Last updated: October 15, 2026
By ZapAI Team
TL;DR: An AI readiness assessment scores ten things before you fund agents. Use case and ROI, data, permissions, identity, integration, platform, skills, responsible AI, budget, and measurement. Score each 0 to 2. Under 9 out of 20, fix foundations first. For Microsoft 365 Copilot, check SharePoint oversharing before anything else, because the cleanup tools come with the license. Our AI strategy consulting team uses this same scorecard.
An AI readiness assessment checks whether your use cases, data, permissions, security, integrations, people, compliance, budget, and metrics can support AI agents. Score each area before funding, then pilot only where the foundations hold.
Agent demos are easy to love. Then the pilot starts. The agent quotes a draft price list from a SharePoint site nobody remembers creating, and finance asks what the Copilot Credits bill looks like in month three. Silence. Familiar?
So the AI readiness assessment belongs before the purchase order. Below is our 10-point checklist, a 20-point scorecard, and a 30/60/90-day plan. Bias disclosed. We get paid for readiness work and for building agents. A low score might mean you don’t need us yet.
What Is an AI Readiness Assessment, and Why Run One Before Agents?
It’s a short, structured review of whether your business case, data, controls, and people can support AI in production. Agents raise the stakes because they act on data instead of just summarizing it.
A chat assistant that gets something wrong writes a bad paragraph, while an agent that gets something wrong can update a record, email a customer, or hand a file to someone who shouldn’t see it. Different risk class. So this checklist weighs permissions as heavily as ROI. A 0 means missing, a 1 means partly there, and a 2 means you could show an auditor evidence tomorrow.
1. Is There a Use Case Worth Funding?
You pass when one named process has an owner, a measured baseline, and a written guess at the gain. Use AI for productivity isn’t a use case.
Score 0 for a slogan, 1 for a process nobody has timed, 2 when you know today’s numbers and what success is worth. Write the hypothesis as a sentence you could be wrong about. For example, the agent drafts first replies on order-status emails, and handle time on that category drops by a third within eight weeks. Falsifiable. That’s the point.
2. Is Your Data Clean, Findable, and Owned?
Agents are only as good as the data they ground on. You need to know where each source lives, who owns it, and whether it’s current enough to quote to a customer.
If the honest answers involve a file share, three Excel exports, and a person who left in 2024, score a 1 at best. The fastest win usually isn’t new data. It’s deleting old data, because five versions of the same pricing PDF give an agent five chances to quote the wrong one to a customer who’ll hold you to it.
Scattered analytics data grounds better from one governed home in Microsoft Fabric. App data stuck in SharePoint lists? Our Dataverse vs SharePoint comparison covers when that stops holding up.
3. Will Copilot Surface Files People Shouldn’t See?
It will if your permissions are loose. Microsoft 365 Copilot only shows content a user can already access, so every overshared site quietly becomes an AI search result.
Microsoft’s secure and governed foundation guide, updated October 2026, runs in three steps, remediate oversharing, set up guardrails, and meet regulations. SharePoint Advanced Management (SAM) is included with Copilot licenses, and foundational Purview capabilities come with Microsoft 365 E3. Most of the kit is already paid for.
- The SAM Content Management Assessment flags overshared, inactive, and ownerless sites. Microsoft suggests rerunning it every 30 days.
- Purview DSPM data risk assessments, for sensitive files sitting in overshared sites.
- Restricted Content Discovery hides a site from Copilot and organization-wide search without changing permissions. A tourniquet, not surgery.
- Need a hard wall? Restricted Access Control limits a site to one Entra or Microsoft 365 group.
- DLP for Copilot policies keep labeled files out of Copilot’s processing.
One line in Microsoft’s SharePoint Advanced Management readiness guide deserves a sticky note. By default, SharePoint sharing is set to the most permissive option. Unless someone changed it, assume you’re overshared. Score 0 if nobody has run a data access governance report, 2 if high-risk sites are fixed and labels are in use.
4. Are Identity and Access Controls Ready?
Every Copilot user needs a Microsoft Entra ID account, and every agent needs least-privilege access. Shared admin accounts and years of unreviewed guests fail this item.
Microsoft’s Copilot requirements page lists an Entra ID account, an eligible base license, and an Exchange Online mailbox for mail-grounded features, and it warns that Copilot isn’t available with device-based licensing for Microsoft 365 Apps for enterprise. Small detail. Big surprise on rollout day.
