A readiness assessment looks forward: it checks whether your processes, data, people and budget are ready before you adopt AI. An AI audit looks at what's already running: which AI tools staff use, what data they touch, whether automations work and what they cost. New to AI? Assess readiness. Already using it? Audit first.
The catch is that suppliers use both terms loosely. Some sell an "AI audit" that is really an opportunity review, asking where AI could help, which is closer to a readiness assessment. A formal audit against ISO/IEC 42001, the standard for AI management systems, is a third thing again, carried out by certification bodies. Ask any provider which one they mean before comparing quotes.
Side by side: timing, scope, evidence and output
| AI audit | AI readiness assessment | |
|---|---|---|
| When | After AI is in use, officially or not | Before adopting AI, or before a bigger step |
| Question | Is what we run safe, working, worth its cost and within our rules? | Are we able to adopt AI well, and what must change first? |
| Looks at | Tools and plans in use, data flows, automations, costs, staff habits, vendor terms | Processes, data quality, systems, skills, budget, ownership, policies |
| Evidence | Billing records, admin reports, run histories, account settings, staff survey | Process maps, sample data, interviews, current tool list |
| Output | Findings ranked by severity, each with a fix and an owner | A score by area, the gaps, and the order to close them |
| Suits | Businesses where staff already use AI, or automations were built by someone who has left | Businesses about to spend on AI for the first time |
A useful shorthand: an audit produces a to-do list about the present, and an assessment produces a to-do list about the future. For each on its own, see what an AI audit covers and costs and what an AI readiness assessment involves.
Five yes-or-no questions that pick the right one
- Do any staff use AI tools for work, on any account? Yes: audit first.
- Do you run automations built by someone else, or by someone who has since left? Yes: audit first, starting with who owns them.
- Does any AI already talk to customers, even just drafting review replies? Yes: audit that before adding more.
- Are you about to pay for a first AI project? Yes, and the first three were no: readiness assessment.
- Are your records mostly on paper or in people's heads? Yes: readiness assessment, and expect the first fix to be record-keeping.
If you haven't asked your staff, you don't yet know the answer to question 1; the short survey further down finds out in a day. A yes to both 1 and 4 means both jobs, in that order: find out what's happening, then decide what should happen next.
Four different things sold as an "AI audit"
When a quote says "AI audit", find out which of these it is. They need different skills and produce different outputs.
- A usage and risk audit. Which AI tools staff actually use, on which plans, with what data, and whether that fits your rules. Example finding: "Four staff paste customer messages into personal chatbot accounts with the model-training setting on."
- An automation health audit. Whether the Zaps, scenarios and flows you run still work, who owns them and what they cost. Example finding: "Three automations run under a former employee's login; one has been paused for three weeks." The self-service version is in finding the Zaps and scenarios nobody owns.
- An opportunity audit. Where AI could save time or money. This is really a discovery or readiness exercise under a more saleable name. Example finding: "Rebooking reminders would recover an estimated 20 appointments a month."
- A certification audit. A formal audit of an AI management system against ISO/IEC 42001, carried out by a certification body; ISO/IEC 42006:2025 sets the requirements for the bodies that do this work. Small businesses rarely need it unless a large customer or contract asks for it.
The first two are true audits. The third is valuable but belongs in the readiness family. The fourth is a compliance product, and anyone offering it should be able to name the accreditation behind it.
A barber shop that needed an audit, not an assessment
Consider an illustrative barber business with three shops and nine barbers. The owner asks for a readiness assessment because they're "thinking about AI". A short conversation shows AI is already everywhere, so an audit is the right first purchase. Here is what a week of audit work might find:
| Finding | Evidence | Severity | Fix |
|---|---|---|---|
| Four barbers expense personal ChatGPT Plus subscriptions ($80 a month in total) and use them for captions and customer DMs | Expense claims; staff survey | Medium: customer messages in consumer accounts | Turn off the training setting now; decide on a shared business plan or a clear rule on what never goes in |
| The booking app's AI features were switched on in an update, including automatic replies to reviews | App settings page | Medium: public replies nobody approved | Switch automatic replies to drafts; owner approves |
| A Zapier account under a former manager's email runs three Zaps, including "new booking to mailing list" | Zapier account list; run history | High: the business doesn't control it | Transfer to a business-owned account; reconnect apps |
| That mailing-list Zap has been paused for three weeks; about 140 new customers were never added | Zap history | High: silent failure | Reconnect, back-fill the missed customers, route alerts to the owner |
| Nobody knows which tools touch customer phone numbers | Interviews | Medium | One-page data map |
The paused Zap is a realistic failure. Zapier pauses a Zap automatically when 95% of its runs error over seven days. The account belonged to a former manager, so anything Zapier sent about it went to an inbox nobody reads any more. Nothing looked broken from the shop floor; new customers simply stopped getting the welcome message. A readiness assessment, which looks forward, would probably never have opened the Zapier account at all.
