Assessing Enterprise AI Readiness

In October 2025, Cisco published the third edition of its AI Readiness Index, a survey of 8,000 senior IT and business leaders in 30 markets. It classed about 13 percent of organizations as fully ready for AI, and that share had barely moved in the three years Cisco had been asking. The ready few were four times more likely than the rest to move pilots into production¹.

Treat the number with care. It is self-reported, and it comes from a company that sells the networks AI runs on. But the pattern it describes is one many executives will recognize: tools bought, pilots launched, enthusiasm high, and very little reaching the daily work of the business. The useful response is not to ask whether your organization sits in the top 13 percent. It is to ask a sharper question, one that a survey cannot answer for you.

Ready for what?

Enterprise AI readiness is the organization’s ability to turn a specific AI ambition into repeatable, governed and economically sustainable work. The key word is specific. Running a dozen controlled experiments, putting assistants in the hands of every analyst, and letting software agents settle supplier invoices are three different ambitions. They ask for different data, different engineering, different controls and different amounts of change in how people work. An organization can be ready for the first and nowhere near ready for the third. Both statements are true at once, and a single yes-or-no answer hides that.

Two sentences are often treated as if they meant the same thing: our IT department has AI tools and our enterprise is ready for AI. The first describes a purchase. The second describes a capability that stretches across strategy, data, people, controls and money. Even data readiness, the dimension that sounds most technical, turns out to depend on the use. Gartner defines AI-ready data as data aligned to specific use cases, and reported that 63 percent of organizations either lacked or were unsure they had the data management practices AI needs². There is no such thing as data that is ready in general.

So the executive question changes. Do not ask whether you are AI-ready. Ask whether you are ready for the AI outcomes you intend to pursue, and which capabilities are missing.

The ambition sets the bar, and so does the law

How much AI should change the business is a strategic choice, and Defining AI Ambition in Module 04 showed how to set it and how to read it against readiness at a high level. This chapter takes the next step: once the ambition is set, it defines the bar every capability has to clear.

Take an illustrative company weighing the two ambitions in the figure. A small experimental program can run on modest data, a handful of skilled people and a controlled environment. AI that helps decide who gets hired, or who gets credit, sits in a different world. In the European Union it is a high-risk use, and the organization deploying it carries legal duties that a sandbox experiment does not. Ambition B is not simply “more” of Ambition A. It needs capabilities that Ambition A never touches.

Eight dimensions, one question each

A practical assessment looks across a handful of dimensions. Lists vary: Cisco’s index uses six pillars, and many consultancies use more. The exact list matters less than covering the whole system, and asking each dimension the same question: what does this ambition need from you, and what is the evidence that you have it?

Three dimensions are easy to underweight. Leadership is not enthusiasm; it is a sponsor who funds the work, takes decisions and removes blockers, because AI that lives as an IT side project struggles to reach the core business. People does not mean turning everyone into an engineer. It means users and managers who understand what the system can and cannot do and when a person must check it. And the operating model, which is really a question of ownership, is a dimension that often surprises leadership teams: if you cannot say who owns an AI system, who builds it, who approves it, who runs it and who measures its value, you will struggle to run more than a few.

The questions are deliberately concrete. Is our data good? invites a shrug. Can the forecasting system reach three years of promotion history, with an owner who will fix it when it breaks? has an answer. For governance, a recognized reference such as the NIST AI Risk Management Framework, with its four functions of govern, map, measure and manage, gives the assessment a common vocabulary⁴.

Failed projects point to missing dimensions

The case for assessing all eight comes from the way AI projects actually fail. RAND researchers interviewed 65 experienced data scientists and engineers about why AI projects go wrong. Their report cites estimates that more than 80 percent of AI projects fail, about twice the rate of IT projects without AI, and it finds five root causes⁵. Gartner, explaining why it expected at least 30 percent of generative AI projects to be abandoned after the proof of concept, named four reasons: poor data quality, inadequate risk controls, escalating costs and unclear business value⁶. The two figures measure different things and should not be compared: RAND’s 80 percent is an estimate, cited from others, of AI projects of all kinds that fail; Gartner’s 30 percent is a forecast of generative AI projects dropped after the proof-of-concept stage.

Read the left column again and notice what is missing: the model. RAND does list one technical cause, problems too difficult for current AI, but most of the causes sit in strategy, data, infrastructure, controls and money. That is the practical argument for a readiness assessment. It is a way of finding these failures on paper, before they are found in production.

Readiness is a chain, not an average

The dimensions are not independent checkboxes. They behave like a chain: the value of the whole depends on its weakest link. The economist Michael Kremer formalized this idea in 1993 and named it after the space shuttle Challenger, lost in 1986 because one small seal, an O-ring, failed. In his O-ring theory, production consists of many tasks that must all be done well; a mistake in any one of them can destroy most of the value of the rest⁷.

AI systems are O-ring systems. Consider an illustrative agent that resolves supplier invoice disputes on its own.

Excellent data and a strong platform do not help if nobody has defined what the agent may pay without approval. Mature governance does not help if the agent cannot read the contract system. This is why the limiting capability matters more than the overall picture, and why the most important output of an assessment is often a single sentence: this is the gap that holds everything else back.

Averages hide exactly that sentence. Suppose, as an illustration, that an assessment scores five dimensions for one ambition.

The average is 3.4 out of 5, which a board slide would present as nearly ready. For an ambition in a high-risk use, the governance score of 1 means the organization cannot launch at all. Report the weakest link first, and the average, if at all, second.

