In short
- AI readiness is how well an agency's people, data, rules, processes and technology are prepared to use AI safely and usefully. It is not the same as having bought a tool.
- Check six things: purpose, people, data, governance and ethics, processes, and technology and procurement.
- Start with data. The UK Government Digital Service said in June 2026: “Good data managed poorly is not AI ready.”
- Match your ambition to your readiness. Small, well-chosen use cases build the skills and trust that larger ones need.
- Score each check on a simple three-level scale, then fix the weakest link first.
Many government AI plans begin with a tool and end with a pilot that never scales. A cheaper place to start is a short, honest check of whether the agency is ready. This article sets out a six-part way to do that check. It draws on published frameworks, and it is written for agency leaders, digital and data teams, and the people who run HR and learning.
What “AI ready” means
An agency is AI ready when it can use AI for a specific purpose, safely, and with people who know what they are doing. That takes more than technology. Deloitte’s AI readiness framework for government makes the same point: readiness involves retooling processes, upskilling or hiring staff, refining partnerships and building data and technical infrastructure, not only buying technology.
Why assess before you buy
- Weak data gives unreliable results. The UK Government Digital Service (GDS) wrote in June 2026 that data maturity is where any AI readiness assessment should begin.
- Technology moves quickly. GDS cautions public bodies against overinvesting in solutions that may soon be superseded. A readiness check tells you what to build that will last: skills, data and rules.
The six checks
Deloitte’s framework named six dimensions: strategy, people, processes, data, technology and platforms, and ethics. The six checks below are based on those dimensions, with governance and ethics combined. For each check, ask the questions, look for the warning sign, and compare with what “ready” looks like at a basic level.
1. Purpose and strategy
- Ask: What specific problems do we want AI to help with? Who owns the goal? How will we know it worked?
- Warning sign: a list of tools, but no list of problems.
- Ready looks like: two or three named use cases tied to agency goals, each with an owner and a measure.
2. People and skills
- Ask: Do leaders understand what AI can and cannot do? Which roles need which skills? Who will use the tool every day?
- Warning sign: training planned after launch.
- Ready looks like: a known skills baseline, briefed leaders and named champions in each team.
3. Data
- Ask: Is the data we need easy to find, accurate, owned, and allowed to be used for this purpose? Who is accountable for each key dataset?
- Warning sign: nobody can say who owns the data, or the same data exists in three versions.
- Ready looks like: named owners, quality checks and access rules for the data each use case needs.
4. Governance and ethics
- Ask: Who approves an AI use? What checks apply for privacy, bias, fairness and transparency? When must a person review the output?
- Warning sign: staff already use public AI tools with no guidance.
- Ready looks like: a short policy, an approval route, risk tiers, review rules and a record of where AI is used.
5. Processes and operating model
- Ask: Which tasks in this process will change? Who does the work afterwards? How are exceptions handled?
- Warning sign: AI added on top of a process that has not changed.
- Ready looks like: a redesigned process map, updated job descriptions and a clear handover to a person.
6. Technology and procurement
- Ask: Does the tool work with our systems? Can we test it and check its outputs? What happens if the vendor changes or leaves?
- Warning sign: the contract is signed before testing, and there is no way to check outputs.
- Ready looks like: testing in a safe environment, exit options, and a way to evaluate outputs.
Match your ambition to your readiness
Deloitte describes a range of ambition, from single-point solutions (task-based automation) through use-case-targeted solutions to transformative efforts. Broader efforts can bring more value, but they need more readiness and carry more complexity.
Many organisations move up step by step, and simple automation is useful learning for staff. A sensible rule is to choose use cases your weakest check can support, and to strengthen that check before you move up a level.
How to score the six checks
| Level | Meaning | What you hear |
|---|---|---|
| 1. Not started | No owner, no policy, no baseline. | “We have not looked at this yet.” |
| 2. Emerging | Some people, some data and a draft policy, applied unevenly. | “A few teams do it their own way.” |
| 3. Ready for this use case | Owned, documented and tested. | “We can show how it works and who is accountable.” |
To run the check:
- Pick one or two use cases, not the whole agency.
- Interview people from leadership, data, HR and learning, legal and privacy, procurement and the front line.
- Review the policies, data inventories and contracts that already exist.
- Score each of the six checks for each use case.
- Rank the gaps and write a 90-day plan that fixes the weakest first.
For a single use case this can be a short exercise rather than a long study.
What this looks like in practice
In one public-sector data engagement, a transport agency held large volumes of traffic data but had no agreed way to use it for planning. The work covered how the data was collected, how it was governed, and how insights reached decision-makers. In the language of the six checks, that is data, governance and processes. The agency gained an actionable data strategy to build on. Read the anonymised case study.
Five common mistakes
- Buying first. The tool is chosen before the problem and the data are understood.
- One-off training. A single session rarely changes habits.
- No data owner. Without an owner, nobody fixes quality or approves use.
- Ethics as a final sign-off. Privacy, bias and review rules shape the design. They are not a stamp at the end.
- No measure of success. If you cannot say what “better” looks like, you cannot tell whether the pilot worked.
A ten-question readiness checklist
Answer yes or no for one use case. Every “no” is something to fix before you scale.
- Can we name the problem this use case solves and the person who owns it?
- Do we have a measure of success we agreed before we started?
- Do leaders understand what the tool can and cannot do?
- Do the people who will use it have the skills and time to learn it?
- Do we know who owns the data it needs, and is its quality checked?
- Are we allowed to use that data for this purpose?
- Is there a clear policy and approval route for AI use?
- Do we know when a person must review the output?
- Have we redesigned the process and the roles around the tool?
- Can we test the tool and validate its outputs, and leave it if we must?
Frequently asked questions
What is an AI readiness assessment?
It is a structured check of whether an agency's people, data, governance, processes and technology are prepared to use AI for a specific purpose. It shows where to invest first and what to fix before buying tools. It is usually run for one or two use cases rather than the whole agency.
How is AI readiness different from digital readiness?
Digital readiness covers systems and skills in general. AI readiness adds questions about data quality and ownership, how to validate outputs, ethics, and when a person must review a result. An agency can be digitally mature and still not be ready to use AI safely for a particular purpose.
Who should be involved?
A senior sponsor, the owners of the key data, the people who run HR and learning, legal and privacy, procurement, and the staff who will use the tool. A check done only by the technology team misses most of the risks, because many of the gaps sit in people, rules and processes.
Can a small agency do this?
Yes. Keep the scope to one use case, use the checklist above, and score honestly. A small, accurate picture beats a large, vague one. A one-hour workshop with the sponsor, the data owner and a few users is enough to see the weakest of the six checks.
What to do next
This week, pick one use case, name its owner and run a one-hour workshop to score the six checks. You will see the weakest link quickly.
If you would like help running the assessment, building the skills or setting up governance, discuss a project with Blak Rice. See our government work.
Sources
- Deloitte Insights, “AI readiness for government”: deloitte.com
- UK Government Digital Service blog, “Data maturity: the foundation for AI ready public sector data” (4 June 2026): gds.blog.gov.uk