Category
The AI Readiness and Maturity Guide
Last updated: June 2026
If you run a $10M to $200M company and your board has started asking whether you are ready for AI agents, the wrong answer is going to surface twelve months from now as a written-off pilot, a budget cut to next year's AI line item, and an awkward question about who picked the vendor. The data the agent needs is locked in three systems that do not talk to each other, the team that was supposed to own it has shipped a chatbot and called it strategy, and the security team is finding employee prompts pasted into public ChatGPT with customer data attached. In this guide, you will get the five-stage AI maturity model, the readiness assessment Arkeo runs on its own engagements, the data audit that determines whether a custom agent can actually ship, and the decision rule for hiring outside help versus running the work in-house, so you can answer the board with a credible plan instead of a pitch deck.
According to the Stanford HAI 2025 AI Index, 78% of organizations reported using AI in 2024, up from 55% in 2023, the largest year-over-year jump in the Index's history. Adoption is no longer the question. Whether your specific operation is ready to put a custom agent into production is. Arkeo has spent three years deploying AI agents on its own operations and on mid-market client engagements, and the failure mode that repeats is not model quality. It is readiness. The data is not clean, the workflow is not mapped, the approvals are not designed, and the company is shipping a pilot when it should have been running an audit.
Quick Answer
• What it is: AI readiness is the diagnosis of your current state, data, infrastructure, workflows, and culture, that determines whether a custom AI agent can actually ship in your business.
• How you measure it: Against a five-stage maturity model (Ad Hoc, Aware, Active, Operating, Embedded) using a data, infrastructure, and culture scorecard.
• Cost of skipping it: Pilots that stall at integration, budgets cut after one bad quarter, and breaches tied to ungoverned shadow AI ($670,000 added breach cost per IBM 2025).
• Why it matters: The companies that diagnose first ship agents in 6 to 10 weeks and avoid the seven-figure write-offs that scare boards off AI for a year.
• Next step: Book a free AI Assessment, Arkeo will audit your workflows to see if you are ready for custom agents.
What does AI readiness actually mean?
AI readiness is the organizational, data, and infrastructure condition of your business measured against the operating requirements of a specific AI workload, not a generic score. A company can be ready for an off-the-shelf copilot, not ready for a custom workflow agent, and nowhere near ready for an autonomous multi-agent process, all on the same day. Readiness is workload-specific. That is the first thing most readiness frameworks get wrong.
The reason it matters now: 78% of organizations are using AI, but Deloitte's State of Generative AI Wave 4 survey of 2,773 C-suite and director-level leaders across 14 countries found that more than two-thirds of enterprise respondents expect 30% or fewer of their GenAI experiments to be fully scaled within the next three to six months. The gap between using AI and operating AI is exactly the gap readiness measures. BCG research published in October 2024 put a number on the same gap: 74% of companies struggle to achieve and scale value from AI, and only 4% have built cutting-edge AI capabilities that consistently generate significant value. The default outcome for an unready company is not failure, it is purgatory.
The default outcome for an unready company is not failure. It is purgatory.
How does the AI maturity model define the stages?
The ai maturity model Arkeo uses on engagements has five stages. They are workload-anchored, not slide-deck-anchored, which means a company can sit at Stage 3 for customer support and Stage 1 for finance on the same Monday morning. Treat the stages as a diagnostic grid, not a ladder.
THE MATURITY GRID
Five stages, scored per workload
A company can sit at Stage 3 for customer support and Stage 1 for finance on the same Monday morning. Move the workload, not the company.
STAGE 01
Ad Hoc
Employees use ChatGPT, Claude, or Gemini on personal accounts. No policy, no inventory, no audit trail. This is shadow AI. The Stanford HAI 78% adoption figure includes you whether you know it or not.
STAGE 02
Aware
Leadership has named AI as a priority. There is an acceptable-use policy, paid enterprise seats for a copilot or two, and an experiment or pilot in one department. No agent has been deployed to production yet.
STAGE 03
Active
At least one custom workflow agent is in production with measurable output. The data pipeline feeding it is documented. Approvals are designed (human-in-the-loop for material actions). The first ROI number is on a board slide.
STAGE 04
Operating
Three or more agents run across two or more departments, integrated with the ERP or CRM, monitored daily. A Manage phase exists with on-call ownership. Failure modes are cataloged and tested. AI is on the operating P&L.
