AI Readiness Checklist

Know what you're using before you do anything else.

• List every AI tool your team or business currently uses
• Note what each tool is used for and who uses it
• Identify which tools handle customer, client, or personal data
• Check whether any tools were adopted informally (without a review)
• Document which AI tools are free/trial vs. paid with contracts

Understand where AI is doing real work — and where the stakes are higher.

• List the specific tasks or workflows where AI is involved
• Flag any use cases that affect decisions about people (hiring, pricing, eligibility)
• Flag any use cases involving sensitive data (health, financial, legal, personal)
• Note which use cases are customer-facing vs. internal-only
• Rank each use case as low, moderate, or high risk based on impact if something goes wrong

You don't need a manual. You need a few clear rules.

• Write a simple AI acceptable use policy (even one page counts)
• Define which AI tools are approved and which are off-limits
• Set rules for what data can and cannot be put into AI tools
• Require human review for AI outputs used in important decisions or external communication
• Share your policy with everyone who uses AI — don't just file it away

Know what you're agreeing to when you use an AI tool.

• Read the privacy policy and terms for every AI tool you use
• Check whether tools use your data for training (and whether you can opt out)
• Verify where your data is stored and processed (especially for regulated data)
• Review vendor security practices — encryption, access controls, breach notification
• Keep a record of your review for each tool so you don't repeat the work

Know which rules might apply — you don't need to be an expert.

• Check whether the EU AI Act applies to you (do any AI outputs affect people in the EU?)
• Check whether U.S. state AI laws apply (especially for hiring, lending, or insurance uses)
• Identify any sector-specific rules that apply (HIPAA, FCRA, ECOA, etc.)
• Review the NIST AI Risk Management Framework as a baseline reference
• Take the AIRegReady readiness assessment for a quick overview

Readiness isn't a one-time project. Build a few simple habits.

• Review your AI inventory when you add or remove tools (at least quarterly)
• Revisit your acceptable use policy as your AI usage changes
• Monitor regulatory developments in your industry and geography
• Keep records of AI-related decisions for auditing if needed
• Reassess your risk profile as your use of AI expands