Is Your Data Ready for AI? A 20-Question Audit You Can Run This Week

Key Takeaways

• “Is our data ready for AI” is unanswerable as asked. Readiness is a property of a workload, not of an organization. The same data can be ready for classification and nowhere near ready for an agent that writes back
• Readiness decomposes into five dimensions — accessibility, structure, quality, documentation, and governance — and they fail independently
• Score the minimum, never the mean. A workload is gated by its weakest dimension. Averaging produces a comfortable number that predicts nothing and has misled more AI budgets than any other single habit
• Documentation is the most common hidden blocker. Teams reliably over-rate it because the knowledge exists — in someone's head. Undocumented fields cannot be validated, and unvalidatable fields cannot support an evaluation set
• Each maturity level is a precondition for the one above. You cannot skip a rung, and an organization at level 1 cannot reliably run a level 3 workload regardless of which model it buys
• Write access changes the arithmetic entirely. A workload that only reads is gated by quality; one that writes back is gated by governance, which is typically two rungs further away
• Remediation has a correct order: accessibility, then documentation, then structure, then quality, then governance. Cleaning before documenting is the most common wasted quarter
• Most readiness gaps are weeks of unglamorous work, not years. The 20-question audit below takes about half a day and routinely reprices projects by a factor of two

Introduction: The Question Behind the Question

Every AI conversation eventually arrives at the same sentence, usually delivered with a slightly apologetic laugh: our data is probably a mess.

It is a strange thing to say, because the person saying it almost never knows whether it is true. It is a hedge, offered preemptively, based on a general sense that data is the sort of thing that is usually messy. Sometimes it turns out the data is fine and the real constraint is elsewhere. Sometimes it turns out the data is far worse than the hedge implied and the project needed rescoping before it began. Either way the sentence is doing no work, because it is not a measurement.

The reason the hedge persists is that the underlying question is genuinely hard to answer, and most attempts to answer it produce a single vague verdict — ready, not ready, needs work — that does not tell anyone what to do next. A verdict is not actionable. A profile is.

This article provides the profile. Twenty questions, grouped into five dimensions, each with an explicit criterion for what a good answer sounds like, and a scoring method that avoids the failure mode nearly every readiness assessment falls into. It takes about half a day of one person's time. It will not make your data better, but it will tell you precisely which part is blocking you, which is the prerequisite for everything else.

Why the Question Is Wrong as Usually Asked

Two structural errors are baked into the way readiness is normally discussed, and both need clearing before the audit is useful.

The first error is treating readiness as a property of the organization. It is not. It is a property of a specific workload running against a specific slice of data. A company whose CRM is immaculate and whose contract archive is a shared drive of scanned PDFs is simultaneously very ready and completely unready, and any single verdict about that company is wrong in one direction or the other.

This matters practically because it changes what you assess. You do not audit your data. You audit the data that a candidate workflow would actually touch — which is usually far narrower than people assume, often two or three tables and one document repository. Narrowing the scope of the audit is the first thing that makes it tractable, and the first thing that makes the results useful.

The second error is averaging. Readiness assessments almost always produce a composite score, because composites feel rigorous and fit neatly in a slide. But the dimensions of readiness do not compensate for one another. Immaculate structure does not offset the fact that nobody knows what the fields mean. Perfect documentation does not help if the data is only reachable through a manual export that one person runs on Fridays.

A workload is gated by its weakest dimension, which means the correct aggregate is the minimum, not the mean. This distinction is not academic. An organization scoring 4, 4, 4, 1, 4 averages to 3.4, which reads as comfortably mid-maturity and produces an approved budget. Its actual capability is 1. The gap between those two numbers is where the overruns live.

The Five Dimensions

Each dimension answers a different question, fails for different reasons, and is fixed by different work. Keeping them separate is what turns a vague sense of messiness into a work plan.

Accessibility asks whether a system can reach the data without a human in the path. It fails through manual export steps, credentials held by one person, rate limits, and systems with no API at all.

Structure asks whether the shape is consistent and predictable. It fails through free-text fields carrying structured meaning, inconsistent enumerations, and schemas that drift without notice.

Quality asks whether the contents are correct. It fails through duplicates, gaps, stale records, and multiple systems that disagree about the same entity.

Documentation asks whether anyone can say what a field means without asking a specific person. It fails silently, and it is the dimension teams most consistently over-score.

Governance asks who may see what, and whether that is enforced by a system rather than by convention. It fails invisibly until an AI system makes the failure visible at scale.

