Most readiness assessments hand back a number and a band. Nobody argues with it and nobody acts on it, because a composite score averages the one workflow where the risk actually sits. A data-estate assessment is narrower and more useful: take a question the business genuinely asks, and test whether an agent can resolve its meaning, trace its inputs, respect the access policy, reproduce the answer, and follow a recorded procedure. Atlan makes that scoreable rather than rhetorical, because certified definitions, lineage, ownership and policy live in one Enterprise Data Graph that can be queried for evidence instead of surveyed for opinion.
| Area | What a data-estate assessment does differently |
|---|---|
| Unit of assessment | One named business question, not the company |
| Input | Artifacts pulled from metadata, not answers typed into a form |
| Scoring | Gated, so a zero on any dimension caps the result |
| Output | A work list with owners, not a maturity band |
| Shelf life | Weeks. Re-run it when definitions, sources or agent tooling change |
What AI readiness assessments actually measure today
Sixteen public frameworks, from analyst firms to cloud providers to standards bodies, converge on roughly the same shape. Six pillars: strategy, data, infrastructure, talent, governance, culture. A questionnaire. A composite score, often banded.
The Cisco AI Readiness Index is the most rigorous of the type, scoring those six pillars across 49 weighted indicators onto a 0 to 100 scale, banded as Pacesetters at 86 and above down to Laggards below 31. Its 2025 edition put 13% of organizations in the top band and 48% in the third. Microsoft’s runs seven pillars across about 45 minutes. MITRE’s scores 20 dimensions on five levels and gates advancement, so reaching a level requires meeting the previous one’s benchmarks. NIST’s AI Risk Management Framework is the outlier in the best way: four functions, Govern, Map, Measure and Manage, and no score at all, because it is a risk framework and says so.
Two of the cloud frameworks carry their own age warnings. The AWS Cloud Adoption Framework for AI page displays the publisher’s banner marking it historical reference only, and Google Cloud’s AI Adoption Framework whitepaper cites sources from 2018 and 2019. Both predate agents entirely, which matters when what you are assessing is agent access patterns rather than model adoption.
Data appears as a pillar in every framework found, and where weights are published it is the heaviest one. What almost none of them do is treat the data estate as the thing being assessed rather than a slice of a bigger pie, which leaves data quality for AI agents rated on a five-point scale by the people responsible for it.
The scope decision to make first
Organizational readiness and data readiness answer different questions and lead to different budgets. Blend them and the score tells you nothing, because you cannot read it back as hire, buy, or fix the warehouse.
If the question is whether your organization is ready for AI as a programme, AI readiness assessment and implementation covers the strategy, skills and operating-model dimensions properly. This page assumes that decision is made and the deployment is coming, and scores what the agent will actually hit: definitions, relationships, provenance, policy, and the data architecture for AI underneath them. The governance questions that sit alongside are a separate axis again, and the difference between data governance and AI governance is worth settling before either assessment starts.
Why one score for the whole company is the wrong output
Gartner’s public definition makes readiness use-case-bound: the data must be representative of the use case needed to run the model for that specific use, and there is no way to establish it in general or in advance.
Almost every scored tool ignores that. National indices produce one number per country by construction. Vendor indices produce one number per organization. Even the best data-specific example found, a readiness score computed from warehouse metadata rather than a questionnaire, reports semantic coverage across the whole account rather than whether a named question is answerable.
The sharper version for anyone deploying agents: readiness is not even per use case. It is per question. An agent does not consume the data estate. It answers something specific against specific tables, with specific joins and specific definitions. Readiness for “what was net revenue last quarter” and readiness for “which accounts are at churn risk” are two different facts about the same warehouse, and a composite score collapses them into one.
What to score instead
Pick three to five questions the business already asks, that someone senior chases by email, and that an agent will plausibly be asked next quarter. Score those. The estate-wide picture emerges from the pattern across them, and it emerges attached to workflows somebody cares about rather than to a pillar diagram.
This also fixes the sequencing problem. A two-year estate-wide readiness programme optimises an average while the five questions the executive team actually asks stay unanswerable, which is how readiness planning turns into shelfware.
The five dimensions, and the evidence each one needs
Score each dimension 0, 1 or 2 for one named question. Zero means no artifact exists. One means it exists and is incomplete or unowned. Two means it exists, has an owner, and you can produce it on request.