STAGE 05
Embedded
An AI operating system runs the business. Agents are first-class workers with scoped permissions, on-prem or private deployment, audit logs, and a managed lifecycle. The company can stand up a new agent in days, not quarters.
Stage 3 is the line between using AI and operating AI. Reach it first in one workflow, not everywhere at once.
Most mid-market operators sit at Stage 1 or Stage 2 and believe they are at Stage 3. That belief is the most expensive mistake in AI strategy, because it justifies signing a six-figure build contract with no audit. The PwC AI Agent Survey of 300 senior US executives in May 2025 reports that 79% of US businesses say AI agents are already being adopted and 88% plan to increase AI-related budgets in the next 12 months. The budget is coming. Whether your operation can turn that budget into a working agent is the readiness question.
How do you run an AI readiness assessment?
The ai readiness assessment is a structured diagnostic of three things: data, infrastructure, and people. It is not a quiz on a slide. A real assessment ends with a one-page diagnosis the CFO and the COO can both read and act on. Arkeo runs the assessment in five working days for a single workflow scope and in three to four weeks for a company-wide scope. The output is a maturity score per workload, a list of go/no-go conditions, and the shortest path to Stage 3 in one chosen area.
The assessment scores each workload candidate against six dimensions. Treat any score below 3 out of 5 in any single dimension as a no-go for that workload until the gap is closed.
THE READINESS DIMENSIONS
Six dimensions every workload gets scored on
Any single dimension below 3 out of 5 is a no-go for that workload until the gap is closed.
DATA
Data availability
Is the data the agent needs already captured digitally, in a system Arkeo can reach via API or export? PDFs in a shared drive count as zero until they are parsed and structured.
DATA
Data quality
Is the data correct, current, deduplicated, and labeled? An agent that runs on dirty CRM contacts will scale your existing bad outcomes faster, not better.
INFRASTRUCTURE
System integration
Can the agent reach the ERP, CRM, ticketing system, and approval queue where decisions get made? If the answer is "only through a CSV export emailed twice a day," the agent will live as a suggestion box.
PROCESS
Workflow clarity
Has the current workflow been written down? Most have not. An agent cannot automate a process that lives only in the head of one senior person about to retire.
GOVERNANCE
Approvals design
Where does the agent need a human signature? An invoice over $5K, a customer refund, a contract clause. These approval points must be designed before the build, not after.
PEOPLE
Culture and ownership
Does a named operator own the agent the day after it ships? If the answer is the consultant, the agent will die in 90 days. The IBM 2025 IBV CEO Study of 2,000 CEOs across 33 countries reports that lack of expertise is the top barrier to AI innovation.
A score below 3 in any single dimension is a stop sign. Close the gap first, then deploy.
The IBM IBV CEO Study is worth quoting in full on this point: 54% of CEOs are already hiring for AI roles that did not exist a year ago, 31% of the workforce will require retraining or reskilling over the next three years, and 65% of CEOs say their organizations will use automation to address skills gaps. Read those numbers as one sentence: the people side of AI is now a board-level capital allocation question, and the firms that skip it lose the budget before they lose the pilot.
What is a key challenge for organizational AI readiness?
The single most common gap is data the company does not realize it is missing. Most mid-market businesses think they have a data problem at the database level. The data problem is usually two steps upstream, in the data that never made it into a database to begin with. Inspection notes in a tradesperson's notebook, customer commitments captured in Slack DMs, pricing exceptions agreed on the phone and never reconciled. Until that data is captured, no model, however good, has anything to reason over.
The second most common gap is integration. The third is approvals design, and the fourth is on-call ownership for after the agent ships. These are not technology problems. They are operating-discipline problems wearing AI costumes. Arkeo has been in business for 25 years operating real companies before deploying AI agents on top of them, which is why the readiness work looks like operations work: process maps, data sources, approval routing, owner names, on-call schedules.
See if your operation is ready for custom agentsThe free AI Assessment audits one of your workflows end-to-end, scores its readiness against the six dimensions above, and tells you exactly where to start. No pitch deck.
Book Your Free AI Assessment →
What is an AI data audit and how do you run one?