The Twenty Questions

Four per dimension. Score each 0 to 4 using the anchors given. Be harsh: the value of this exercise is entirely in its honesty, and a generous audit produces a budget that is wrong in the expensive direction.

Accessibility

1. Can a program read this data today without a human performing a step? Score 4 if there is a documented API or direct query access with service credentials. Score 0 if someone exports a file. Manual export is not a minor inconvenience — it caps every workload at the frequency of the human, and it silently becomes a single point of failure attached to one employee's calendar.

2. Is access governed by service credentials rather than a personal account? Score 4 for a service identity with scoped permissions. Score 1 if it runs under someone's login. Personal-account access is the most common reason an AI workflow breaks three months after launch, and the failure arrives on the day that person changes role.

3. How current is the data a system can reach? Score 4 for real-time or near-real-time. Score 2 for nightly. Score 0 if the accessible copy is a periodic snapshot nobody refreshes reliably. Staleness is a correctness problem wearing an infrastructure costume.

4. Can you retrieve a specific record by a stable identifier? Score 4 if yes. Score 1 if retrieval requires fuzzy search on a name. Without stable identifiers you cannot build idempotent pipelines, which means reruns duplicate work and failures cannot be safely retried.

Structure

5. Are the fields you need typed and constrained? Score 4 if dates are dates and enumerations are enumerations. Score 1 if critical values live in free text. A status held as free text will contain a dozen spellings of the same state, and every one of them becomes a branch someone has to handle.

6. Is the schema stable, and are changes announced? Score 4 if there is a change process. Score 0 if columns appear and disappear without notice. Undetected schema drift is the leading cause of AI workflows that degrade silently rather than failing loudly, which is the worse of the two outcomes.

7. Is one real-world entity represented once? Score 4 for a resolved, deduplicated view. Score 1 if the same customer exists three times with different spellings. Entity resolution is expensive to retrofit and nearly free to maintain once established.

8. Are relationships between records explicit? Score 4 for real foreign keys. Score 1 if the link between an invoice and its contract exists only in a naming convention that people mostly follow.

Quality

9. What proportion of records have every field the workflow needs? Score 4 above 95%. Score 1 below 70%. Measure this rather than estimating it — the estimate is almost always optimistic, and the query takes ten minutes.

10. When two systems disagree, is there a defined winner? Score 4 if a system of record is designated and honored. Score 0 if the answer is “it depends who you ask.” Undefined precedence means a workflow cannot be correct, only consistent with one arbitrary source.

11. Do you know the error rate of the current manual process? Score 4 if measured. Score 0 if never examined. This is the single most useful number in the entire audit, because it sets the bar an AI system must clear — and it is frequently much lower than people assume, which reframes the whole conversation.

12. Is there a validation layer at the point of entry? Score 4 if bad data is rejected on write. Score 1 if cleanup happens downstream, forever. Downstream cleanup is a recurring tax; entry validation is a one-time fix that stops the tax accruing.

Documentation

13. Is there a written definition of each field the workflow uses? Score 4 for a maintained data dictionary. Score 0 if the definitions live in one person's memory. Note that “the field name is self-explanatory” is a score of 1, not 4 — self-explanatory field names are how organizations discover that two departments meant different things by active.

14. Are the business rules that produce the data written down? Score 4 if a new hire could apply them from the document. Score 1 if the process lives in an experienced person's judgment. This is usually the true scope of an automation project, and discovering it late is how three-week builds become three-month builds.

15. Are known exceptions and edge cases cataloged? Score 4 for a maintained list. Score 0 if exceptions surface one at a time in production. Every organization has them; the difference is whether they are written down or rediscovered.

16. Could someone reconstruct why a historical record looks the way it does? Score 4 for lineage or audit history. Score 1 if records are overwritten in place. Without history you cannot build an evaluation set from past decisions, which removes the cheapest source of labeled examples you have.

Governance

17. Are permissions enforced by systems rather than convention? Score 4 for enforced role-based access. Score 1 if the control is that people know not to look. Convention-based controls survive human behavior and do not survive automation, because a service account has no discretion.

18. Do you know which fields carry regulated or sensitive data? Score 4 if classified and labeled. Score 0 if nobody has looked. Discovering this after a workflow is live is materially more expensive than discovering it at design time, and in regulated sectors it can be disqualifying.

19. Is there an approved position on this data leaving your environment? Score 4 if legal has reviewed and documented it. Score 0 if unexamined. This single question kills more late-stage AI projects than any technical factor.

20. Can you produce an audit trail of who accessed what? Score 4 if logging exists and is queryable. Score 1 if logs exist but nobody can search them. This is a precondition for any workload that acts rather than merely reads.