The audit's cost savings were small (a few subscriptions consolidated), but its main value was control: after it, the owner knew what ran, where the data went, and who would hear when something broke. If you'd like to start with the money side yourself, auditing your AI subscriptions takes an afternoon.
An audit is only as good as its follow-up, so put a re-check in the diary 90 days out and test the high-severity findings again. Is the Zapier account now in the business's name? Do failure alerts reach the owner, and has anyone tested that by breaking a connection on purpose? Have the four barbers moved to the agreed accounts, or just promised to? In the illustration, the technical fixes were done within a week; the habits, such as keeping customer numbers out of personal accounts, needed the re-check and a reminder at a team meeting.
Paper tickets and no exports: why readiness comes first
Now the opposite case: a dry cleaner with two counters, paper tickets and a card machine. Staff don't use AI; the owner wants to automate collection reminders and uncollected-item chasers. An audit would find almost nothing to audit. A readiness assessment asks whether the building blocks exist, and here's how an illustrative score might look, with each area rated 1 to 5:
| Area | Score | What the assessor found |
|---|---|---|
| Processes written down | 3 | Collection policy exists; chasing is done from memory |
| Data digital and usable | 1 | Tickets on paper; phone numbers in a notebook |
| Systems that can connect | 2 | Card machine only; no booking or till software with an export |
| People and skills | 3 | Counter supervisor keen, owner short of time |
| Budget and ownership | 4 | Clear owner and a monthly budget ceiling |
| Rules for customer data | 2 | No written rules on what customers are contacted about |
The verdict is clear: the first project isn't AI at all. It's moving tickets into a till or point-of-sale system that records items, dates and phone numbers digitally, and getting customers' agreement to receive texts. Once those exist, the reminder automation is simple. Spending on AI before that would mean paying someone to type tickets into a spreadsheet by hand. For a quick way to score yourself before paying anyone, the 20-minute AI readiness checklist uses similar areas.
Readiness gaps and the usual fix for each
The dry cleaner's low scores are specific to it, but the kinds of gap repeat across small businesses. Each has a fix that doesn't involve buying AI:
| Gap | How it shows up | Usual fix |
|---|---|---|
| Nobody owns the project | Meetings end with "let's look at it next month" | Name one internal owner with an hour a week |
| Rules live in people's heads | Two staff give different answers about the refund policy | Write down the five policies an AI would have to follow |
| Customer data scattered across tools | Details in three apps and a notebook, none complete | Choose one system of record and stop duplicating |
| Staff uneasy about their jobs | Quiet resistance and "it won't work here" | Explain what changes for them and what doesn't, before anything is built |
| No running-cost ceiling | Surprise bills after launch | Set a monthly ceiling before choosing tools |
That's the point of assessing readiness first: much of what decides whether an AI project succeeds is in place, or missing, before any tool is chosen.
Evidence each one should ask you for
A provider's first request for information tells you which job they're really doing. An audit asks for evidence of what exists:
- Card and bank statements, searched for AI and automation vendors.
- Admin reports, such as the Copilot usage report in the Microsoft 365 admin centre, which shows active users over 7, 28, 90 or 180 days.
- Lists of automations with their owners and run histories.
- The settings pages of tools with built-in AI, because vendors change defaults. Since 16 June 2026, for example, SimplePractice's Note Taker has opted new users in by default to keeping de-identified transcripts. And Intuit, which now presents QuickBooks AI as Intuit Intelligence, says QuickBooks Online's AI features can't currently be switched off individually, which is worth knowing before you decide what's acceptable.
- A short, anonymous staff survey about which AI tools they use and for what.
A readiness assessment asks for evidence of capability:
- A list of processes with volumes and time per task.
- Samples of the data those processes produce.
- Who owns each process, and who would own an AI project.
- Budget, including a ceiling for monthly running costs.
- Any policies on customer data, and how staff feel about AI.
What each one asks of your own time
Neither job is free for you, even when someone else does the work. An audit leans on records: expect the owner to spend an hour or two finding statements and granting read-only access to admin screens, plus ten minutes from each member of staff for the survey. An assessment leans on conversations: roughly 30-45 minutes with each person who owns a process, a walkthrough of how work really flows, and time to pull sample data. In the illustrations above, that meant about three hours of the barber owner's time for the audit, and two hours with the dry cleaner's owner plus an hour with the counter supervisor for the assessment. Budget it as you'd budget the fee, because a rushed interview or a missing statement becomes a gap in the findings.
Running the staff survey, and reading it with AI
Both jobs benefit from asking staff directly, and the audit depends on it, because the most important AI use is often invisible to the owner. Keep it anonymous and short. Five questions that work:
1. Which AI tools have you used for work in the last month?
(ChatGPT, Gemini, Claude, Copilot, something inside another app, other)
2. Is the account personal, or one the business pays for?
3. What do you use it for? (captions, replies to customers, rotas, other)
4. Have you ever pasted a customer's name, number or message into it?
5. What would you like AI to take off your plate?To summarise the answers, paste them into an assistant on a business plan with names removed, and ask for patterns rather than quotes:
Summarise these anonymous staff survey answers for the owner.
