Interest in AI is not the bottleneck. In 2025, 20% of EU companies with ten or more employees used AI, up from 13.5% a year earlier; among small companies it was 17%, among medium-sized ones 30% and among large ones 55% (Eurostat). In Germany, 57% of companies with 20 or more employees now use AI, and 85% of those that do not cite a lack of skills (Bitkom). In the US, about 17–20% of all firms use AI, and 37% of those with 250 or more employees (US Census Bureau).
The gap between interest and a system that pays off is rarely the model. It is readiness: a process nobody has measured, data scattered across inboxes, no owner, compliance questions discovered in week six. The 25 questions below are the ones a good first audit should answer. Work through them for one process at a time, and you will know whether you are ready for a pilot, need a discovery phase first or should fix the basics.
How to use this checklist
Score each question:
- 0 — no, or we do not know;
- 1 — partly, or known but not documented;
- 2 — yes, documented and checked.
The maximum is 50 points. Scoring takes about an hour with the process owner and someone who knows the systems. Be strict: “we think so” is a 1, not a 2.
Block 1: Process and value (questions 1–5)
1. Can you name one process with a countable unit? “Customer service” is too broad; “order-status enquiries”, “supplier invoices” or “inbound calls to book a service visit” are units you can count, cost and automate.
2. Do you know the monthly volume and its seasonality? Volume drives every business case. Twenty invoices a month rarely justify automation; two thousand usually do. Note peaks, because the system has to handle them.
3. Do you have a measured baseline? Handling time, fully loaded cost per unit, error and rework rate, response time or conversion. Measured from your systems over four to eight weeks, not estimated in a meeting. Without it, no improvement can be proven.
4. Is there one success metric, and a person who signs it off? One primary metric (cost per invoice, share of tickets resolved without a human, booked appointments) plus a named owner who will make the go/no-go decision.
5. Do you know what failure costs today? The price of the status quo is your budget ceiling. Home-services businesses miss 14–27% of inbound calls and a missed call can mean a lost job worth $230–3,000 (Thoughtly); processing an invoice costs $10.89 on average versus $2.78 at best-in-class teams (Parseur). Put your own numbers next to these. Our guide to calculating AI automation ROI shows how.
Block 2: Data and knowledge (questions 6–10)
6. Do you know where inputs arrive and in which formats? Email, PDF scans, web forms, phone, WhatsApp, a supplier portal. Each channel and format adds integration work; a list prevents surprises.
7. Is your knowledge base current, and who owns updates? An AI assistant is only as good as the documents it answers from. Outdated price lists and policies are the most common cause of “hallucinations” that are really stale data. Name an owner and an update rhythm.
8. Can you collect a few hundred real historical cases? Real tickets, calls or documents, including the messy ones, form the test set that tells you whether the system works — before customers find out.
9. Do you know which personal data is involved? Names and addresses, health information, financial data, voice recordings. Special categories under the GDPR raise the bar for everything that follows.
10. Do you know where the data may be processed? EU-only hosting, transfers to US providers under standard contractual clauses or the Data Privacy Framework, or self-hosted models. Decide this before choosing tools, because it rules options in and out.
Block 3: Systems and integration (questions 11–15)
11. Which systems must the AI read from and write to? CRM, helpdesk, ERP, calendar, telephony, e-commerce platform. Answering questions needs read access; doing work needs write access, and that is where most of the budget goes. Integrations take 40–60% of a typical RAG project budget (ment.tech).
12. Do those systems have APIs, webhooks or MCP servers? Modern SaaS tools usually do; older on-premise software often does not. MCP has become the standard way to connect agents to systems, with more than 10,000 public servers (Digital Applied).
13. Are you already paying for an AI agent in your stack? HubSpot Breeze, Salesforce Agentforce, Zendesk AI, Intercom Fin and Microsoft Copilot Studio all include agents with per-outcome or credit pricing. Test what you already have before commissioning something new.
14. Can the solution run in your own accounts? Your cloud, your API keys, your automation platform. It costs nothing extra at the start and saves a painful migration later.
15. What happens when a system or the AI fails? A fallback to a human queue, a status message, a retry. Production systems are defined by how they fail.
Block 4: People and operations (questions 16–20)
16. Is there a business owner and a technical owner after launch? Somebody must own the metric, and somebody must own the system. Without both, quality decays quietly.
17. Where must a human approve or decide? Refunds above a threshold, legal statements, medical or financial advice. 49% of large US companies have explicitly defined scenarios in which an agent may not decide on its own (KPMG).
18. How will employees be involved and trained? Resistance from staff is a barrier for 42% of German AI users (Bitkom). People who help design the escalation rules become the system’s best reviewers. The AI Act also expects AI-literacy measures for staff, softened after the Digital Omnibus to supporting measures (ActuIA).
19. Who reviews quality every week? Manual QA typically covers only 1–2% of calls (AssemblyAI); with AI you can score 100% of conversations, but someone still has to read the reports and act on them.