Meaning: can the concepts in the question be resolved?
Every business concept in the question needs one certified definition with a named owner, not a team alias, and a review date. “Active customer,” “net revenue,” “at risk” each resolve to a specific field or metric that finance or the domain owner has signed off.
Evidence for a 2: the definition, its certifier, its last review date, and the same number returned by the BI tool and the agent. Where the question resolves through text-to-SQL, the generated query should name the certified metric rather than reconstruct it. A semantic layer for AI agents is what makes that retrievable rather than remembered, and the effect is measurable. Anthropic reported its internal analytics agent below 21% accuracy on its own evaluation set without skills and semantic grounding, and consistently above 95% with them.
Provenance: can the answer be traced to source?
Pick one figure the question produces and trace it back to the source systems without a human filling in a gap from memory. Where the trace breaks is where trust breaks.
Evidence for a 2: a lineage path from the answer to the originating systems, plus the freshness of each hop against its stated service level. Context freshness belongs in this dimension, not in a separate hygiene exercise, because an answer computed from a stale source is wrong in a way no quality test catches.
Boundaries: does policy hold when an agent asks?
Run the identical question as two principals with different entitlements. The results should differ, correctly. Then look at the audit log and check which identity appears.
Evidence for a 2: two differently scoped results from the same question, and an audit entry naming the agent rather than a shared service account. Agents running on broad-read service accounts are the most common way a well-governed estate leaks, which is what agent access control exists to prevent and why giving agents access to enterprise data is a governance decision rather than a connectivity one. Cisco’s 2025 index found 24% of organizations able to control agent actions with guardrails and live monitoring.
Reproducibility: does the same question return the same answer?
Ask it ten times on unchanged data and count the distinct answers. The pass mark is one.
Evidence for a 2: the ten outputs. This is the dimension no published framework tests, and the one most likely to fail on first contact. Part of the cause is the model layer: Thinking Machines Lab ran 1,000 identical completions of an open model at temperature zero and got 80 distinct outputs. The larger part is usually the data layer, where the same entity exists in two systems under two definitions and the agent picks differently on different runs. Agent evaluation practice has versioned golden sets and regression runs for exactly this, and readiness assessment has not absorbed them. The mechanics are documented across the LLM evaluation frameworks already in use next door.
Procedure: is the method recorded anywhere?
For this question, is the procedure written down: which tables, which filters, which checks, what happens when a source is late, who to escalate to? Not the skill, the procedure, including its retries.
Evidence for a 2: the written procedure and its owner. Zero of the sixteen public frameworks ask for this, and it is what separates a demo that worked once from a workflow that runs on Mondays. It is also what makes decision traces legible after the fact, and it links readiness to context observability rather than leaving it as a one-off audit.
Evidence beats self-report, and the gap is measurable
Nearly every readiness assessment in circulation is an opinion survey about yourself. Cisco’s index is a double-blind survey of senior leaders across 49 indicators, rigorously sampled and entirely self-reported: “76% of Pacesetters have fully centralized data” means 76% of respondents said so. Microsoft’s, and the analyst questionnaires, work the same way. Nothing inspects a catalog, a lineage graph, a query log or a schema.
The gap that opens up is not small. A March 2026 survey of senior data and AI executives by Monte Carlo with CDO Magazine found 71% of organizations preparing to be AI-ready and 29% with a documented definition of what that means. In the same study, 61% reported silent failures, where the monitored metrics looked normal throughout a critical issue, and 62% named human review before release as their primary verification method.
Gartner’s own framing supports the evidence view: proving AI readiness is “a process and a practice based on the availability of metadata to align, qualify and govern the data.” That is a claim that readiness is provable from metadata, not declarable on a form, and it puts metadata management on the critical path of the assessment rather than beside it. It is also a description of the work: a metadata layer for AI with real coverage turns most of the rubric above into a query, and types of metadata for AI agents determines which of the five dimensions you can answer without a workshop.
Two scoring mechanics are worth stealing from the better frameworks. Require an artifact for any score above the midpoint, and score what operates today rather than what is planned. Gate advancement rather than averaging it, the way MITRE does, so one strong dimension cannot carry a weak one. A question that scores two on meaning and zero on reproducibility is not 60% ready. It is not ready.