Scoring: Take the Minimum

For each dimension, take the lowest of its four question scores — not the average. Then your workload readiness is the lowest of the five dimension scores.

This will feel unreasonably punitive. It is not. A single unaddressed question genuinely does block the workload: if you cannot retrieve a record by stable identifier, it does not matter that the other three accessibility questions scored 4, because you cannot build a safely retryable pipeline. The minimum is not a pessimistic aggregation choice; it is an accurate model of how these dependencies actually behave.

Consider the profile in the figure above: accessibility 4, structure 3, quality 2, documentation 1, governance 3. The mean is 2.6 — respectable, mid-maturity, the sort of number that gets a project approved. The minimum is 1.

And the analytically interesting part is which dimension is lowest. Most teams looking at that profile would start on quality, because quality is the dimension people associate with messy data and because cleanup feels productive. That would be a wasted quarter. You cannot meaningfully clean data whose fields nobody has defined — you would be enforcing rules you have not written, and you would find yourself asking the same domain expert to adjudicate every ambiguous record, which is exactly the bottleneck the project was meant to remove.

Documentation gates quality. Fix the 1 before touching the 2.

What Each Level Unlocks

The scores map onto a capability ladder, and the ladder has no shortcuts.

Level 0 — Scattered. Files, inboxes, one person's spreadsheet. Nothing is automatable. Assistant tools still help individuals, but no workflow can be built.

Level 1 — Centralized. One system of record exists, fields are inconsistent. Assisted lookup and drafting with a human in the loop on every item.

Level 2 — Structured. Typed fields, stable schema, deduplicated. Classification, extraction, and routing become reliable enough to run at volume.

Level 3 — Documented. Field meanings and business rules are written down and owned. Now you can build an evaluation set, which means you can build workflows that are monitored and improvable rather than merely functional.

Level 4 — Governed. Permissions, classification, and audit are enforced by systems. Only here do agentic workloads that write back become defensible.

The rung that surprises people is 3. Teams frequently reach level 2 and expect to be able to run a monitored production workflow, then find they cannot construct a golden set because no two people agree on what the correct output is for the ambiguous cases. That disagreement is not a labeling problem. It is an undocumented-business-rules problem surfacing at the only moment that forces it into the open.

Why Documentation Is the Usual Blocker

Across audits, documentation is the dimension most often scored highest by the team and lowest by the evidence. The reason is structural rather than careless.

Documentation is the only dimension whose absence is invisible to the people who have the knowledge. If you have worked somewhere for six years, you do not experience the absence of a data dictionary as a gap, because you are the data dictionary. Every question gets answered promptly and correctly, so the system appears to function. The deficiency only becomes legible when something needs the knowledge in a form a person cannot supply on demand — which is exactly what an AI workflow is.

This produces a specific and expensive pattern. The audit scores documentation at 3 because everyone can answer every question. The project proceeds. Six weeks in, the builder needs to know whether a particular status counts as closed for the purposes of the rule, and it emerges that operations and finance have been using it differently for years, and neither knew. Now the project is blocked on a business decision nobody has authority to make quickly, and the timeline doubles.

The diagnostic that avoids this is simple and slightly confrontational: ask two people in different functions to define the same five fields independently, in writing, without conferring. Compare. The disagreement rate is your real documentation score, and it is common for at least one of the five to diverge materially — usually to the surprise of both parties.

The Governance Coupling

There is one asymmetry in the ladder worth isolating, because it accounts for a large share of failed agentic projects.

A workload that only reads is gated primarily by quality and documentation. A workload that writes back — updates a record, sends a message, changes a status, moves money — is gated by governance, and governance is typically the least-developed dimension in a small or mid-sized organization because it has never needed to be.

The reason is that human-scale access control is mostly convention, and convention works well at human scale. Employees have broad technical access and narrow behavioral norms about what they actually look at. Nothing enforces the norm; nothing needs to, because people exercise discretion.

A service account has no discretion. Give it the access a person has and it will use all of it, at machine speed, without the situational judgment that made the convention safe. This is why the most common security defect in internal AI tooling is not a breach but a permission-scope error: the workflow reads on behalf of a user but sees what the service account can see, which is everything.

The practical implication is a planning rule. If your candidate workflow writes to any system, add two rungs to your readiness requirement. A project that would be comfortable at level 2 as a read-only classifier needs level 4 the moment it starts acting, and level 4 is months of work that nobody scoped.

Remediation, in the Right Order

Remediation has a correct sequence, because the dimensions depend on each other. Doing this out of order is the most common way organizations spend a quarter and end up no more capable.

