What does AI readiness mean for a team?
AI readiness, for a small or mid-size team, means the practical conditions are in place for people to use AI tools on real work safely and to get better at it. It is not a measure of how advanced the company is, and it is not a judgement about any individual. A team of keen early adopters can be unready if nobody knows what data may go into which tool.
The checklist below covers four areas: tool access, information boundaries, a task with a review standard, and support. Each has a few questions you can answer in a short meeting. Unanswered questions become actions with an owner. NIST's AI RMF Playbook, in its guidance on training personnel, suggests training suited to different roles and defined escalation paths for risk concerns; this checklist turns those ideas into team-level questions, and is an operational adaptation rather than anything NIST endorses.
What is on the AI readiness checklist?
Answer each question with yes, no or not sure. A not sure is useful; it usually points to the most important conversation.
1. Named tool
Can every person name the exact AI service and account type approved for work?
2. Working access
Can each person actually sign in to that tool today, without using a personal account?
3. Findable guidance
Can someone find the current AI guidance in under a minute, without asking anyone?
4. Information examples
Can people give one example of information that may go into the tool, one that may not and one they would ask about?
5. A person to ask
Is there a named person who answers grey-area questions within a working day or so?
6. A first task per role
Has each role got one low-risk, recurring task chosen for practice?
7. A visible standard
Are the criteria for a good result written down before anyone submits work?
8. A qualified reviewer
Is there someone with the domain knowledge to review that task's output?
9. Protected time
Has the manager set aside regular short slots for practice that are not cancelled first?
10. Disputes and questions
Do people know how to challenge feedback or raise a concern about a tool's output?
11. Clear visibility rules
Have people been told what managers will and will not see about their practice?
12. A review date
Is there a date to revisit the checklist after the first practice cycle?
Does the team have a clear approved tool?
Readiness starts with one named tool that people can actually use. Name the exact service, plan and account arrangement, such as a company workspace rather than personal accounts. Check whether each learner can access it and whether the intended task is permitted under the provider's terms and your own rules. General enthusiasm about AI does not resolve account access or an unclear information boundary.
Ask someone to find the current approved-tool guidance without help. If they cannot, make it easier to locate and name the owner who maintains it. This is a practical preparation check, not a finding that a particular service is secure or legally suitable for every task.
Are the information boundaries understandable?
Boundaries are understandable when people can sort real examples correctly without looking them up. Choose an allowed, a restricted and an uncertain example from the intended workflow. Ask employees to explain where each belongs and whom to contact about the uncertain case. Use fictional examples during that discussion rather than introduce sensitive data merely to test the rule.
A statement that a provider does not train on your data does not settle retention, access or contractual permission. Keep those questions separate in tool approval. The checklist helps expose an unresolved decision; it does not replace the people responsible for making it. The AI policy guide for small businesses covers how to write these boundaries down.
Is there a task and a visible review standard?
There should be at least one role-relevant deliverable per role, with enough source material to check and criteria published in advance. Say what context is needed, which claims require evidence and what a learner should explain after editing. Make sure a reviewer has the domain knowledge to assess the actual work.
Keep confidence and performance separate. A self-rating can identify concerns but cannot show that a person knows how to check a source. A practical sample shows a bounded piece of work, not universal competence or a prediction of productivity. The skills assessment guide explains how to build such a task and its rubric.
Want to see how this connects to a role?
Explore the planned team trial ↗Can the team sustain the review routine?
A routine is sustainable when a named reviewer, regular practice time and a way to handle disputes all exist. If nobody can review an output, adding more tasks makes the programme harder to understand. Start with a routine the manager can support and improve it with actual observations.
Be explicit about visibility. People practise more honestly when they know a manager sees progress on skills, not every word they typed into a tool.
What does the checklist look like in use?
A fictional 35-person property management firm, Ashby Lettings, runs the checklist in a 40-minute team meeting. It has a company workspace for one AI assistant, which everyone can access, so items 1 and 2 are yes. Item 3 fails: the guidance is in a long email from spring that half the team cannot find.
Item 4 produces the most useful discussion. Staff agree that a draft listing description is fine and a tenant's bank details are not. Nobody is sure about a tenant's maintenance complaint that includes their name and flat number. That uncertainty becomes the most important action: the operations lead will decide the rule and add the example to the guidance.
Items 6 to 8 are partly in place. Lettings negotiators have an obvious first task, drafting listing descriptions from supplied property facts, and a senior negotiator can review it. The accounts team has no chosen task yet. Item 9 fails because practice keeps being dropped for viewings, so the manager books a recurring 15-minute slot on Tuesday mornings.
The result is not a score. It is five actions, each with an owner and a date, and a review after the first month. That is the purpose of a readiness checklist.
What should you do about each gap?
Most gaps have a small, specific fix. The table pairs common gaps with a first action.
| Gap | First action | Owner to name |
|---|---|---|
| No agreed tool | Choose one approved tool and plan for the first practice tasks. | Whoever approves software spend |
| Guidance cannot be found | Put a one-page summary where people already look. | The policy owner |
| Grey-area data | Decide the rule for the most common uncertain example and publish it. | Operations or data protection lead |
| No task for a role | Pick one recurring, low-risk deliverable with a checkable answer. | The role's manager |
| No reviewer | Pair the role with a senior colleague or narrow the task until someone can review it. | The team lead |
| No practice time | Book a short recurring slot and protect it for a month. | The line manager |
How does the online self-check relate to this checklist?
The linked self-check asks five questions drawn from these areas and summarises your answers with equal editorial weights. It runs in your browser, does not submit answers and has no validated pass threshold. Use it to open the conversation, then work through the full checklist here for the detail.
Turn each unresolved item into an action with an owner and a review date. Revisit the checklist after the first practice cycle and record which decision changed, rather than treat the first result as permanent.
When is a readiness checklist not enough?
A checklist tells you whether practice can start, not whether anyone is skilled. Once the conditions are in place, look at real work samples. It also does not replace legal, security or data protection advice; if your answers raise a question about contracts, regulated data or a high-risk use, take it to someone qualified. This page is general information, not legal advice.
Tosheo.ai is planned to help once the conditions are in place, with a diagnostic, role-specific practice and a manager view of progress. It is pre-build, and it will not decide your information rules or approve tools for you.