This article summarises publicly available guidance from regulators and official sources. It is general educational information only and does not constitute legal or professional advice. Requirements vary by jurisdiction. Consult your regional authority or a qualified professional for advice specific to your situation.
Most AI tool projects that fail do not fail because the technology did not work. They fail because the business was not ready: no one owned the outcome, staff were not prepared, the data was in the wrong state, or no one had thought through what to do when the AI got something wrong. This checklist gives you a clear picture of where your business stands before you invest time or money in AI adoption. It covers four dimensions that consistently separate businesses that get results from AI from those that do not: governance, technical, risk, and people and culture.
In short: Work through each section and rate yourself on each item as either Green (in place), Amber (partially in place or unclear), or Red (not in place). Any section where you have two or more Reds is worth addressing before starting an AI project. You do not need to be fully Green in every area, but you should understand where your gaps are and have a plan to address the critical ones. A printable version of this checklist is below.
This checklist is designed for businesses at the point of planning or early-stage AI adoption. It is not a compliance assessment and does not tell you whether you meet any specific legal requirement. For compliance-specific requirements in your sector, see our AI risks by industry guide.
Dimension 1: Governance
Governance readiness means having basic accountability structures in place before AI is introduced. The most common governance gap in small businesses is not having anyone who owns AI decisions. Without a named decision-maker, AI projects drift, conflicts between staff about what is appropriate go unresolved, and when something goes wrong there is no one with authority to act.
Work through each item and mark it Green, Amber, or Red:
Governance Checklist
- There is a named person in the business responsible for AI decisions and oversight (this does not need to be a dedicated role, but someone owns it).
- There is a basic policy or set of rules about how staff can and cannot use AI tools in their work. Even a one-page document counts.
- Staff know they need to get approval before signing up for a new AI tool or using a new AI feature for work tasks.
- The business has reviewed the data handling terms of at least the AI tools it currently uses most frequently.
- There is a process for handling a complaint or problem that involves an AI tool, such as an AI error that affected a customer or an AI output that was wrong and acted on.
- The business privacy policy is up to date and, if the business uses AI tools that process personal information, the policy reflects this in some form. The December 2026 automated decision-making changes to the Privacy Act are on the radar if your business uses AI that significantly affects individuals.
If you have 2 or more Reds here: Build the basics before expanding AI use. A short AI acceptable use policy and a named owner for AI decisions are the minimum. Our free AI staff policy template covers both and takes about 30 minutes to customise for your business.
Dimension 2: Technical
Technical readiness does not mean having a dedicated IT team or sophisticated infrastructure. For most Australian SMBs, it means understanding what data you have, where it lives, and whether the systems you use are capable of integrating with AI tools in a way that produces reliable results. Poor data quality is the most common reason AI tools deliver disappointing outcomes after a promising pilot.
Technical Checklist
- The business knows what data it holds, where it is stored, and which systems contain the most important business data (even a rough inventory is enough).
- The key business data is reasonably clean and consistent. If you were to export your customer list or job history into a spreadsheet, it would be usable without major cleaning.
- The business has a reliable internet connection and the devices staff use for work are reasonably current (last 4 years).
- Staff who would be primary users of AI tools are comfortable using web-based software tools in general. They do not need to be technical, but comfortable with learning new software.
- If AI tools will connect to existing business systems (accounting software, CRM, project management), those systems have API access or integration support available.
- The business has adequate cloud storage or can access it for the data AI tools will need to process (many AI tools have upload limits on free or entry-level tiers).
If you have 2 or more Reds here: Technical gaps are generally solvable but benefit from being addressed before an AI project rather than during it. Data cleaning, system access configuration, and staff device upgrades are all manageable with lead time. Trying to do them while simultaneously running an AI pilot adds friction and makes it harder to evaluate whether the AI itself is working.
Dimension 3: Risk
Risk readiness means understanding what could go wrong and having proportionate responses in place. Many small businesses skip this step because risk assessment sounds like enterprise governance complexity. It is not. For most SMBs, the key risks are narrow: data going somewhere it should not, an AI output being wrong and causing a problem, and staff using tools in ways the business did not intend. Assessing whether you have basic responses to each of these is achievable in an afternoon.
Risk Checklist
- The business knows what personal information about clients, customers, or staff would be processed by the AI tools it is planning to use (or is currently using).
- For each AI tool that processes personal information, the business has checked (or will check before use) where that data goes, whether it is used for model training, and whether it is stored on overseas servers.
- There is a basic plan for what to do if an AI tool is involved in a data breach or exposes personal information unexpectedly. This does not need to be detailed, but someone should know who to contact.
- Staff understand that AI outputs need to be checked before they are used for anything important, and there is a culture of verification rather than blind trust in AI results.
- The business has checked whether the AI tools it plans to use carry any specific sector-specific compliance risk for your industry (see our industry risk guide).
- For AI tools that will be used in customer-facing communications or documents, there is a review step before those outputs go to customers.
If you have 2 or more Reds here: Before expanding AI use, run a quick assessment on the specific tools you plan to use. Our AI risk assessment checklist covers five risk dimensions for any individual AI tool and produces a traffic-light rating that makes the risk picture clear without requiring technical expertise.
Dimension 4: People and Culture
The people and culture dimension is where most AI projects quietly fail. Technology adoption in a business is a change management challenge at least as much as a technical one. Resistance from staff, anxiety about job security, or a culture where no one wants to admit they do not understand the new tool all undermine adoption even when the technology is well chosen. Assessing your readiness here is about being honest about where your team is, not about finding fault.