Running it, and keeping it current
The first pass takes longer than anyone budgets, because collecting the evidence is itself the finding. If nobody can produce the certifier for a metric definition inside an afternoon, that is the score.
Cadence matters more than precision. Gartner is explicit that AI-ready data is “not one and done,” and the observed decay is fast: Anthropic reported the offline accuracy of its analytics agent drifting from around 95% to around 65% over a single month when the supporting context went unmaintained. Re-score a question when its definitions change, when a source system is replaced, when the agent gains a new tool or data source, and on a fixed cadence in between. Data observability for AI pipelines turns that cadence into an alert rather than a calendar reminder.
Ownership is the other half. A work list without a named owner per line is a document. Most of the remediation lands with the teams that own the definitions and the pipelines rather than with whoever ran the assessment, which is the practical argument for implementing a context layer once instead of re-litigating definitions per project.
What the score is actually for
Readiness assessments have a credibility problem, and it is self-inflicted. They ask people to rate themselves, average the ratings, and return a band that flatters roughly half of everyone who takes one. Gartner’s research on AI maturity, using a seven-question instrument across 432 respondents, found that 45% of leaders in high-maturity organizations keep AI initiatives in production for three years or more against 20% in low-maturity organizations, and that data availability and quality remained a top implementation challenge for both groups: 34% at the low end, 29% at the high end. Maturity did not make the data problem go away. It made the organization better at living with it.
A per-question, evidence-gated assessment is less comfortable and more useful. It does not tell you that you are a Chaser. It tells you that the churn-risk question fails on meaning because two teams define churn differently, fails on reproducibility because of that, and will keep failing until someone with authority picks one. No amount of context engineering downstream repairs a definition nobody owns. That is a decision with a name attached, which is the only kind that gets made.
The AI-ready data checklist turns these five dimensions into twelve items you can score in an afternoon, and what makes data AI-ready explains the layers underneath them. When the gaps are known, preparing enterprise data for AI agents is the build sequence, and whether to build or buy the metadata tooling is the question that usually follows.
FAQs about AI readiness assessments
1. What is the difference between AI readiness and AI maturity?
Readiness is a judgement about whether you can start something now. Maturity is a staged description of how far a practice has progressed. Maturity models typically define four or five named levels and place you on one. A readiness assessment should tell you what to fix before a specific deployment, which is a shorter and more actionable output.
2. Should I assess the organization or the data estate?
Both, separately. Blending them produces a score you cannot act on, because you cannot tell whether the answer is to hire, to buy or to fix the warehouse. Organizational readiness covers strategy, funding, skills and governance maturity. Data-estate readiness asks whether a named question is answerable correctly and repeatably.
3. How long does an AI readiness assessment take?
Public options range from a three-minute self-check to a consulting engagement of several weeks. A per-question data-estate assessment sits in between: scoring one question across five dimensions with evidence attached takes a few hours once the artifacts exist, and much longer the first time, because collecting the evidence is itself the finding.
4. Why is a single company-wide readiness score misleading?
Because it averages. An organization with strong strategy and unusable definitions can score moderately prepared while every agent it deploys returns wrong numbers. Gartner’s public position is that readiness depends on how the data will be used, so a score that ignores the use case is measuring something other than readiness.
5. What evidence should an assessment ask for?
An artifact rather than an opinion. A certified definition with a named owner and a review date. A lineage trace from the figure back to source systems. An audit entry showing the agent under its own identity. The output of the same question run twice. The written procedure for the question, with its checks and what happens when a source is late.
6. How often should we re-assess?
Gartner describes AI-ready data as a practice rather than a one-and-done project, so treat the score as perishable. Re-assess a question when its definitions change, when a source system is replaced, when the agent gains a new tool or data source, and on a fixed cadence in between. Published measurements of accuracy decay run in weeks, not years.
Sources
-
Lack of AI-Ready Data Puts AI Projects at Risk, Gartner (26 February 2025)
-
Foundational AI Capabilities, AWS Cloud Adoption Framework for AI, ML and Generative AI
-
The State of AI Reliability, Monte Carlo with CDO Magazine (March 2026)
-
How Anthropic Enables Self-Service Data Analytics With Claude, Anthropic (3 June 2026)
-
Defeating Nondeterminism in LLM Inference, Thinking Machines Lab (10 September 2025)
