An AI readiness assessment for a mid-market company is ten plain questions, and most of them are about people, data rules and reporting rather than technology. A company can answer all ten on two pages in about a week. This article is for the private equity operating partner or deal team member who has to assess a company, and for the portfolio-company CEO who will be asked.
I was COO and then President of a public company that closed more than 40 acquisitions, and I ran the integration on most of them. Now I write fixed-fee AI plans for CEOs of private-equity-backed and owner-led mid-market companies through 013 Labs.
Why most "AI readiness" assessments measure the wrong thing
Many assessments produce a tool inventory and a maturity score: which software the company licenses and a number from one to five. That looks rigorous and tells a board almost nothing.
A mid-sized company rarely fails at AI for lack of a platform. It fails because nobody decided who may use what, nobody owns the result, and nobody wrote down what must never happen. A tool list cannot show any of that. Neither can a maturity score, because a company with ten tools and no owner scores higher than a company with one tool and a clear rule.
So this assessment asks three things instead: who decides, who owns, and what must never happen. Everything below is a version of one of those three.
The ten questions
Each question is worded the way a diligence team would put it, with why it is asked, what a good answer sounds like, and who answers.
1. Where is AI already being used in the company, including by people nobody told to use it?
Why it is asked: Use almost always starts before any decision, with quotes, invoices or customer records pasted into public tools to save an hour. A good answer: A short written list, gathered by asking people rather than checking invoices, that names each use and what information goes into it. Who answers: The COO, with help from the person people already ask about AI.
2. Who is accountable for AI use at the company, by name?
Why it is asked: A committee or a department is not an owner. When something goes wrong, someone has to be the person the board calls. A good answer: One name, with a few hours a week of real time and the authority to say no. Who answers: The CEO.
3. Who are the people already using AI well, and what is each allowed to build?
Why it is asked: Most companies already have someone colleagues turn to when a spreadsheet misbehaves. Without a written scope that person is a risk; with one they own a result. The free guide to spotting your AI champion covers how to find them. A good answer: Two or three names, each with a written scope: what they may build, what they must never touch, and who signs off. Who answers: The CEO and the COO together.
4. What is on the never-build list?
Why it is asked: A buyer or lender wants to know the limits before it hears the ambitions. A good answer: Three to five lines, starting with this one: nothing that sends money, signs a contract or makes a promise to a customer without a named person's approval. Who answers: The CEO, with the General Counsel or outside counsel.
5. What is the rule for customer and employee data in AI tools?
Why it is asked: This is where the legal and reputational exposure sits. A good answer: One sentence, written down and sent to everyone: which tools are approved, and that nothing else receives customer, employee or pricing data. Who answers: The General Counsel, or the CFO where there is no in-house counsel.
6. Which contracts, customers or regulators restrict how you may use AI?
Why it is asked: Some customer agreements, lender terms and industry rules limit what can be shared with outside software. Missing one can cost more than the tool ever saved. A good answer: A named person has checked the customer and lender terms that matter most and noted the restrictions, even if the list is short. Who answers: The General Counsel.
7. Which vendor claims about AI has the company accepted, and who checked them?
Why it is asked: Vendors describe nearly every product as AI, and a company that buys on a pitch alone is paying for a promise. A good answer: For each purchase, a short note covering what it replaces, who owns it, how the company will know it worked, and what happens to the data. Who answers: The CFO.
8. How would the company know if an AI tool made a mistake?
Why it is asked: Tools fail quietly, and a wrong figure in a quote can travel a long way before anyone notices. A good answer: Each use has a named person who checks the output and a rule for what gets reviewed by a human before it goes out. Who answers: The COO.
9. Does the monthly reporting hold together well enough to build on?
Why it is asked: AI applied to numbers nobody trusts only makes the confusion faster. A good answer: One set of monthly numbers that the owner, the lender and the managers all accept, with a clear person responsible for producing them. Who answers: The CFO.
10. What will the board be told each quarter, and who writes it?
Why it is asked: An assessment that is done once and filed is stale in a season. The board needs a regular, short answer. A good answer: A one-page written update, owned by one person, covering what changed, what it cost and what could go wrong. Who answers: The CEO, with the CFO.
How to score the answers without a scorecard
Skip the numbers. For each question, put the answer in one of three bands:
- No written answer. People may know the answer, but it exists only in someone's head.
- Written but not owned. There is a document, but no named person is responsible for keeping it true.
- Written, owned and reviewed. A named person wrote it, answers for it, and has looked at it again in the last quarter.
A company that lands most questions in the third band is ready in the sense that matters. A company with most answers in the first band has not failed. It has a short list of things to write down.
What the assessment should produce
One written answer, about two pages long, that a board member who was not in the room can read in five minutes. It should contain the ten questions, the answer to each in plain English, the band each one sits in, and a short list of the next three things to write down. The board keeps it, and the same document gets updated every quarter instead of replaced.
It is not a slide deck, a vendor shortlist or a maturity chart. The agenda and the ten questions are on one page: AI board briefing template.
Where this fits before and after a deal
Before a deal, the ten questions belong in diligence next to the questions about contracts and key people. They are quick to ask and hard to fake.
If you are the owner on the other side of that table, preparing to sell, the same questions are worth answering a year or two early: Does AI make my business worth more when I sell?
After close, the same answers become the starting point for the plan. The first 100 days after the deal shows where the AI question tends to land in the sequence, and where AI fits in post-merger integration explains which integration jobs it helps and which it does not.
Mistakes that repeat
- Starting with a tool list. It answers a question the board did not ask.
- Assigning the answer to IT. Who decides, who owns and what is forbidden are business decisions.
- Naming a committee as the owner. A committee cannot be called at night when something goes wrong.
- Leaving the data rule for later. It is the cheapest control and the first a buyer's lawyers look for.
- Doing it once. An assessment not renewed each quarter becomes a file nobody opens.
Frequently asked questions
What is an AI readiness assessment?
A short, structured look at whether a company can use AI safely and usefully. For a mid-sized company it means ten plain questions about who decides, who owns each use, what data may be shared, and what must never be built, answered in writing.
What does private equity look for in AI due diligence?
Mostly the same things it checks elsewhere: a named owner, written rules, clean reporting and no hidden exposure. Investors want to know where customer data is going, what contracts restrict it, and whether the CEO can answer the board's question without a list of software.
How long does an AI readiness assessment take?
For a mid-sized company, about a week. Most of the time goes to asking people what they already use and getting leaders to commit answers to paper.
Do we need an outside firm to run it?
Not necessarily. A CFO or COO with time can run the ten questions internally. An outsider helps when nobody has the hours, when a board or buyer wants an independent read, or when the honest answers are uncomfortable for the person asking.
What happens if we score badly?
Nothing dramatic. A weak first assessment gives you a short list to write down and assign. The real risk is not asking, because the gaps then surface in front of a lender or a buyer.
Not sure where you stand? Take the 3-minute AI readiness scorecard.