There’s an AI Administrator role for Copilot administration without Global Administrator rights. Use it. A 2 here means MFA enforced, Conditional Access reviewed, guests reviewed this year, and agent connections running under scoped accounts.
5. Can Agents Reach Your Systems Through Real APIs?
An agent that can’t read or update your line-of-business systems is just a chatbot. Each target system needs a supported connector or API, with authentication you control.
Score 2 for Dataverse, standard connectors, or documented REST APIs. Score 0 when the only path is a nightly CSV someone emails to themselves. The build mechanics, including MCP servers and least-privilege actions, live in our guide to building an AI agent for Dynamics 365.
6. Have You Picked the Right Platform for the First Agent?
Match the platform to where users work and how hard the job is. Microsoft 365 Copilot for everyday work, Copilot Studio for most internal agents, custom code when retrieval or control needs go further.
The readiness test is whether you chose per use case, on purpose. Our Copilot Studio vs custom agents breakdown has a five-question test for exactly that, and Claude vs Microsoft Copilot covers the chat-seat debate. Score 0 if a demo picked the platform. If Copilot Studio wins, plan environments, data policies, and ownership from day one, as in any Copilot Studio implementation.
7. Do Your People Have the Skills and the Appetite?
You need a named business owner with time budgeted, an admin who understands Copilot and Power Platform governance, and users who’ve seen what good review looks like.
Score 0 if training means a launch email. Score 2 if the owner has hours allocated and managers know who reviews agent output, which is the cheapest fix on this list and the one most likely to be skipped because everyone assumes someone else is checking the drafts.
8. Have You Covered Responsible AI and Compliance?
You need a written AI use policy, a risk review per agent, and a map of the rules that apply. US firms usually anchor on the NIST AI RMF. EU exposure adds the AI Act.
NIST’s AI Risk Management Framework, released January 26, 2023, organizes the work into four functions, Govern, Map, Measure, and Manage. A Generative AI Profile (NIST AI 600-1) followed on July 26, 2024. Voluntary, yes. Still the easiest common language with auditors.
Selling into the EU? Per the European Commission’s AI Act overview, prohibited practices and AI literacy duties have applied since February 2, 2025, and transparency rules from August 2026. The AI Omnibus, in force since July 27, 2026, moved high-risk rules for Annex III uses such as employment to December 2, 2027, which means an HR screening agent you build this year will likely sit squarely inside that scope. Bring counsel in early.
For policy headings, borrow the six goals in Microsoft’s Responsible AI Standard (v2, June 2022), accountability, transparency, fairness, reliability and safety, privacy and security, and inclusiveness.
9. Is the Budget Real, Including Usage Costs?
Budget for seats and for metered usage. Microsoft 365 Copilot lists at $30 per user per month paid yearly, and agents draw Copilot Credits at $0.01 each on pay-as-you-go.
Per Microsoft’s Copilot enterprise pricing, checked October 15, 2026, that $30 sits on top of a qualifying Microsoft 365 plan. Copilot Business lists at $21 for up to 300 users, with an $18 first-year promo on yearly billing for existing Business customers through December 31, 2026.
Metered is where budgets wobble. Credit packs run $200 a month for 25,000 credits, and Microsoft’s Copilot Credits licensing guidance lists prepurchase discounts up to 20% at the largest tier. Quick math. 200 enterprise seats cost $72,000 a year before a single credit, and an agent burning 100,000 credits a month adds $1,000. Score 2 only with a credit forecast and a named owner for the bill.
10. How Will You Know the Pilot Worked?
Pick two or three KPIs before launch, measure a baseline, and run a time-boxed pilot against a comparison group. Usage alone isn’t success.
- Minutes per task, before and after.
- Edit rate on agent drafts. Heavy rewrites mean no time saved yet.
- Accuracy on a fixed test set of questions with known answers, rerun after every change.
- Cost per resolved item, once credits are counted.
The Copilot Dashboard in Viva Insights tracks adoption, but adoption isn’t ROI. Our usual pilot runs six to eight weeks with a few dozen users, plus a similar group without access so you can tell the agent’s effect apart from a busy quarter.
How Do You Score Your AI Readiness Assessment?
