AI readiness assessment.

What an AI readiness assessment answers

An AI readiness assessment answers three questions: can we use AI safely now, where should we start, and what must be fixed first. It is narrower and faster than an AI strategy, which ranks a whole portfolio of uses, and it comes before a roadmap, which sequences delivery. If you want to try the questions yourself first, use our AI readiness checklist.

Who should get one

• Staff are already using AI. People paste emails and documents into personal ChatGPT or Claude accounts and nobody knows what has been shared. In Datacom’s 2025 State of AI Index, a vendor survey of larger NZ organisations, 52% of leaders said this “shadow AI” was a problem.
• Before a big licence decision. You are about to buy Microsoft Copilot or another platform for everyone and want to know whether your files, permissions and people are ready for it.
• The board or audit committee wants assurance. Directors want a defensible view of AI risk and opportunity, not a vendor’s.
• Before asking for budget. You need evidence that a first project is feasible before writing the business case.

The six areas we score

Each area is scored from 1 to 5. A 1 means the area would block most AI uses today; a 3 means a well-chosen first project can proceed with care; a 5 means AI can be adopted broadly here with normal controls. Every score cites the evidence behind it.

Illustrative example: a 40-person Christchurch accounting practice.

Sample recommendations

Recommendations are scored by impact and effort, and each has an owner and a date. Continuing the illustration:

The pilot candidate was tested during the assessment on a sample of real client requests, so its score reflects evidence, not optimism. For the first item, our AI use policy template for NZ SMBs is a practical starting point.

What you receive

Scorecard

Six areas scored 1 to 5, with the evidence for each score and what would raise it.

Shadow AI findings

Which tools staff use, for what, and what information has been entered into them, from the survey and interviews.

Tested candidates

One or two candidate uses tried on your real examples, with how often the output was right.

Privacy and risk notes

Gaps against the information privacy principles and the Privacy Commissioner’s expectations for AI.

90-day action list

Scored recommendations with owners and dates.

Readout

A session with leadership to walk through the findings and agree the next step.

How the assessment runs

1. Discover: listen. Interviews with leaders and team leads, and a short anonymous staff survey on current AI use. Anonymity matters; people under-report otherwise.
2. Discover: inspect. Review systems, permissions, exports, vendor terms and policies. We look at settings, not just documents describing them.
3. Prove: test one or two uses. Try the most promising candidates on real examples, so at least one recommendation is backed by evidence about accuracy.
4. Score and report. Score each area, write the action list and present it. Then you decide what to do and who does it.
5. Scale: reassess. Six to twelve months later, rescore to see which gaps have closed.

What drives the cost

The drivers are organisation size, the number of teams and sites, how many systems need inspecting, how deeply candidate uses are tested, and whether you want a draft privacy impact assessment included. A single-site practice is a short engagement; a multi-region organisation with several business units is a larger one. We fix the scope and price before starting. To see what acting on the findings might cost, read what custom AI projects cost and try the AI ROI calculator.

What informs our scoring

Our scores come from building systems that had to work inside real organisations. The Property Management Agent for APL Property, an internal AI agent that handles email triage, records, orders and follow-up for a regional NZ property firm with staff keeping the decisions, depended on exactly the things this assessment checks: access to inboxes and records, clear approvals, and an owner on the business side.

Limits of a readiness assessment

• It does not make you ready. It tells you what to fix. The fixes are the work.
• Scores are not industry benchmarks. We do not publish averages for your sector, and a score should not be used in marketing.
• Surveys under-report. Even anonymous, some staff will not admit to pasting client data into a chatbot. We treat survey results as a floor.
• Skip it if you already know. If you have a clear workflow, an owner and access, go straight to a proof of concept.

New Zealand specifics we check

• Privacy officer. Every agency must appoint at least one privacy officer under section 201 of the Privacy Act 2020. We check one exists and knows about AI use.
• Impact assessment. The Privacy Commissioner expects a privacy impact assessment before AI tools are used, and advises not to enter personal information unless the provider has confirmed it is not retained or disclosed.
• IPP 3A. Since 1 May 2026, collecting information about people from other sources carries a notification duty, which affects AI enrichment and research uses.
• The usual barriers. Xero’s 2026 survey of its NZ customers found privacy and security concerns (40%) and mistrust of AI output quality (37%) were the top reasons for not using AI more. The assessment produces evidence on both for your organisation.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.