AI readiness checklist.

Use this checklist before you commit money to an AI tool or project. It is built for New Zealand businesses of roughly 5 to 200 people and takes about ten minutes once you have the right people in the room. Every check is a plain yes or no. The rule that makes it useful: answer yes only if you could show the evidence today. “We sort of have a policy” is a no.

How to use the checklist

1. Pick one workflow first. Readiness only means something for a specific piece of work, such as supplier invoice coding or customer enquiry replies. Our lesson on choosing your first AI workflow helps if you have several candidates.
2. Get three people together. The workflow owner, someone who does the work daily, and whoever looks after IT or privacy.
3. Answer all 30 checks. Tick only what you can evidence. Note what the evidence is beside each tick.
4. Score each area out of 5. Use the scoring table below. Any area at 0 or 1 is a blocker.
5. Fix the blockers, then re-score. The fix is often a policy, an account change or a named owner, not a technology project.

The AI readiness checklist

1. Workflow and value

• We have named one workflow, not “AI in general”, that we want to improve.
• The workflow has an owner who can approve changes to how it runs.
• We track at least one number for it today: hours a week, turnaround time, error rate or backlog.
• We have 20 or more real examples of the work (emails, forms, documents) to test with.
• We know what a wrong output would cost, and who would catch it.

2. Data and systems

• The information the workflow needs is in systems we control (Microsoft 365, Google Workspace, Xero, a CRM), not only in people’s heads.
• We know which systems an AI tool would need to read from and write to.
• Those systems have an API, export or connector, or we have checked that they do not.
• The documents the AI would rely on are current; old versions are archived or labelled.
• Someone can tell us who has access to what today.

3. Privacy and security

• We know whether the workflow involves personal information, and whose.
• We have a privacy officer, which every agency must appoint under section 201 of the Privacy Act 2020.
• We know whether the provider uses our inputs to train its models, and we use a plan where it does not.
• We know which countries the provider processes and stores our data in, and have written it down.
• We have done, or scheduled, a privacy impact assessment for this use.

4. People and change

• The staff who do the work know what is being considered and have been asked for input.
• At least one person has 2 to 4 hours a week set aside to test and give feedback.
• We can say who will check AI output before it is used, and how.
• We have a written AI use policy, or one is being drafted.
• We have considered whether the change affects anyone’s role or hours.

5. Tools and accounts

• We know which AI tools staff already use, including personal accounts.
• Staff use business accounts, not personal free accounts, for work information.
• Someone in the business controls admin settings: sign-in, removing users, data retention.
• We have checked what AI features our existing software already includes.
• We know how we would stop using the tool and get our data out.

6. Budget and measurement

• We have a budget for the first three months, including staff time.
• We know the monthly running cost we would accept for the result we expect.
• We have a baseline measurement taken before any change.
• We have agreed the result that would make us stop.
• A decision-maker will review the result on a set date.

How to score your answers

Give one point per tick. Score each area out of 5, then total out of 30.

Why the privacy and people checks carry so much weight

The Privacy Commissioner’s position is that the Privacy Act applies to everyone using AI tools in New Zealand, and its guidance says it expects a privacy impact assessment before an AI tool is used (OPC). The joint small-business guide from NCSC New Zealand and Australian partners asks owners to confirm what data a tool collects, where it is stored and whether it is used for training (NCSC). On people: if the change could affect jobs, Employment New Zealand says employers need genuine business reasons, consultation and a fair process (Employment NZ). These are the gaps that turn a good pilot into a problem later.

Worked example

Illustrative example: a 25-person accounting practice in Tauranga wants AI help with supplier invoice coding for clients on Xero.

The practice fixed the blocker in three weeks: it adopted a one-page policy from our AI use policy template, moved staff to a business plan that does not train on inputs, recorded where the provider processes data, and wrote a short privacy impact assessment. Privacy rose to 4 and the total to 22, which made a narrow pilot on invoice coding and exception review sensible.

Common mistakes

• Scoring intentions. “We will write a policy” scores zero until the policy exists.
• Treating readiness as a technology question. Blockers are more often ownership, accounts and rules than software.
• Waiting for perfect data. Fix the data problems that change the answer for your workflow; ignore the rest for now.
• Ignoring shadow use. If staff already use personal AI accounts, your privacy score is lower than you think. The AI data inventory template helps you find out what information is going where.
• Running it once. Re-score before each new workflow; the answers change.

Next step

If you score 15 or more with no blockers, map the workflow step by step with the AI workflow mapping template. If you would rather have an independent view, our AI readiness assessment runs the same checks with your team against real examples.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.