Is my company ready for AI? A practical checklist

Short answer: you have a basis for a controlled pilot when you can run one defined workflow end to end with reliable data, clear human approval, privacy and access controls, measurable acceptance criteria and a rollback plan. If any of those are missing, address them first, then pilot.

Test readiness with a single, concrete workflow: invoice approval

Pick one everyday decision that already has owners and policy. Invoice approval works well because it mixes documents, data entry, policy checks and human sign-off.

1) Define the decision and human approval

• Owner: Accounts payable lead approves policy and exceptions.
• Scope: invoices under a set threshold with matching POs; route others to manual review.
• Human-in-the-loop: final approval by an authorized approver; AI suggestions must be reviewable and overridable.

2) Verify data and privacy

• Inputs: supplier master, PO data, invoice PDFs/EDI, approval matrix.
• Quality: check completeness, accuracy and consistency for required fields like vendor ID, PO number, amounts and tax. The GOV.UK Data Quality Framework describes assessing fitness for purpose across the data lifecycle and using dimensions such as completeness, consistency and timeliness (UK Government Data Quality Framework).
• Privacy: classify any personal data in invoices and apply minimization and access restrictions.

3) Access control and audit logging

• Access: limit who can view invoices and model outputs by role; approvals require named accounts.
• Audit: record data sources used, prompts or rules, outputs, who reviewed/approved and timestamps. NIST’s AI Risk Management Framework highlights the need for governance, documented roles and ongoing review across the lifecycle (NIST AI RMF Core).

Use proven risk and data guidance to structure the work

NIST’s AI Risk Management Framework organizes responsible AI into four functions: Govern, Map, Measure and Manage. In practice:

• Govern: set policies, roles, training and an AI system inventory; plan for periodic review and decommissioning when needed (NIST AI RMF Core).
• Map: define the context and stakeholders, intended uses, risks and benefits, and human oversight needs before you build (NIST AI RMF Core).
• Measure: design tests and metrics that reflect deployment conditions; document limitations and uncertainty (NIST AI RMF Core).
• Manage: monitor risks, allocate resources and be ready to recalibrate or remove a system if it exceeds risk tolerance (NIST AI Risk Management Framework).

For data, apply a lifecycle view and address issues at source. The UK Government Data Quality Framework recommends clear metadata, validation during collection, and targeted improvements where they add most value (UK Government Data Quality Framework).

Design a measurable pilot and a rollback you will actually use

Acceptance criteria (illustrative)

• Coverage: the pilot attempts a recommendation on invoices in scope without stalling required AP steps.
• Decision quality: use independently checked examples to measure incorrect approvals, missed exceptions and incorrect rejections. Agreement with a reviewer alone is not proof of correctness. Set acceptance thresholds before testing and document uncertainty.
• Latency: recommendations arrive before current manual SLA expires.

Rollout guardrails and rollback

• Start in shadow mode: produce recommendations while humans decide as usual; compare outcomes.
• Introduce staged automation only where acceptance criteria are met; document and test how to stop new automated actions and return to the manual process. A rollback cannot automatically undo an invoice already sent or a payment already executed.
• Define who can pause or decommission the system and under what conditions, consistent with governance and decommissioning practices (NIST AI RMF Core).

Invoice-approval AI readiness checklist

• Write the in-scope invoice policy, thresholds and exception rules; name the approver of these rules.
• Inventory required data fields (vendor ID, PO, amounts, tax, currency) and mark any personal data.
• Check data quality on a recent sample and log issues by dimension (completeness, consistency, timeliness).
• Confirm role-based access for viewing invoices, model outputs and approvals; enable audit logs.
• Define human approval gates and who can override or escalate exceptions.
• Set acceptance metrics, evaluation method and decision thresholds; agree who can authorize go/no-go.
• Document a rollback plan with a named trigger, responsible owner and reversion steps.
• Schedule periodic reviews to reassess risks, data drift and policy changes.

Common gaps and practical next steps

• Data scattered across email and drives: centralize a secure intake and capture metadata; validate required fields at ingestion (UK Government Data Quality Framework).
• Unclear roles: publish a RACI for mapping, measuring and managing AI risks so teams know who approves and who operates (NIST AI RMF Core).
• No measured testing: define a small, representative test set and document results, limitations and uncertainty before affecting production decisions (NIST AI RMF Core).

One pilot does not establish company-wide readiness

Different workflows need different controls. A successful invoice pilot does not establish that another department, dataset or higher-impact decision is ready. Review access, data, failure modes and acceptance criteria for each proposed use.

Where to go next

• Map your current sign-offs and escalation paths: How to create an approval workflow?
• See what an invoice pilot can look like: Can AI be used to automate invoice processing?

FAQ

Do we need to pick a specific AI vendor to run the assessment?

No. Use the assessment to validate your workflow, risks, data and governance first. NIST’s Map and Measure functions emphasize context and testing before broader deployment or tool decisions (NIST AI RMF Core).

What if invoices arrive as messy PDFs and emails?

Treat data quality at source: standardize intake, collect required fields, attach metadata and track issues. Focus on the fields that drive the approval decision (UK Government Data Quality Framework).

Readiness means having enough evidence and controls to justify the next bounded step; it is not a guarantee of safety. Start there, then scale deliberately using the same governance, data quality and monitoring habits.