AI Readiness Assessment for Australian Businesses: A Two-Layer Framework

An AI readiness assessment should end in a decision, not a score. The AI Lab Readiness Framework asks two questions for every proposed AI use case: should we build it, and can we? It maps the answer to a three-horizon roadmap grounded in Australian privacy law.

Download the AI Readiness Framework (free PDF)

Why most AI readiness assessments fall short

Australian businesses are trying AI faster than they are putting it to work. The National AI Centre's SME AI Pulse found that 44% of small and medium businesses had adopted AI in some form in February 2026. Yet the ABS found that only around 12% of Australian businesses used AI in their workplace in 2024–25. The gap between trying AI and running it in the business is where most projects stall.

A typical AI readiness score does not close that gap. A number out of 100 cannot tell you:

whether your data is legally usable for the use case you actually want to build
whether your review process would catch a convincing but wrong answer
whether your Privacy Act obligations are covered
whether the value you are chasing is worth the effort

Our framework replaces the score with a documented decision for each proposed use case: what evidence was inspected, which gaps have owners and dates, and which value pool the effort maps to.

Layer 1: Strategic readiness ("Should we?")

Layer 1 looks at the whole organisation across five dimensions. It is modelled on the way strategy firms assess AI programs, scaled for a business of 10 to 200 people.

Dimension	The question it answers
1. Strategy and value pools	Where does AI create the most value for this business? Which 5–10 use cases sit in the high-value, high-feasibility quadrant, and what is the estimated dollar impact of each?
2. Data and technology foundations	Is the data legally usable, technically accessible and good enough for the priority use cases? What foundational investment is genuinely required?
3. Talent and operating model	Build, buy or partner? Where are the capability gaps and how are they closed?
4. Governance and risk (Australia)	Privacy Act 1988 and the 2024 amendments, sector overlays such as APRA CPS 234 and CPS 230, IRAP for government work, ISO 42001, Australian Consumer Law and cross-border data processing.
5. Adoption and value capture	How do pilots become production? How is value measured, and what is the review rhythm from pilot to portfolio?

Layer 2: Use-case readiness ("Can we?")

Layer 2 is applied to each prioritised use case. It inspects evidence, not opinions: what the records show, not what people say.

Evidence area	What we inspect
Workflow and baseline	Process description, sample cases, current quality and time records. Is the problem defined precisely enough to measure improvement?
Data and permission	Sample inputs, source owners, quality checks, permitted uses and cross-border processing consents. Can the system use the information legally?
System integration and security	Proposed data flow, permissions, interface tests and tenancy model. Can it do the bounded task without unintended access or actions?
People and accountability	A named process owner, review responsibilities and an escalation route. Can people operate it, challenge outputs and make the release decision?
Evaluation and acceptance	Representative cases, expected outcomes, failure categories and acceptance criteria. Can the team tell an acceptable result from a convincing but wrong one?
Operation and exit	Monitoring plan, support ownership, running-cost estimate and shutdown procedure. Can the organisation sustain the use case, and stop it when necessary?

Both layers are required before a pilot moves to production.

Three horizons: from pilot to capability

Every prioritised use case is mapped to one of three horizons. This avoids the two most common failure modes: running pilots that never scale, and buying a platform that never proves its value.

Horizon	Window	Focus	Measure of success
H1: Foundation pilots	0–3 months	2–3 bounded, low-risk use cases that fix a documented pain point, with a person in the loop by default	Time or quality gain against baseline, and a decision to scale, revise or stop
H2: Scale and hardening	3–9 months	Harden successful pilots for production: security, monitoring, cost controls, compliance evidence. Launch a second wave of 3–5 use cases	Portfolio in production and measurable value captured
H3: Enterprise capability	9–18+ months	Reusable components, portfolio governance and a standing operating rhythm	AI adoption is a repeatable program the business owns

The Australian regulatory overlay

AI readiness in Australia is not only a technology question. The framework treats governance as a first-class dimension, because the obligations are real and some have firm dates:

Privacy Act 1988 and the Australian Privacy Principles (APPs) apply to personal information your AI systems use.
Automated decision-making transparency. From 10 December 2026, APP entities that use personal information in automated decisions that could significantly affect people must explain this in their privacy policies (OAIC).
Sector overlays such as APRA CPS 234 and CPS 230 for financial services, and IRAP for government work.
The National AI Centre's Guidance for AI Adoption sets out six essential practices, including accountability, testing and human control.

If your use case touches client data that cannot leave Australia, see our approach to sovereign AI hosted in Australia.

How the assessment runs

Stage	Activity	Deliverable
1. Scope and inputs	Executive briefing. Confirm scope, sponsor and the decision needed. Nominate 5–10 candidate use cases.	Signed scope note
2. Strategic scan (Layer 1)	Value-pool mapping, value and feasibility prioritisation, governance and risk register	Readiness heatmap and use-case portfolio
3. Evidence checks (Layer 2)	Inspect data samples, permissions, integration paths, review workflows and acceptance criteria for each priority use case	Use-case decision records and a gap list with owners
4. Business case and roadmap	Dollar impact per use case with upper and lower bounds, H1–H3 sequencing, buy-versus-build decisions	Business case pack and roadmap
5. Executive readout	Readout to the sponsor and leadership, with decisions recorded live and a 30-day checkpoint	Decision record and next-step brief

Quick AI readiness checklist

Before you commit budget to an AI project, check you can answer yes to these:

We can name the process, its owner and how long it takes today.
We know which data the system needs, who owns it, and that we are allowed to use it this way.
We know where the data will be processed, including whether it leaves Australia.
We have a set of real test cases with known correct answers.
A named person will review outputs before they reach a client.
We know what it will cost to run each month, and how we would switch it off.

If you answered no to two or more, start with an assessment rather than a build.

Get the full framework

The complete AI Lab Readiness Framework, including both layers, the three horizons, the comparison with Big 4 and boutique advisory, and the delivery process, is a free two-page PDF.

Download the AI Readiness Framework

Want us to run it on your business? Book an AI readiness assessment or read about our AI consulting services.