First, accessibility. Cheapest to fix, and it gates your ability to measure anything else. Until a program can read the data, every subsequent assessment is manual and therefore sampled, stale, and disputed. Usually days to weeks.

Second, documentation. Before cleaning, define. Write down what fields mean, what the business rules are, and what the known exceptions are. This is unglamorous, requires your most experienced people, and cannot be delegated to the newest hire or outsourced. Typically two to four weeks for a single workflow's scope, and it makes everything downstream cheaper.

Third, structure. With definitions written, typing and constraining fields becomes mechanical rather than a series of judgment calls. Weeks.

Fourth, quality. Now cleanup is possible, because correct is defined. This is the dimension people want to start with and should finish with. Duration varies enormously — anywhere from a week to a quarter depending on volume and history.

Fifth, governance. Classification, enforced permissions, audit logging. Only strictly required if the workload writes, but worth starting early in regulated sectors because review cycles are long and largely outside your control.

The counterintuitive item is documentation before cleanup. It is counterintuitive because cleanup feels like progress and documentation feels like paperwork. But cleaning undefined data means making thousands of small judgment calls that nobody has authority to make consistently, and the result is data that is tidier and no more trustworthy.

Three Anti-Patterns

The data lake reflex. Faced with a readiness gap, the instinct is to centralize everything into one repository first. This converts a scoped, tractable problem into an eighteen-month infrastructure program that will not finish before the AI initiative's political capital runs out. Audit the two or three sources your candidate workflow needs, fix those, and leave the rest alone.

“We'll clean it during the project.” Cleanup embedded inside an AI build is cleanup with no owner, no acceptance criteria, and no visible line item, which means it expands invisibly and gets blamed on the AI work when the timeline slips. Make it a separate phase with its own definition of done, even if the same people do it in the same weeks.

The synthetic shortcut. Generating synthetic examples to compensate for thin real data is legitimate for load testing and illegitimate for evaluation. A golden set built from synthetic examples measures whether the system handles the cases you imagined, which is precisely the set of cases that were never the risk. The edge cases that matter are the ones you would not have thought to synthesize.

How This Should Change Your First Workflow Choice

The audit's most valuable output is usually not the remediation plan. It is the re-selection.

Most organizations arrive with a candidate workflow already chosen, picked on business value alone. Running the audit against it frequently reveals that a different workflow — less exciting, lower headline value — sits on data that is two rungs more mature and could ship in a third of the time.

Shipping the second workflow first is almost always correct, for a reason that has little to do with the data. The first completed AI workflow in an organization is not primarily valuable for what it does. It is valuable because it establishes the evaluation infrastructure, the integration plumbing, the review-gate design, and the internal confidence that makes the next three cheaper and easier to approve. Optimizing that first project for completion probability rather than headline value is the highest-return sequencing decision available.

So run the audit against two or three candidates rather than one. The comparison is where the insight is.

The Brightter Perspective

The reason data readiness is treated as a vague preamble rather than a measurement is that vagueness is comfortable for everyone in the room. A specific score creates an obligation. “Our data is probably a mess” creates none, which is exactly why the phrase survives.

What we consistently find is that the gap between the hedge and the reality runs in both directions, and roughly equally often. Some organizations are considerably more ready than they believe and have been deferring a project they could have shipped two quarters ago. Others are considerably less ready and are about to approve a budget built on an averaged score that conceals a blocking dimension. Both are expensive, and both are resolved by half a day of honest assessment against explicit criteria.

At Brightter, we run this audit early and against multiple candidate workflows, because the output that matters most is usually not a remediation plan — it is a better choice of first project. We would rather spend a week discovering that the intended workflow is eighteen months away and a different one is six weeks away than spend six months proving the first point the expensive way.

Conclusion

Readiness is not a property of your company and it is not a single number. It is five independent dimensions, assessed against one specific workload, aggregated by taking the minimum rather than the mean.

Score the twenty questions honestly. Take the lowest score in each dimension, then the lowest dimension. Look at which one it is, because that identifies your actual constraint, and it is frequently not the one you expected. Remediate in order — accessibility, documentation, structure, quality, governance — and resist the pull toward cleanup before definition. If the workflow writes to anything, require two more rungs than you think you need.

Then run the same audit against a second candidate workflow, and be genuinely open to the possibility that the boring one should go first.

If you are trying to establish whether your data can support the workflow you have in mind — or which workflow it could support today — that assessment is the cheapest week in the entire program. Start a project at brightter.com/start-a-project.