An enterprise is ready for AI agents when it has a clearly measurable task, documented processes, permission-controlled access to the data and systems the agent needs, a security and approval model for agent actions, a named owner and a way to measure results. The 40-point AI agent readiness checklist below scores eight areas from 0 to 5. A total of 28 or more out of 40, with no area below 3, usually means you can start a production pilot. Lower scores tell you exactly what to fix first, which is far cheaper than discovering the gaps halfway through a build.
Key takeaways
- Most failed agent projects stall on data access, unclear processes or missing approvals, not on the AI model.
- Score eight areas: use case, process, data, systems, security, governance, people and measurement.
- Treat any area scoring 2 or below as a blocker to fix before building.
- Run the assessment with business, IT, security and data owners in the room, not just the AI team.
- Pilot one narrow, measurable task first, then expand the agent’s tools and autonomy as it proves reliable.
Why readiness matters more for agents than for chatbots
A chatbot answers questions. An AI agent plans steps, calls tools and can change data in business systems. That autonomy means weaknesses that a chatbot could tolerate become real risks: an agent with broad permissions can make broad mistakes, and an agent working from an undocumented process will automate the confusion. If the difference is new to your team, start with agentic AI vs generative AI.
A readiness assessment answers one question before you spend on a build: what has to be true in our organisation for an agent to do this task safely and usefully? It also gives you a realistic budget input. Gaps in data and governance are the main reasons estimates grow, as we explain in AI agent development cost in 2027.
How to run the AI agent readiness assessment
Pick one candidate task, such as triaging supplier invoices or preparing first-line support replies. Assessing “AI agents in general” produces vague answers. For each of the 40 checks, score 1 if the statement is true and 0 if it is not or nobody knows. Each area therefore scores 0 to 5. Involve the process owner, an IT or integration lead, a security representative and a data owner, because each holds part of the answer.
The 40-point AI agent readiness checklist
1. Use case and value
- The task is specific and repeated often enough to matter, for example daily or weekly.
- Today’s baseline is measured: time per case, error rate, cost or backlog.
- Success is defined as a number the business agrees on before the build starts.
- The task benefits from judgment over unstructured inputs, not just fixed rules a simple script could follow.
- A business sponsor will fund the pilot and act on the results.
2. Process clarity
- The current process is documented step by step, including exceptions.
- Decision rules and policies the agent must follow are written down.
- It is clear which steps are low risk and which need a person to approve.
- Escalation paths exist for cases the agent cannot handle.
- The process is stable, not about to be redesigned for other reasons.
3. Data access and quality
- The documents and records the agent needs are identified and reachable digitally.
- Source data is current, de-duplicated and trustworthy enough to act on.
- Existing access permissions are known and can be enforced for the agent.
- Sensitive and personal data in scope is classified.
- Historical examples with known correct outcomes exist for testing.
Data is the area that most often scores lowest. Our data engineering team usually starts here.
4. Systems and integration
- Every system the agent must read from or write to has a documented API or another supported integration route.
- Test or sandbox environments exist for those systems.
- Rate limits, quotas and service accounts are understood.
- Write actions can be undone, or are limited to drafts a person confirms.
- Integration owners are available during the pilot.
Tool connections can be standardised with the Model Context Protocol. See MCP explained.
5. Security and identity
- The agent will run under its own identity with least-privilege permissions.
- Secrets and credentials are stored in a managed vault, never in prompts or code.
- Prompt injection and tool misuse have been considered in a threat model.
- Logs of prompts, tool calls and outputs can be retained securely.
- The security team has agreed the controls needed before go-live.
Use the OWASP Top 10 for LLM Applications and our guide to AI agent security threats as references.
6. Governance and compliance
- An AI use policy exists and covers autonomous actions.
- Legal and compliance requirements for the task, such as GDPR or sector rules, are identified.
- Human approval steps are defined for high-impact actions.
- Every agent decision can be traced and explained after the fact.
- A process exists to pause or roll back the agent if it misbehaves.
The NIST AI Risk Management Framework and ISO/IEC 42001 provide structures for this area. For approval design, see human-in-the-loop AI agents.
7. People, skills and ownership
- A named product owner is accountable for the agent’s behaviour and results.
- Subject-matter experts can spend time reviewing outputs during the pilot.
- The team that will run the agent has, or can get, the skills to monitor and improve it.
- Users affected by the change have been informed and consulted.
- Support and incident responsibilities after launch are agreed.
8. Measurement and operations
- A test set of realistic tasks with expected outcomes will exist before launch.
- Quality, cost per task and time saved will be tracked from the pilot onward.
- Tracing and monitoring tools are chosen. See AI agent observability.
- Budget alerts and limits on steps and tokens per task are planned.
- There is a date to review the pilot and decide whether to scale, change or stop.
How to interpret your AI agent readiness score
| Total score | What it usually means | Recommended next step |
|---|---|---|
| 0 – 15 | Foundations are missing. An agent would automate an unclear process on unreliable data. | Fix process documentation and data access first. Consider simpler automation. |
| 16 – 27 | Promising, with specific gaps that would cause rework or risk. | Close every area scoring 2 or below, then run a limited proof of value. |
| 28 – 34 | Ready for a production pilot with a narrow scope. | Pilot one task with human approvals and measured outcomes. |
| 35 – 40 | Strong foundations for agents. | Pilot, then expand tools and autonomy step by step as evaluation supports it. |
The total matters less than the weakest area. A score of 32 with a 1 in security or governance is not ready, because that single gap can cause a serious incident.
Fixing the most common AI agent readiness gaps
- Undocumented process. Map the current process with the people who do it, including exceptions. This often reveals quick wins before any AI is involved.
- Data the agent cannot reach. Build a governed access layer, often through APIs or a data platform, rather than giving the agent broad database access.
- Systems without APIs. Add an integration layer or start with read-only tasks. Our API and system integration team handles this.
- No approval model. Start with the agent drafting actions for a person to confirm, then automate the low-risk steps once accuracy is proven.
- No test data. Collect 50 to 200 real historical cases with known correct outcomes. They become the evaluation set for every change.
- No clear owner. Appoint a product owner from the business, not only from IT, so the agent is judged on business results.
If several areas score low, a short business analysis engagement can map the process, data and controls before any build budget is committed.
Common questions
What does AI agent readiness mean?
It means your organisation has the use case, processes, data access, systems, security, governance, people and measurement in place for an agent to perform a specific task safely and usefully.
What score do we need to start an AI agent pilot?
As a guide, 28 or more out of 40, with no single area scoring below 3. Any area at 2 or below should be fixed first, especially security and governance.
Who should take part in the assessment?
The business process owner, an IT or integration lead, a security representative and a data owner. Each holds information the others do not.
How long does an AI agent readiness assessment take?
For one candidate task, a focused workshop plus follow-up checks typically takes one to two weeks, depending on how quickly data and system owners can confirm details.
Can we build an agent if our data is not ready?
You can start with a narrower task that uses the data you can trust, or with read-only assistance, while the wider data work proceeds. Building on unreliable data usually costs more later.
Get an independent AI agent readiness review
Bring one task you would like an agent to handle. Our enterprise AI integration team will score the eight areas with your stakeholders, highlight the blockers and propose a pilot plan with clear success measures.