How CloudHero assesses AI readiness.
An AI readiness assessment establishes whether a specific workflow has a useful business outcome, suitable data and a credible implementation path. CloudHero connects each finding to evidence, an owner and a next action. This page explains the assessment carried out with our team and the rules behind the free questionnaire. A scoped implementation plan is a deliverable of the detailed assessment.
What does the full assessment cover?
We agree the workflows, decision and depth before starting. These nine areas guide discovery. We adapt the questions to the proposed architecture; a project using an existing model may not need model-training infrastructure.
- Business and team readiness
- Who sponsors the work and owns the decision? What funding, time and team capacity are committed? Which users and technical roles need preparation?
- Use cases and value
- What problem is being solved, for whom and how often? What is the current time, quality and cost? Which measurable improvement would justify investment? Compare benefit and payback scenarios using explicit adoption assumptions.
- Architecture
- Which approach fits: existing search or automation, a managed model, retrieval or agent tools? What are the cost, quality and latency trade-offs? What happens when evidence is missing or a model changes?
- Storage and lifecycle
- Where will sources, indexes, evaluation sets, prompts and logs be stored? What retention, deletion, versioning, backup and recovery rules apply? Assess training datasets and model artifacts when relevant.
- Security, privacy and accountability
- Which requirements have the responsible security, privacy or legal owners identified? What data classifications, processing locations and access controls are needed? Who approves remaining risks and handles incidents?
- Integration and action permissions
- Which interfaces, identities and rate limits apply? What may the application read, propose or execute? How will approvals, retries, duplicate actions and partial failures be handled?
- Testing and evaluation
- Which tasks, languages and user groups belong in the test set? Include unsupported answers, permission checks and attempts to bypass the rules. Who reviews results and approves quality, latency and cost criteria? What is retested after a change?
- Deployment and operation
- What demand, availability and recovery targets must the application support? How will versions be released and rolled back? Who owns monitoring, budget alerts, updates and support?
- Data strategy
- Which required sources are accessible and useful? Inspect samples for quality and coverage. Record provenance, ownership, refresh frequency and conflicting versions. Identify preparation tasks and how their completion will be verified.
How do findings become decisions?
For each finding, record the source, collection date, review method and limitations. State the business impact, required action, accountable person and acceptance condition. Separate observed measurements from assumptions and targets.
- Verified: reviewed evidence supports the finding within the agreed scope.
- Action required: evidence identifies a gap with an owner and a condition for closure.
- Unknown: information is missing or insufficient; specify how to obtain it.
- Not applicable: record why the question does not apply to the workflow or architecture.
A recommendation may be to define the use case, prepare data, run a focused experiment, proceed to a bounded pilot or reconsider the investment. Time saved is recorded separately from cash savings. Estimates state their scope, volume assumptions and uncertainty.
See the fictional knowledge-assistant example for a source-ownership finding linked to a pilot decision.
What does the initial online check ask?
The online check collects declarations about one project. It covers six dimensions and asks ten core questions. Planning proposed actions adds an approvals question; executing actions adds a recovery question. You can review and change every answer before viewing the result.
The check does not inspect data, test an application or verify compliance. “I do not know” preserves an information gap. A positive answer is labelled as a reported foundation until evidence is reviewed.
Which workflow do you want to improve?
Choose one project for this check.
- Find information in company documents
- Read and process documents
- Prepare customer or employee responses
- Prepare reports or analyse data
- Carry out actions in business systems
- Another workflow
- We have not chosen yet
Where is this project today?
Select the current state, even if a launch is planned.
- Idea or exploration
- Prototype or pilot
- Already used in daily work
Can you measure the improvement you want?
For example, time per task, correction rate or cost per request.
- We have a baseline and a target
- We know the goal but have not measured the baseline
- The goal still needs to be defined
- I do not know
How prepared are the data sources?
Consider source quality, current versions and who maintains them.
- Sources are identified, maintained and reviewed
- Sources exist but need cleanup or clear owners
- We have not checked yet
Are the access rules for those sources clear?
The application must respect the permissions of the people using it.
- We have documented who can access what
- Some permissions or integrations are unresolved
- I do not know
What kind of information will the application use?
Choose the most sensitive category involved; do not enter actual records.
- Public or non-sensitive information only
- Personal, confidential or regulated information
- We have not classified the information
What should the AI application be allowed to do?
Choose the highest level of access planned for this project.
- Read information and prepare answers
- Prepare actions for a person to carry out
- Execute actions or update business records
- We have not decided
How are permissions and approvals enforced?
Consider who may propose, approve and execute each action.
Shown when: What should the AI application be allowed to do? → Prepare actions for a person to carry out or Execute actions or update business records
- The controls are defined and tested
- Controls are planned but not tested
- We have not defined the controls
- I do not know
Can you recover from a failed or repeated action?
For example, a duplicate update or an action that only completes halfway.
Shown when: What should the AI application be allowed to do? → Execute actions or update business records
- Recovery and duplicate handling have been tested
- We have a plan but have not tested it
- We have not planned this
- I do not know
How will you judge the application’s results?
