Self-scoring check
Is your business
ready for AI?
Ten questions, ten minutes, scored as you go. Nothing is sent anywhere — it runs in your browser and vanishes when you close the tab. Be honest with it; a flattering score is no use to anybody.
AI readiness for a small business comes down to ten things: knowing where AI touches your business, staff on business-tier accounts, training switched off on consumer accounts, AI mentioned in your privacy notice, a written staff policy, no special-category data in general AI tools, a human checking output, no AI making final decisions about people, customer-facing AI that identifies itself, and a security review of anything you have built yourself.
Published
The ten-point check
Tick the ones you can honestly say are true today. If you are not sure, leave it unticked — "I don't know" is a finding, not a pass.
Your score
0 / 10
Tick the items above to score.
Nothing is stored or sent anywhere. Screenshot it if you want to keep it.
Why these ten
Because they are the ten that come up. This is not a framework borrowed from enterprise compliance and shrunk down — it is the list of things I actually find missing when I look at a small business, in roughly the order they cause trouble.
Notice what is not on it. Nothing about having an AI strategy, an innovation roadmap, or a governance committee. A six-person firm in Cornwall does not need any of that, and anyone selling it to you is selling something. What you need is to know where AI is, what it can see, and who is accountable for what it produces.
Notice too that a firm using barely any AI can score ten out of ten. Readiness is not adoption. It is knowing where you stand, which is exactly what makes adopting more of it later a straightforward decision rather than a leap.
What to fix first
The ten items are not equal, and treating them as a list to work through in order is the wrong approach. Two of them account for most of the real-world harm.
- 01
Items 2 and 3 — the accounts. Staff on consumer accounts with training enabled is the most common actual data exposure in small business. Moving daily users to a business tier fixes it in an afternoon and costs less than most people expect. The full explanation is here.
- 02
Item 4 — the privacy notice. One paragraph. This is the one that turns a defensible practice into a breach purely through silence.
- 03
Item 5 — the staff policy. The thing that makes items 2, 3, 6 and 7 stick rather than being a decision you made once. There is a free template here — copy it and put your name on it.
- 04
Everything else. Genuinely important, but they are either less likely to bite or they only apply if you are doing the specific thing described.
Three items, one afternoon, and most of the exposure gone. That is the honest shape of this for a typical small firm, and it is a lot less than the compliance industry would have you believe.
Where a proper review goes further
Being straight about the limits of a self-assessment, because that matters more than getting you to book something.
A checklist tells you what you believe is true. It cannot tell you what your staff are actually doing, which is frequently different and always more interesting. It cannot read your privacy notice and tell you whether the wording holds up. It cannot look at a tool you have built and find the API key sitting in the browser. And it cannot tell you whether the contract you signed with a client restricts how their data gets processed.
That is what a readiness check does: I look at what is actually happening rather than what is supposed to be, and you get a written report with a short list of what to fix and what it will take. Fixed price, and if the honest answer is that you are already fine, I will tell you that and charge you accordingly.
Straight answers
- What does "AI ready" actually mean?
- It does not mean you are using AI heavily. It means that wherever AI touches your business, you know it is there, you know what data it sees, someone checks what it produces, and you have told the people whose data it is. A firm using no AI at all can be perfectly ready; a firm using it everywhere with none of that in place is not.
- How long does this take?
- Ten minutes to score. Most of what it flags is an afternoon of work. The exception is moving staff onto business accounts, which is a decision rather than a task.
- Is a low score a disaster?
- No. Most small firms score badly the first time and there is nothing shameful in it — none of this was on anyone’s radar three years ago. The point of scoring is knowing which two or three things to fix first, not passing a test.
- Do I need to fix everything?
- No. The items are not equal. Staff on consumer accounts with training left on, and no privacy notice mention, cause most of the actual harm. Fix those two and you have removed the majority of your exposure.
- Is my score stored anywhere?
- No. It runs entirely in your browser and nothing is sent anywhere. Nothing is saved when you close the page, so screenshot it if you want to keep it.
- What if I do not know the answer to some of these?
- Then leave them unticked, and treat "I don’t know" as the finding. Not knowing which accounts your staff use, or whether a tool trains on your data, is itself the gap. Most of the value here is in discovering the questions you cannot answer.
Read next
Can I put customer information into ChatGPT?
The single most common way small firms leak data. When it is fine, when it breaches UK GDPR, and how to make it safe.
A one-page staff AI policy you can actually use
Free template. What staff may and may not put into AI tools, which tools are approved, who checks the output. Prevents most incidents before they happen.
Want someone to do this properly with you?
A fixed-price AI-readiness check goes where a self-assessment cannot: what your staff are actually doing rather than what you think they are, the real state of your privacy notice, and an honest view of what is already exposed. You get a written report and a short list of what to fix.
Ask about a readiness check