Score each point 0, 1, or 2 for a total out of 20. The bands below are ZapAI guidance from our own engagements, not an industry standard.
| Point | 0 (missing) | 2 (ready) |
|---|---|---|
| 1. Use case and ROI | A slogan, no owner | Owner, baseline, falsifiable hypothesis |
| 2. Data quality and ownership | Unknown sources, stale copies | Named owners, current, deduplicated |
| 3. Governance and permissions | No sharing reports ever run | High-risk sites fixed, labels and DLP live |
| 4. Identity and security | Shared admins, unreviewed guests | MFA, Conditional Access reviewed, scoped agent access |
| 5. Integration and APIs | CSV exports and scraping | Supported connectors or documented APIs |
| 6. Platform choice | Picked from a demo | Chosen per use case, fits licenses and skills |
| 7. Skills and change | Launch email only | Owner time budgeted, review roles defined |
| 8. Responsible AI and compliance | No AI policy | Policy, per-agent risk review, rules mapped |
| 9. Budget and licensing | Seats only | Credit forecast, spending cap, bill owner |
| 10. Measurement | We’ll check usage | KPIs, baseline, comparison group, stop criteria |
A 1 sits in between. Now the total.
- 0 to 8, foundations first. Don’t buy agents yet. Spend 60 days on points 2 through 4.
- 9 to 14 means pilot-ready. Fund one scoped agent on clean data, with human review.
- 15 to 20? Scale-ready, though each agent still gets measured on its own.
- One override beats the total. Any 0 on point 3 or 4 blocks a broad Copilot rollout.
Harsh? Maybe. A 16 with wide-open SharePoint is still a leak waiting for the right prompt.
What Does a 30/60/90-Day AI Readiness Plan Look Like?
Days 1 to 30 assess and contain, days 31 to 60 fix and pilot, days 61 to 90 measure and decide. The day-90 goal is an evidence-backed funding decision, not a big launch.
- Days 1 to 30. Score the checklist with IT, security, and one business owner in the room. Run the SAM assessment and data access governance reports, switch on Restricted Content Discovery for the worst sites, and draft the AI use policy.
- Days 31 to 60. Remediate top-risk sites with site access reviews, labels, and DLP for Copilot. Build one agent, assemble a test set of 50 known questions, and launch the pilot.
- Days 61 to 90. Compare KPIs to baseline, review real credit consumption, and rescore all ten points. Then scale, adjust, or stop.
Stopping is a legitimate outcome. Far cheaper at day 90 than at month nine.
Wrapping Up
An AI readiness assessment is ten honest questions and a number. What sinks agent projects is rarely the model. It’s stale data, loose SharePoint permissions, missing owners, and budgets that forgot about credits, so score yourself, respect the override on permissions and identity, and let the 30/60/90 plan turn that score into a funding decision.
ZapAI is a Microsoft Dynamics 365, Power Platform, Fabric, and AI consulting firm based in Irving, Texas. We help US companies decide where AI agents will pay off, then get data, permissions, and governance ready before anything ships. For a second opinion on your score, our AI readiness and strategy team can run the assessment with you and hand back a scored report with a 90-day plan.
What Leaders Ask Before Funding AI Agents
Realistically, how long does an AI readiness assessment take?
Two to four weeks for a mid-size Microsoft tenant, in our planning experience. The fixes it surfaces take longer, which is why the plan above runs 90 days.
Do we need Microsoft 365 E5 to get ready for Copilot?
Not to start. Microsoft says foundational Purview capabilities come with Microsoft 365 E3, and SharePoint Advanced Management is included with Copilot licenses. E5 or E7 adds optimized Purview features.
Can we skip the assessment and just run a pilot?
You can, if the pilot stays small and grounds only on sites you’ve already checked. A happy pilot on clean data proves nothing about the rest of the tenant, though.
Copilot readiness assessment vs AI readiness assessment, does the difference matter?
Somewhat. A Copilot readiness assessment covers the Microsoft 365 tenant, meaning licenses, identity, and permissions. An AI readiness assessment adds the business case, custom agents, compliance, and measurement. Funding agents? Run the wider one.
Does the EU AI Act apply to a US company?
Wherever you’re based, it can reach you. The Act covers companies that place AI systems on the EU market or whose AI output is used in the EU. Have counsel confirm scope per use case.
What score should we hit before buying Copilot licenses broadly?
15 out of 20, with no zeros on permissions or identity. For a pilot, 9 is enough. That’s our rule of thumb, not Microsoft’s, so adjust it to your risk appetite.