People and Culture Checklist
- Leadership is genuinely committed to AI adoption and willing to use AI tools themselves, not just expect staff to use them.
- The reason the business wants to adopt AI has been communicated to staff in plain terms: what problem it solves, what it does not replace, and what the expected outcome is.
- Staff have been given a realistic picture of how AI adoption will affect their roles, including an honest answer to the job security question if it is likely to come up.
- There is budget and time allocated for staff training and a realistic plan for how staff will get up to speed on new tools. AI tool adoption without training tends to produce low-quality use rather than no use.
- There is a feedback channel for staff to raise problems with AI tools, including concerns about accuracy or appropriateness, without feeling that they are challenging a management decision.
- The business has thought about which staff members are likely to be early enthusiasts (AI champions) and which are likely to need more support, and has a plan to work with both groups rather than assuming the enthusiasts will bring everyone along.
If you have 2 or more Reds here: Do the people work before the technology work. A well-chosen AI tool deployed into a team that is unprepared or resistant will underperform every time. Our guide on AI change management for Australian businesses covers how to bring different staff groups along, handle common staff concerns, and run a communication plan that builds rather than erodes trust.
Reading Your Results
When you have worked through all four dimensions, count your Reds and Ambers. A business with mostly Greens and a few Ambers is ready to start a well-scoped AI pilot with a clear owner and defined success criteria. A business with several Reds in one or two dimensions should address those gaps first. A business with Reds across multiple dimensions would benefit from building foundations before expanding AI use, because the foundational gaps are more likely to determine outcomes than the choice of AI tool.
The goal is not to be perfect before you start. It is to understand what you are walking into and to have proportionate responses to the most likely failure modes. Most AI adoption problems are foreseeable and preventable. This checklist exists to help you foresee them.
What to Do Next
Once you have your readiness picture, the natural next step depends on where your main gaps are. If governance is the priority, start with a basic AI policy. If risk is the priority, run a per-tool assessment before expanding your AI tool set. If people and culture is the gap, work through a change management plan before rolling out new tools. If technical gaps are the main issue, address data quality or system integration before committing to tools that depend on clean data.
The guides and tools below cover each of these priorities:
Governance: Free AI staff policy template for Australian businesses
Risk: AI risk assessment checklist for any tool
People: AI change management guide for Australian businesses
Compliance context: AI risks by industry for Australian SMBs
Methodology (Real-World, Verified)
This guide is researched against primary regulatory sources and official regulator guidance, verified as of the date shown, and written for a business with no dedicated compliance function.
Read our full methodology and independence and disclosure policy.
Related reading: our can staff upload customer data to AI tools, our AI and the Privacy Act guide, and our Claude AI review for Australian business.
Try our free AI Tool Selector to get a personalised AI tool recommendation for your business.
Related reading: our AI governance by region.
For the practical next steps after this readiness check, see our AI risk management hub.
How long does it take to complete this AI readiness assessment?
For most business owners working through it alone, the checklist takes 30 to 60 minutes. If you involve your team (which is recommended for the people and culture dimension), allow 90 minutes for a facilitated discussion. The value is not in the time it takes but in the honest conversation it prompts. Many business owners find the exercise surfaces assumptions they were holding about AI readiness that turn out not to be shared by their team.
Do I need to score Green in every area before adopting AI?
No. The purpose of the assessment is to identify gaps, not to gatekeep AI adoption. Many businesses successfully adopt AI tools while working on governance or risk gaps in parallel. What matters is that you are aware of the gaps and have a plan to address the critical ones. The areas that most commonly cause AI project failures are governance (no one owns the project) and people readiness (staff are unprepared or resistant). If those two areas are in reasonable shape, most other gaps can be managed in parallel with early-stage adoption.
Is this checklist relevant to businesses that have already started using AI?
Yes. Many businesses using AI tools informally (staff using free versions of ChatGPT, for example) have never formally assessed their readiness. Working through this checklist on existing AI use often surfaces governance and risk gaps that have been present for months without being noticed. The most useful outcome for businesses already using AI is the risk dimension, which identifies whether personal information is being handled appropriately and whether there are privacy or compliance issues that need to be addressed retroactively.
What is the difference between AI readiness and AI compliance?
AI readiness is about whether your business has the foundations in place to adopt AI successfully: governance, technical capability, risk awareness, and team preparedness. It is a practical business assessment. AI compliance is about whether your business meets specific legal requirements when using AI, including Privacy Act obligations, sector-specific regulations, and upcoming automated decision-making disclosure requirements. The two overlap (good governance supports compliance) but are different assessments. This checklist covers readiness. For compliance-specific requirements in your industry, see our AI risks by industry guide.
Should I complete this checklist alone or with my team?
Both approaches work for different purposes. Completing it alone gives you your personal assessment as the business owner. Completing it with key staff gives you a more accurate picture of the people and culture dimension and surfaces gaps between management's perception and ground-level reality. For businesses where AI adoption will be driven by operational staff (rather than just management), involving two or three team members in the discussion is likely to produce a more accurate and useful result.
The information in this article is general in nature. It reflects a summary of publicly available guidance and does not constitute legal, privacy, or professional advice. Your obligations will depend on your specific situation, jurisdiction, and business circumstances. Do not rely on this article as a substitute for qualified legal or professional advice.
If your readiness assessment shows gaps in governance, start with a basic AI policy. Our free AI staff policy template for Australian businesses covers approved tools, data handling rules, and the process for introducing new AI tools. Customise it in about 30 minutes.
Get the Free AI Policy Template