A Practical AI Readiness Checklist for Small Businesses

Score each statement 0, 1 or 2: zero means no; one means partly or informally; two means yes with evidence. The maximum score is 50. Complete the checklist for one use case, not “AI across the business.”

Process and value

1. We can name the exact task and its trigger.
2. We know current volume, cycle time and error/rework rate.
3. We know who receives and uses the output.
4. We can explain why AI is preferable to a form, rule or ordinary workflow.
5. The expected benefit is large enough to measure.

Data and examples

1. We have representative normal and edge-case examples.
2. Required fields are available and sufficiently consistent.
3. We know which inputs contain personal, confidential or regulated information.
4. We have authority to use the information for this purpose.
5. Retention, deletion and export requirements are understood.

Ownership and workflow

1. One business owner is accountable for the outcome.
2. A knowledgeable employee can test output quality.
3. Exceptions have a named destination.
4. The human approval point is explicit.
5. We can operate temporarily if the AI or vendor is unavailable.

Privacy, security and risk

1. Vendor data-use and model-training terms have been reviewed.
2. Access uses named accounts, least privilege and strong authentication.
3. Sensitive information is removed or minimized where possible.
4. We have considered inaccurate, biased or harmful outputs.
5. An incident or material error has an escalation path.

Testing and change

1. Acceptance criteria are written before configuration.
2. A test set includes ordinary, edge and deliberately poor inputs.
3. We can run beside the current process before replacing it.
4. Staff affected by the change will participate in testing and training.
5. There is a stop, rollback and post-pilot review decision.

Interpret the score

Worked example: customer email triage

A 14-person service company scores 37. It has a measurable inbox backlog, a clear service coordinator and good historical emails. It loses points because customer messages include addresses and account details, vendor terms have not been reviewed, and nobody has defined how low-confidence cases will be handled.

The right next move is not launch. It is to remove unnecessary fields, review the vendor arrangement, create confidence thresholds, route exceptions and assemble a labeled test set. Those actions may take a week and dramatically improve the quality of the pilot.

NIST organizes AI risk work around govern, map, measure and manage. Canada's privacy commissioners emphasize necessity, proportionality, transparency, data minimization and meaningful safeguards. The checklist translates those principles into small-business operating questions; it does not replace a privacy impact assessment or legal review.

This checklist is general operational guidance. Privacy, employment, sector and provincial requirements vary; obtain qualified advice where appropriate.