Everyone wants to get started with AI. But starting too quickly means running into problems. Copilot finds files that should never have been shared. An AI agent gives answers based on outdated documents. And after three months, no one uses the licenses anymore.
An AI readiness assessment prevents this. You check in advance if your organization is ready for Copilot and AI agents. And most importantly: where you need to arrange something first.
In this article, you will get the checklist that we use ourselves. Five areas, the questions you need to ask, and the red flags to watch out for.
What is an AI readiness assessment?
An AI readiness assessment is a short, structured check of your organization. You don't just look at technology. You look at five things simultaneously:
- Strategy and use cases: do you know what you want to use AI for?
- Data and access rights: is your information well-organized and secured?
- Security and governance: do you have rules for what AI can and cannot do?
- People and skills: do employees know how to use AI effectively?
- Licenses and technology: do you have the right foundation in Microsoft 365?
If it's specifically about Microsoft 365 Copilot, it is often called a Copilot readiness assessment. The questions are largely the same. Only the emphasis is even more on rights and oversharing in SharePoint, OneDrive, and Teams.
The checklist: five areas, the right questions
| Area | Questions to ask | Red flags |
|---|---|---|
| Strategy and use cases | Which three processes take the most time now? Who owns the AI project? How do you measure success? | "We want something with AI" without a concrete goal. No owner. No baseline measurement. |
| Data and access rights | Where is your most important knowledge stored? Who has access to it? Is that knowledge current? | Sites open to everyone. Share links that never expire. Three versions of the same policy. |
| Security and governance | Is there an AI policy? Which AI tools do employees already use? Who approves new AI applications? | No policy. Employees using free AI tools independently. No visibility of what data is going in. |
| People and skills | Do employees know what AI can and can't do? Is there training per role? Are there ambassadors? | One general demo for everyone. No focus on AI literacy. |
| Licenses and technology | Are your identities and devices well-secured? What licenses do you have? What integrations are needed? | No MFA. No sensitivity labels. Licenses purchased without a usage plan. |
Area 1: strategy and use cases
Don't start with technology. Start with the work. What questions are asked repeatedly every day? What tasks take a lot of time but require little thinking? That's where the quickest gains are.
Choose two or three concrete use cases. For example: answering questions about HR policy, comparing budget to actual expenses, or preparing a client meeting. Record how long that work takes now. Without a baseline measurement, you can't later demonstrate what AI delivers.
Area 2: data and access rights
This is the area where most organizations are surprised. Copilot and AI agents in Microsoft 365 only show employees what they already have access to. That's good. But in many organizations, far more is open than anyone realizes.
Therefore, check:
- which SharePoint sites and teams are accessible to the entire organization;
- where share links to "everyone" are set;
- which documents are outdated but still findable;
- whether each important knowledge source has an owner.
An AI is only as good as the information it relies on. Messy knowledge gives messy answers.
Area 3: security and governance
AI without rules is a risk. Not because the technology is dangerous, but because no one knows what is happening. Ask yourself three questions:
- Do we have an AI policy that employees know and understand?
- Do we know which AI tools are already being used, even outside of IT?
- Who decides on new AI applications and who supervises them?
Are employees already using free AI tools with company information? Then you're dealing with shadow AI. Banning rarely works. Offering a safe alternative does.
Area 4: people and skills
Technology is simple. Change is human work. A license does not change how someone works. Therefore, look at:
- AI literacy: the European AI regulation expects organizations to ensure sufficient AI knowledge among employees working with AI.
- Training per role: a finance team needs different examples than a sales team.
- Ambassadors: colleagues who show how they use AI convince more than any demo.
Area 5: licenses and technology
Finally, the basics. Are your identities secured with MFA and conditional access? Do you use sensitivity labels for confidential information? What Microsoft 365 licenses do you have, and for whom does Copilot really add value?
Don't buy licenses for everyone just because you can. Buy them for the roles where it actually saves time.
What does an AI readiness assessment deliver?
At the end, you don't need a thick report. You need three things:
- An honest picture of where you stand, per area.
- A short list of risks that you need to address first.
- A concrete starting point: the first use cases and the steps to bring them live.
How long does it take?
A good assessment doesn't need to take months. With the right questions and access to your Microsoft 365 environment, you can have a clear picture within a few weeks. Often sooner.
How 365 Agents helps
At 365 Agents, we start each collaboration with this analysis. We review your knowledge in SharePoint, your rights, and your processes. Then we determine where the Frontier Crew delivers the most. You choose the processes and approve your knowledge. We set up the agents, with governance by design: the rights in Microsoft 365 remain applicable, and we add the AI governance you need.
Want to know how ready your organization is for Copilot and AI agents? Schedule a call, it only takes 30 minutes.
Frequently asked questions
What is the difference between an AI readiness assessment and a Copilot readiness assessment?
A Copilot readiness assessment focuses on Microsoft 365 Copilot, with extra emphasis on rights and oversharing. An AI readiness assessment looks more broadly, including AI agents, governance, and use cases beyond Copilot.
Does everything have to be in order before we start with AI?
No. Waiting until everything is perfect often means never starting. Solve the biggest risks and start with a small group.
Who should be involved?
At a minimum, IT, a business owner, and someone who oversees privacy and compliance. Also include the teams that will work with the use cases daily.
What if we have already deployed Copilot?
An assessment is just as valuable. You see where usage lags and which risks you still need to address.