THE AI DATA AUDIT
Four passes to a go or no-go
The highest-leverage exercise in cluster 02. Every readiness question downstream depends on it.
PASS 01
Source inventory
List every system, document store, inbox, spreadsheet, and human notebook that contains data the agent will need.
PASS 02
Quality probe
Pull a 100-row sample from each source and score it for completeness, correctness, and consistency.
PASS 03
Integration map
For each source, document the access route (API, export, OCR, manual entry), the latency, the cost, and the failure mode.
PASS 04
Risk profile
Classify data by sensitivity, identify regulated fields (PII, PHI, financials), and decide cloud, private cloud, or on-premise before the build.
Output: go, fix-first, or no-go for this workload. Skip the audit and you pay the breach tax instead.
An AI data audit is the structured inventory of every data source a candidate workload depends on, scored for availability, quality, integration cost, and risk, and concluded with a go, fix-first, or no-go recommendation for the workload. It is the single highest-leverage exercise in cluster 02 because every other readiness question downstream depends on it. An ai audit is not a database review. It is an operating review with a data lens.
The audit follows a four-pass routine. Pass one is the source inventory: list every system, document store, inbox, spreadsheet, and human notebook that contains data the agent will need. Pass two is the quality probe: pull a 100-row sample from each source and score it for completeness, correctness, and consistency. Pass three is the integration map: for each source, document the access route (API, export, OCR, manual entry), the latency, the cost, and the failure mode. Pass four is the risk profile: classify the data by sensitivity, identify regulated fields (PII, PHI, financials), and decide where the workload must run (cloud, private cloud, or on-premise) before any agent is built.
Skipping the audit is what produces the breach numbers in IBM's 2025 Cost of a Data Breach report: the global average breach now costs $4.44 million, the US average has hit an all-time high of $10.22 million, organizations with high shadow-AI usage incur an extra $670,000 per breach, and 97% of organizations that suffered a breach of an AI model or application lacked proper AI access controls. 13% of breached organizations reported a breach of an AI model or application. Those numbers are the tax on running pilots without an audit.
U.S. average data breach cost in 2025, an all-time high. Organizations with high shadow-AI usage incur an extra $670,000 per breach.
Source: IBM Cost of a Data Breach 2025
Most mid-market operators believe their data is in worse shape than it is in the systems and in better shape than it is in reality outside the systems. The audit pulls those two beliefs into line. Once it is done, the rest of the readiness work becomes mechanical: the gaps are listed, the integration costs are estimated, the regulated workloads are flagged for private deployment, and the build sequence becomes obvious.
What is an AI maturity model versus an AI strategy?
Readiness owns the current state. Strategy owns the future state. The line matters because the same operator can have a credible AI strategy and still be unready to execute it, or be perfectly ready to execute and not have a strategy.
READINESS · CLUSTER 02
Diagnoses the present
The five-stage maturity model, the readiness assessment, the data audit, the audit services decision. Answers: can we ship a custom agent in this workflow today?
STRATEGY · CLUSTER 01
Sequences the future
The 30/90/12-month roadmap, the sequencing of pilots into deployed agents, the implementation plan. Answers: in what order do we build, over what timeline, with what budget?
ROI · CLUSTER 03
Justifies the spend
The business case math, the top-three-agent prioritization, the cost-to-deploy versus expected-return calculation. Answers: which agents pay back first and how do we prove it to the board?
The right reading order is readiness, then strategy, then ROI. Skipping readiness is how mid-market companies end up with a beautiful 30/90/12-month roadmap that crashes at month three when nobody can find the data the month-three milestone depends on.
How do you choose AI audit services versus running the audit in-house?
Two questions decide it. The first: does your team have someone who can sit in the same room as your CFO, your COO, and your VP of Engineering for a week and produce a maturity diagnosis they all sign off on? The second: do you have an internal track record of finishing diagnostic work without it sliding for two quarters? If the answer to either is no, you are buying ai audit services. If the answer to both is yes, you can use ai audit tools and run it internally.
The honest tradeoff matrix:
OPTION 01
DIY internal audit
Best when: you have a senior operator (former PMO, COO chief of staff, fractional CTO) on payroll who can carve out 30 to 50 hours over two to three weeks and finish.
Cost: internal time only.