20. How will customers be told, and how do they reach a human? A clear disclosure, an easy path to a person and a feedback loop. This is good service and, in the EU, a legal duty.
Block 5: Risk, compliance and budget (questions 21–25)
21. Is the use case high-risk under the EU AI Act? AI used in hiring, credit scoring, education and some essential services falls under Annex III, with obligations applying from 2 December 2027; emotion recognition in the workplace has been prohibited since 2 February 2025 (AIActo, AI Act Article 5). If yes, plan a separate compliance track. Our EU AI Act guide for SMBs covers the timeline.
22. Are transparency and consent covered? Since 2 August 2026, chatbots and voice agents in the EU must disclose that they are AI (Article 50). In the US, AI-generated voices count as “artificial voice” under the TCPA and need prior express consent (FCC 24-17). In Germany, recording a call without consent is a criminal offence under §201 StGB (gesetze-im-internet.de).
23. Are the GDPR basics in place? A data processing agreement with each provider, a list of subprocessors (model, voice and telephony providers), retention periods and a DPIA where calls are recorded or voice data is processed. Details in GDPR for AI chatbots.
24. Is there a budget for both build and operation, with a usage cap? 54% of German AI users name unpredictable costs as a barrier (Bitkom). Budget the build, the monthly running costs and a hard ceiling on tokens and minutes.
25. Will you own the result, and do you have an exit plan? Code, prompts, workflows, evaluation sets and data should belong to you, with a documented way to change vendors or models.
Scoring and what to do next
| Score | Status | Next step |
|---|---|---|
| 40–50 | Ready | A paid, time-boxed pilot of 2–4 weeks with signed exit criteria |
| 25–39 | Partly ready | A discovery phase: baseline, data access, integration map, compliance check |
| 0–24 | Not yet | Process and data foundations first; quick wins with tools you already pay for |
One rule overrides the total: a 0 on question 21, 22 or 23 is a blocker. Resolve it before any customer-facing pilot, whatever the score. Once you are ready, our guide on moving from AI pilot to production shows the next stages.
Which use cases usually score highest
| Use case | Why it tends to be ready | Evidence |
|---|---|---|
| First-line support | Countable tickets, clear outcome, platforms with per-resolution pricing | 66% of service teams use AI agents; 70% saw an effect within 60 days (Salesforce) |
| Inbound calls and booking | Missed calls have a direct price | Booked-call share from under 50% to 80% in a plumbing case (ServiceTitan) |
| Speed-to-lead | Response time and conversion are measurable | Human ISA $3–5k per month vs AI $99–500 (Rework) |
| Document processing | High volume, structured outcome | $10.89 vs $2.78 per invoice (Parseur) |
| Outbound “AI SDR” replacing salespeople | Usually scores low: hard to measure, high churn | 50–70% annual churn; human pipeline 2.6× higher (Forma Nôrden) |
What a good audit delivers
An audit should end with decisions, not slides. Expect a process map of the candidate process, a ranked shortlist of two or three use cases with an ROI estimate each, the measured baseline, the data and integration gaps, compliance notes and a fixed-price estimate for the pilot. On the US market, a fixed-price process audit costs around $1.5–2k and takes one to two weeks (TheCrunch); many providers credit it against the later build.
How to run the audit in one week
You can run a first audit internally, or with a partner, in five working days:
- Day 1 — kickoff and scoring. One hour with the process owner and the systems owner: go through the 25 questions and mark every 0 and 1.
- Days 2–3 — data. Export volumes and handling times for the baseline, collect real historical cases for a test set, list input channels and formats.
- Day 4 — systems and compliance. Check APIs and existing AI features in your tools; sketch the data flow; list personal data, providers and the disclosure you will need.
- Day 5 — business case and decision. Calculate conservative, base and optimistic scenarios, rescore the questions and decide: pilot, discovery or foundations.
At the end of the week you should have one page per candidate process: score, baseline, ROI estimate, open gaps and a recommendation. That page is what you take into the budget discussion.
Typical mistakes
- Auditing “the company” instead of one process. Readiness is process-specific; score each candidate separately.
- Estimating the baseline. A guessed baseline produces a guessed ROI.
- Discovering compliance late. Disclosure, consent and data processing agreements are cheap at the start and expensive in week six.
- Ignoring the tools you already pay for. The cheapest agent may already be in your CRM.
- Forgetting operations. Who reviews quality and updates knowledge after launch is part of readiness, not an afterthought.
- Treating a low score as failure. It is a to-do list — and a much cheaper finding than a failed pilot.
Conclusion
An AI readiness audit answers one question: can this specific process be automated with measurable benefit, acceptable risk and a budget you control? Twenty-five questions, one hour of honest scoring and a few weeks of data collection give you that answer before you spend money on a build.
If you would like to go through the checklist with an engineer, book a free 15-minute audit. We will pick your strongest candidate process, score it with you and tell you what a pilot in Lotus Libre Agents or Lotus Libre Systems would take.