. Or the candidate task happens twice a month, so no build can ever repay itself. Every one of these is common, and none is fatal.
The fixes are mostly cheap. Documentation is an afternoon with the person who does the work. Ownership is a decision. The review-step expectation is a conversation about how these systems actually mature. Security basics are configuration, not procurement. Only locked-up data sometimes needs real technical work, and that is a scoping question we handle in AI consulting engagements before any build is priced.
Where does risk management fit for a small business?
You do not need an enterprise governance programme, but the shape of one is worth borrowing. The NIST AI Risk Management Framework boils down, at small-business scale, to knowing what the system does, who is accountable for it, and what happens when it is wrong. The review-step and named-owner checks above are exactly that, sized for a team of ten rather than ten thousand. The same thinking should shape how you question vendors — our list of AI vendor security questions covers what to ask anyone, including us.
Ready — what should you automate first?
Not the hardest problem. The right first project is high-volume, rule-heavy, and low-drama, because it proves the approach and builds the review habit before anything customer-facing is at stake. Our guide to choosing what to automate first walks through that selection in detail.
Common questions about readiness
Do we need clean, perfect data before starting?
No — you need reachable data, not perfect data. If the information the process uses lives in systems with export or API access, that is enough to start. What genuinely blocks projects is data that exists only in one person's head, in unsearchable scans, or in a legacy system nothing can connect to.
How much volume makes a process worth automating?
There is no magic threshold, but the test is simple: multiply the minutes per occurrence by occurrences per month, and ask whether you would notice getting that time back. A task done twice a month rarely justifies a build regardless of how annoying it is; a ten-minute task done thirty times a day almost always does.
What does not ready actually look like?
The process lives in one person's head and is done differently each time; the data sits in a system with no export or API; nobody can name who would own the automation after handover; or leadership expects it to run unsupervised from day one. Each of these is fixable, and fixing it first is far cheaper than discovering it mid-build.
Can a business fix a not-ready answer without outside help?
Mostly, yes. Writing the process down as it is actually done takes an afternoon. Naming an owner is a decision, not a project. Turning on two-factor authentication and a password manager is a week of nagging. The only fix that sometimes needs help is data access, when a legacy system requires a migration or an integration workaround.
Free consultation
Tell us what is costing you the most time
Describe the process. You get a straight read on whether it is worth automating, roughly what it would take, and what we would tackle first — on a call that costs nothing.
- Under an hour, free, and no obligation
- Fixed price per stage, agreed before any work starts
- You own everything we build, documented and in your accounts
- If you do not need us, we will say so on that call
The form is the fastest way to reach us — we reply from a real person, usually within one business day.