Include realistic tasks, errors, permissions and the languages people use.
- A test set, reviewers and acceptance criteria are defined
- People try it and give informal feedback
- We have not defined an evaluation
- I do not know
Who will own the application after launch?
Consider business decisions, answer review, support and team preparation.
- Business, review and support owners are assigned
- Some roles are assigned
- No owner has been assigned
- I do not know
How far have you planned the budget and team capacity?
Include preparation, implementation and ongoing running costs.
- Budget and team capacity are agreed
- We have initial estimates
- We still need to work this out
How are the initial recommendations selected?
The same published rules generate the online result. A matching rule adds its explanation and next action. We show the first three priorities, with further findings available below them.
Action permissions and recovery come first, followed by unclear action scope, source access, data handling, source preparation, workflow definition, evaluation, team ownership and cost planning. These are CloudHero’s triage priorities. They are not a validated maturity score or an estimate of financial return.
Each dimension is marked “information missing” if a relevant answer is unknown, “preparation needed” if another rule matches, or “foundation reported” otherwise. If no rule matches, the next step depends on the project stage: scope a pilot, review the pilot or review the next release. A reported foundation still needs verification.
Test permissions and approvals
Applies when: What should the AI application be allowed to do? → Prepare actions for a person to carry out or Execute actions or update business records and How are permissions and approvals enforced? → Controls are planned but not tested or We have not defined the controls or I do not know
Define who may propose, approve and execute actions. Verify that the application cannot bypass these controls.
Test failure recovery
Applies when: What should the AI application be allowed to do? → Execute actions or update business records and Can you recover from a failed or repeated action? → We have a plan but have not tested it or We have not planned this or I do not know
Test retries, duplicate actions and partial failures before allowing changes to business records.
Set the application’s action boundaries
Applies when: What should the AI application be allowed to do? → We have not decided
Decide what the application may read, propose or change, and who approves each capability.
Clarify access permissions
Applies when: Are the access rules for those sources clear? → Some permissions or integrations are unresolved or I do not know
Document who can access each source and how the application will enforce those permissions.
Classify the information first
Applies when: What kind of information will the application use? → We have not classified the information
Identify sensitive categories before choosing data flows or granting model access.
Review sensitive-data handling
Applies when: What kind of information will the application use? → Personal, confidential or regulated information
Ask the responsible security and privacy colleagues to confirm processing, retention and approval requirements.
Confirm source quality and ownership
Applies when: How prepared are the data sources? → Sources exist but need cleanup or clear owners or We have not checked yet
Inventory the proposed sources, inspect samples and resolve missing owners or outdated versions.
Choose a specific workflow
Applies when: Which workflow do you want to improve? → We have not chosen yet
List candidate tasks, name their users and select one measurable problem for the assessment.
Clarify the business outcome
Applies when: Can you measure the improvement you want? → The goal still needs to be defined or I do not know
Agree a business owner, measurable goal and the evidence needed to justify investment.
Make evaluation repeatable
Applies when: How will you judge the application’s results? → People try it and give informal feedback or We have not defined an evaluation or I do not know
Create a representative test set, assign reviewers and agree quality, access, latency and cost criteria.
Assign the missing responsibilities
Applies when: Who will own the application after launch? → Some roles are assigned or No owner has been assigned or I do not know
Name the business, review and support owners. Identify training and incident-handling needs.
Measure the current process
Applies when: Can you measure the improvement you want? → We know the goal but have not measured the baseline
Record task volume, time, correction effort and cost before estimating improvement.
Confirm effort and running costs
Applies when: How far have you planned the budget and team capacity? → We have initial estimates or We still need to work this out
Estimate data preparation, integrations, human review, model usage and support. Confirm available people and budget.
What follows a detailed assessment?
- Business case and priorities: baseline, goals, candidate workflows and benefit assumptions.
- Readiness findings and risks: evidence, blockers, remediation owners and acceptance conditions.
- Architecture and evaluation plan: components, alternatives, action boundaries and release criteria.
- Effort and cost estimates: first release, later phases, recurring costs and uncertainty.
- Team preparation: skill gaps, training needs, adoption and support ownership.
- Implementation and operating plan: milestones, dependencies, monitoring, updates and recovery.
The online check provides an initial result. We agree the scope, fee and schedule of a detailed assessment separately. Application development, training delivery and ongoing operation are separately scoped.
Our Mindory implementation and RaptorCI evaluation work illustrate the engineering behind these questions. Read our AI agent evaluation guide for test design.
Sources and version
This CloudHero methodology adapts the coverage of the AWS Prescriptive Guidance workload questionnaire and its guidance on actionable outcomes. The online branching, wording and interpretation rules are CloudHero’s. AWS example answers are illustrative; their budgets, percentages and technologies are not required targets.
Method version: 2026-11-03.1. Answers are used to calculate the result. They are saved as an enquiry only when you choose to send them with your contact details. The check requests no documents, credentials or customer records.