Evidence, not false precision

Scores are useful only when they are consistent and backed by evidence. A figure such as 3.27 out of 5 suggests a precision that no readiness assessment has; the score is less important than the gap behind it. For each dimension, record four things: the current score, the evidence for it, the level this ambition requires, and the action that would close the gap. The record below is an illustration, for an ambition to forecast demand with AI.

Data = 4 says nothing. Data = 4, because there is a catalog, every critical dataset has a named owner and quality is checked weekly can be challenged, checked and improved. The evidence column is what turns the assessment from a self-portrait into a management tool. It is also why the assessment should be done by a cross-functional team, covering business, technology, data, security, risk, finance and change leadership, rather than by the technology function alone. Each of them sees gaps the others will miss. Resist false precision, too. A readiness score quoted to two decimals, such as 3.27 out of 5, looks rigorous but rests on judgments that are not that exact; the evidence behind a whole-number score is worth more.

Not every gap deserves immediate money. Prioritize where the gap is large and the business importance is high, then weigh urgency, dependency, risk and effort. A gap that blocks five initiatives at once, such as missing data ownership in a shared domain, is usually worth more than a larger gap that blocks only one.

Different bars for experiment, production and scale

The bar also rises with the stage. What an experiment needs is not what a production system needs, and neither is what a portfolio of systems running across the enterprise needs.

The gap between the bottom two tiers is where many initiatives stall. Gartner’s 2024 forecast of abandoned generative AI projects is a forecast about exactly this boundary⁶, and the readiness gap in Cisco’s survey shows up most clearly in who manages to cross it¹. How to move a particular system across the boundary is the subject of From AI Pilot to Production to Scale, later in this module.

Two opposite mistakes follow from ignoring the tiers. The first is to build everything before starting: a full platform, a complete data program and an enterprise governance office before a single use case has proved its value. That delays learning and often builds the wrong foundation. The second is to scale a successful pilot as if production and scale had the same bar as the experiment, without security, operations or ownership. The discipline that avoids both is minimum required readiness: build what the current stage needs and what the next stage will need, and let readiness grow with the roadmap. For the same reason, reassess at each major stage of the roadmap, and whenever strategy, technology, regulation or risk changes materially, not as an annual ritual.

Story: ready for care, not for testing

In 2015 the Royal Free London NHS Foundation Trust, a London hospital trust, began working with DeepMind, Google’s AI company, on Streams, a mobile app that alerts clinicians when a patient shows signs of acute kidney injury⁸. The clinical aim was not what the regulator later questioned. When it ruled on the project, the Information Commissioner began by acknowledging the potential of creative uses of data for patient care⁹.

The difficulty lay in one dimension, at one stage. To test the app’s clinical safety, the trust gave DeepMind the records of about 1.6 million patients. The Information Commissioner’s Office opened an investigation in May 2016¹⁰, and in July 2017 it ruled that the trust had failed to comply with the Data Protection Act 1998, the UK law then in force. Patients had not been adequately informed, and would not reasonably have expected their records to be used in this way. The ICO rejected the argument that the processing was direct care, which the trust had relied on for patients’ implied consent: testing a new system is a different purpose from treating a patient. The trust had not shown that 1.6 million records were necessary and proportionate for the test, and no privacy impact assessment had been done before the project began⁹.

The ICO did not impose a fine. The trust signed an undertaking to establish a proper legal basis for the project and for future trials, set out how it would meet its duty of confidence to patients, complete a privacy impact assessment and commission an audit of the trial. It said publicly that it accepted the findings [@ico-royal-free-deepmind-2017; @techcrunch-royal-free-ico-2017]. The Commissioner’s own summary of the lessons was blunt: the shortcomings were avoidable, and trusts should not dive in too quickly⁸.

Read through this chapter, the case is a readiness question that was never asked in its specific form. Data that a hospital holds properly to treat patients is not, by that fact, ready to build and test software. What the project needed, before any data moved, was an answer to ready for what? asked of one dimension at one stage: may we use this data, in this volume, to test this system, and have we told the people it describes? A privacy impact assessment is the standard tool for producing that evidence, and its timing was the gap. No average across eight dimensions would have revealed it, because the weakness was one link, not a low overall score.

What this means for leaders

An honest readiness assessment changes the conversation in the leadership team. It replaces the mood question, are we ready?, with a set of specific ones: ready for which outcome, missing what, proven how, and fixed in what order. It also protects against both familiar failures: the enthusiastic launch of twenty initiatives on foundations that cannot carry them, and the cautious freeze that waits for the organization to become perfect. Readiness does not halt the portfolio. It sequences the investment.

Check yourself

1. An organization with enterprise AI tools and a cloud platform is AI-ready.MythFact
2. The same organization can be ready for AI experiments and not ready for AI agents in core operations.MythFact
3. A high average readiness score means the organization can proceed.MythFact
4. Most root causes of AI project failure identified by RAND are organizational rather than technical.MythFact
5. The safest approach is to build every foundation before starting any AI work.MythFact
6. Data an organization already holds lawfully is ready for any AI use of it.MythFact

Reflection: find your O-ring

What comes next

A readiness assessment answers whether the organization can pursue a particular ambition, and what it must close first. It does not say how far the organization has come overall, or what “better” looks like across the whole enterprise. Readiness asks whether we can pursue this ambition; maturity asks how systematically we operate AI today. The next chapter, The AI Maturity Model, provides that second view.