Give: tools used and how many people use each; personal vs paid
accounts; uses involving customer data; top three requests.
Don't quote any answer word for word. Don't guess at who wrote what.An illustrative result for the barber shops:
Seven of nine respondents use an AI tool for work. Five use personal accounts. Four have pasted customer messages into a personal account, mostly to draft replies to booking questions. The most common request is help with Instagram captions, followed by handling rescheduling messages. One respondent at the second shop seems to use AI most heavily.
That last sentence is the problem: the prompt said not to guess at who wrote what, and in a nine-person business "one respondent at the second shop" may identify someone. Delete it and re-run with "Remove anything that could identify a person or location." Anonymous surveys only stay useful if staff trust they're anonymous.
Telling an audit from an assessment when the quote arrives
- "Will you look at the tools and automations we already run?" If not, it's a readiness assessment, whatever it's called.
- "Will you test our automations, or just list them?" An automation health audit checks run histories and failures.
- "Is the output a findings list or a score?" Findings suit an audit; a score with gaps suits an assessment.
- "Is this against a standard?" If they mention ISO/IEC 42001, ask whether it's a certification audit and by which accredited body, or an informal gap review.
- "What will you recommend buying at the end?" A provider that already knows the answer before seeing your business is selling a product.
Prices vary widely with scope, so compare quotes on what each will examine and produce rather than on the headline figure; what an AI readiness assessment costs goes through the pricing side.
A light version of each you can run yourself
A one-afternoon self-audit: search the last three months of card statements for AI and automation vendors; open each tool's privacy settings and check the model-training switch on any consumer account used for work; list every automation with its owner's email; check whether any owner has left; and run the five-question staff survey. If you sell to customers in the EU, note that the AI Act's duty on staff AI literacy was softened in July 2026 to taking measures to support it, and that its transparency duties for chatbots have applied since 2 August 2026, so any customer-facing bot should say it's a bot.
A 20-minute self-assessment: score the six areas in the dry cleaner's table from 1 to 5 for your own business. Any area at 1 or 2 is the first project, and it usually isn't an AI project. Anything that needs judgement beyond that, such as data-protection questions or a certification requirement from a customer, is where paying for outside help starts to make sense.
Audits and readiness assessments: follow-up questions
Is an AI audit the same as ISO/IEC 42001 certification?
No. ISO/IEC 42001, published in December 2023, is a standard for AI management systems, and certification against it is done by certification bodies, whose own requirements are set out in ISO/IEC 42006:2025. An ordinary AI audit from a consultant checks your tools, data and automations against good practice and your own rules. Most small businesses only need certification if a large customer or contract asks for it.
How often should a small business audit its AI use?
Once a year is a sensible rhythm for most, with extra checks when someone who set up automations leaves, when a vendor changes its terms or defaults, or before you add AI that talks to customers. A light self-audit takes an afternoon: card statements, account settings, a list of automations and their owners, and a short staff survey. Bring in outside help when the findings go beyond what you can judge.
Can the same provider do both an audit and a readiness assessment?
Yes, and it's often efficient, because much of the evidence overlaps. Ask for two separate outputs: a findings list about what's running now, and a readiness score with gaps for what comes next. Do the audit part first. Be wary of a free readiness assessment that ends by recommending one particular product; it may be a sales funnel rather than an assessment.
Further reads
- Signs Your Business Isn't Ready for AI Yet and What to Fix First — The warning signs a readiness assessment usually uncovers, and fixes.
- Is Your Business Data Ready for AI? A Clean-Up Checklist — The data clean-up that most readiness gaps come down to.
- How to Audit Your Workflows for AI Opportunities Yourself — The opportunity review some providers sell as an audit, done yourself.
- Microsoft 365 Copilot Readiness Checklist for Small Businesses — A readiness check for one specific rollout: Copilot.
- SOC 2 and ISO 27001 Explained: Checking an AI Vendor's Security — How security standards and certifications differ from an AI audit.
- AI Strategy vs AI Implementation Consultant: Which Do You Need? — What to buy after the audit or assessment is done.
- Course, 1:1 Call, Audit, or Project: Which AI Help Do You Need? — What a course, a 1:1 call, an audit and a project each leave you with, five questions to find your starting point, and one deli's route through three.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: ISO listings for ISO/IEC 42001 and ISO/IEC 42006:2025; EU AI Act (Article 4 as amended by the Digital Omnibus on AI, Article 50); Microsoft 365 admin centre Copilot usage report documentation; Zapier help on auto-paused Zaps; Intuit on QuickBooks Online AI features (Intuit Intelligence); SimplePractice notice on Note Taker defaults.