Direct answer

AI data readiness is not the size of a database. It is the degree to which a team can use specific information for a defined workflow, measure the result, correct errors, and operate within its legal and security boundaries. A scorecard creates a decision before implementation: pilot, remediate, narrow, or stop.

Use a zero-to-three scale for six dimensions. Zero means absent or unknown. One means mostly manual, inconsistent, or unverified. Two means suitable for a bounded pilot with documented controls. Three means production-capable, monitored, and owned. Record evidence beside every score; a confident number without evidence is not readiness.

1. Purpose and decision boundary

Can the team name the exact task, user, input, output, and decision that remains human? “Use our CRM with AI” scores zero. “Classify inbound demo requests into an existing routing taxonomy and require human review for strategic accounts” is testable.

Write the cost of a false positive and false negative. If neither can be described, the team cannot set a threshold or review rule. Confirm that automation is preferable to a deterministic rule, better form design, process cleanup, or ordinary reporting.

2. Access and system authority

Identify the system of record for every critical field and the approved access method. Manual CSV exports, shared credentials, undocumented joins, and personal spreadsheets are readiness risks. A pilot may use a controlled extract, but the production plan should specify identity, permissions, rate limits, synchronization, and what happens when the source is unavailable.

Decide where corrections live. If a reviewer fixes an address or category only inside the AI layer, the source system remains wrong and the workflow accumulates hidden state. Production readiness requires a safe feedback path or a deliberate rule that the AI output is advisory and not authoritative.

3. Quality and semantic consistency

Measure missingness, duplicates, stale records, impossible values, and conflicting definitions. Sample actual cases by segment rather than inspecting only averages. “Active customer,” “qualified lead,” “resolved ticket,” and “approved invoice” often mean different things to different teams. The model cannot repair an unresolved operating definition.

Create a field dictionary: name, meaning, owner, allowed values, update event, source, and quality rule. For unstructured text or documents, define language, format, length, scan quality, version, and known exception types. A small set with strong labels is more useful for evaluation than thousands of unknown examples.

4. Coverage and representativeness

Compare the proposed data with the population the workflow will serve. Include quiet periods and peaks, new and established customers, common and rare document formats, relevant languages, changed policies, and the difficult cases people currently resolve manually. Split evaluation data by meaningful segments so a good aggregate score does not conceal a weak minority segment.

Do not claim the data represents groups or situations you did not measure. The NIST Generative AI Profile recommends contextual evaluation and documentation of limitations. For an SMB, the practical version is a coverage table with explicit gaps and a rule for cases that fall outside the tested boundary.

5. Governance, minimisation, and retention

Document purpose, legal basis where applicable, approved users, sensitive fields, vendors, transfer locations, retention, deletion, incident ownership, and contractual restrictions. The ICO data minimisation guidance asks whether personal data is adequate, relevant, and limited to what is necessary. Apply that question field by field.

Remove convenience data that does not improve the task. Mask or tokenize where possible. Separate production secrets from evaluation datasets. Confirm whether prompts, outputs, files, or telemetry are retained by each provider and re-check current vendor terms before launch.

6. Feedback and outcome measurement

Define the ground truth or accepted proxy. Who decides whether the result is correct? How quickly is that decision available? Can overrides be captured with a reason? Can the team trace a bad outcome to the input, rules, version, and reviewer? Without a feedback loop, the workflow can drift while activity metrics look healthy.

Measure the business outcome separately from model accuracy. A routing classifier may be accurate yet fail to improve response time because queues are understaffed. A summarizer may save time but increase escalation because key limitations disappear. Readiness includes the operational system around the model.

Decision rule

Pilot only when all critical dimensions score at least two. A three in access cannot compensate for a zero in purpose, security, or measurement. Create a remediation owner and date for every one. Stop when necessary data cannot be used lawfully, when harmful errors cannot be caught, or when the outcome is too subjective to evaluate at the proposed level of autonomy.

The NIST AI RMF organizes work through Govern, Map, Measure, and Manage. The scorecard follows the same lifecycle logic while staying concrete enough for a single SMB workflow.

Sources and next steps

Sources: NIST AI RMF, NIST Generative AI Profile, and ICO data minimisation guidance.

Related: AI Automation Data Requirements, AI Automation Readiness Assessment, and NIST-Based AI Risk Assessment.