Small Business AI Readiness & Workflow Toolkit

WORKING TOOLKIT

1. AI Readiness Scorecard

Score each statement 0 = No / Not Established, 1 = Partially, or 2 = Yes / Consistently Established. Maximum score: 40.

Leadership & Business Alignment

1. We can name the business problems we want AI or automation to solve.
2. We have an accountable owner for technology and AI decisions.
3. We can define measurable outcomes such as hours saved, faster response, fewer errors or improved revenue.
4. We distinguish experimentation from production use.

Workflow Readiness

5. Our important workflows are documented well enough to explain to another person.
6. We know where duplicate entry, delays, handoffs and repetitive work occur.
7. We know which tasks require human judgment and which are rules-based.
8. We can identify at least three repeatable processes worth evaluating for automation.

Data, Privacy & Security

9. We know which information is confidential, regulated or sensitive.
10. Employees know what information must not be entered into unapproved AI tools.
11. We use strong identity controls such as MFA where appropriate.
12. We have reliable backup and recovery for critical business information.

People & Governance

13. Staff understand that AI output requires human review.
14. We have basic acceptable-use guidance for AI tools.
15. Employees know which tools are approved for business use.
16. We have a process for reporting errors, privacy concerns or unsafe AI behavior.

Implementation Capability

17. We can run a limited pilot before company-wide deployment.
18. We can measure whether a pilot actually improved the workflow.
19. We can support, document and maintain a successful automation after launch.
20. We are prepared to stop or redesign an AI use case that does not produce measurable value.

Score Interpretation

• 0–15: Foundation First. Focus on workflow documentation, security, data handling and acceptable-use controls before significant AI deployment.
• 16–29: Pilot Ready. Select one or two low-risk, measurable workflows for controlled implementation.
• 30–40: Controlled Scale. The organization has a stronger foundation for multiple AI and automation initiatives, but each use case still requires security, privacy and ROI review.

---

2. Workflow Mapping Worksheet

Complete these fields for each workflow you are considering for improvement:

• Workflow name: What process are we evaluating?
• Trigger: What starts the process?
• People involved: Who touches the process?
• Systems involved: What software, email, spreadsheets, forms or databases are used?
• Current steps: Document the process from start to finish.
• Average volume: How many times per day, week or month does this occur?
• Time per occurrence: How much employee time is consumed?
• Friction: Where do delays, errors, duplicate entry or missed follow-up occur?
• Human judgment: Which steps require expertise, approval or subjective decisions?
• Sensitive data: Does the workflow touch PHI, financial data, credentials, HR information or other confidential records?
• Desired outcome: What would a better version of the workflow achieve?

3. AI Opportunity Prioritizer

For each candidate workflow, score the following from 1 to 5:

• Business value: Revenue, customer experience, risk reduction or operational importance.
• Time savings: Potential reduction in repetitive staff effort.
• Feasibility: Availability of clean inputs, integrations and clear process rules.
• Adoption readiness: Likelihood that staff can realistically use and support the solution.
• Risk: Privacy, security, legal, reputational or operational downside. Lower risk is better.

Priority guideline: Start with workflows that combine high business value, meaningful time savings and strong feasibility with low data sensitivity and limited downside if the system makes a mistake.

4. AI Acceptable-Use Starter

Organizations should customize this starter language for their environment and obtain appropriate legal, compliance or security review when required.

• Only approved AI systems may be used for company business.
• Do not enter passwords, authentication secrets or private encryption keys into general-purpose AI tools.
• Do not enter regulated, confidential, customer, employee, medical or financial information unless the organization has specifically approved that system and use case.
• AI-generated content must be reviewed by a responsible person before it is relied upon, published, transmitted to customers or used to make material business decisions.
• AI may assist decision-making but should not silently replace required human approval.
• Employees must not represent AI-generated information as verified fact without appropriate review.
• New AI tools or automations should be evaluated for security, data handling, ownership, retention, integration and business value before production use.
• Suspected disclosure of confidential information, unsafe output or significant AI error should be reported promptly.

5. Vendor Evaluation Checklist

• What business problem does the product solve?
• What information will the vendor receive, retain or process?
• Can customer data be used to train vendor models?
• What identity, MFA, permissions and administrative controls are available?
• What integrations are required?
• Can data be exported if the organization leaves the platform?
• What are the implementation, licensing, support and exit costs?
• What happens during an outage?
• Who is responsible for maintaining prompts, workflows, integrations and documentation?
• How will success be measured after 30, 60 and 90 days?

6. 90-Day Action Plan

Important: This toolkit is general educational material. It is not legal, compliance, accounting, medical or cybersecurity certification advice. Regulated environments require appropriate professional review.