Risk: the audit stalls at week six because the operator gets pulled to the actual job they were hired for. The output is a half-finished spreadsheet nobody reads.
OPTION 02
External audit firm
Best when: you need the diagnosis on a known timeline and you want an outside voice the board will trust on Monday.
Cost: in the mid-market, audit fees commonly land in the $15K to $50K range for a single-workflow assessment and $40K to $150K for a company-wide one, depending on scope and sensitivity.
Risk: you buy slides instead of a deployable plan if the firm has never operated a business itself. Test for build experience, not deck experience.
OPTION 03
The Arkeo approach
Best when: you want the audit to be the first step toward a deployed agent, not a standalone consulting engagement.
Cost: the free AI Assessment audits one workflow end-to-end; the paid Consult extends it across the company; build and Manage phases follow if the audit says go.
Risk: none, until you book the Consult or the build. The free Assessment is structured to give you a decision, not a sales pitch.
One blunt truth before you sign anything: most "AI strategy" firms deliver a 40-slide deck and disappear. That is the failure mode the 74% value-gap figure from BCG's October 2024 research is measuring. If the firm cannot describe the agent they would build out of the audit, in operating language a CFO understands, the audit is going to end at the deck and your maturity score will not move.
What does the NIST AI RMF say about readiness?
The NIST AI Risk Management Framework 1.0 is the US government's reference standard for managing AI risk and trustworthiness. Released January 2023 and updated with a Generative AI Profile in July 2024, it is voluntary, sector-agnostic, and organized around four core functions: Govern, Map, Measure, and Manage. Most mid-market operators do not need to implement NIST line-by-line. They do need to know it exists, because regulators, insurers, and enterprise customers are going to start asking about it inside the next two budget cycles.
Map the NIST four functions onto the Arkeo readiness work as follows. Govern is the policy, ownership, and approval rules your readiness assessment names. Map is the workflow and data audit, which surfaces what the agent will touch. Measure is the maturity score per workload plus the ROI math. Manage is the on-call ownership and the lifecycle of the agent after it ships. If you cannot answer those four questions for a specific workload, the workload is not ready, regardless of how the team feels about ChatGPT.
What does "ready" actually look like at Stage 3?
Picture a 200-person specialty manufacturer with one custom agent in production. The agent reads incoming RFQs, extracts spec data, queries the ERP for stock and lead time, drafts a quote, routes it to the sales engineer for approval, and writes the approved quote back to the CRM. The data pipeline is documented. The integration runs over the ERP's REST API plus a Slack-based approval queue. The Manage phase covers a 30-minute morning check by an internal owner and a quarterly review with Arkeo. The agent has a name, a runbook, an owner, and a row on the operating P&L. The company can describe in one paragraph why this workflow was first, what it cost, what it saves, and what is shipping next.
That is what Stage 3 looks like. It is not a moonshot. It is a normal operating system upgrade. Arkeo has been deploying agents on this exact pattern since 2023, including the agents that run Arkeo itself: we use what we sell. A scoped single-workflow agent typically runs $15K to $40K and reaches production in 6 to 10 weeks, 8 to 12 weeks when the deployment is private or on-premise. Off-the-shelf copilots like Microsoft 365 Copilot or ChatGPT Enterprise are roughly $20 to $30 per user per month and live in days. The first quick win typically lands inside 30 to 90 days. Those are operator ranges from Arkeo's own builds, not sourced benchmarks.
The companies that get to Stage 3 first are not the largest. They are the ones that took readiness seriously, ran the audit, picked one workflow, deployed it well, and operated it in production for a full quarter before scaling. The companies that get stuck at Stage 2 are the ones that signed for a platform license before they ran an audit.
Not sure which sub-topic to start with?
If you are not sure whether your first move is the maturity model, the assessment, or the data audit, that uncertainty is itself a Stage 1 signal. The fastest way to resolve it is to book the free AI Assessment. Arkeo will audit one of your workflows end-to-end, place the workflow on the maturity model, and point you at the right entry point. Use the assessment as the routing question, then dive into the spoke articles for the deeper material.
Audit your workflows in 60 minutesArkeo's free AI Assessment audits one of your workflows against the six readiness dimensions and gives you a go, fix-first, or no-go decision you can take to the board.
Book Your Free AI Assessment →
