An AI readiness framework is a structured way to check whether your organization can adopt AI safely and usefully. It names the dimensions you assess, the questions under each, and how you score the answers. The best ones for an Australian business cover strategy, people and workflows, governance, data and security, and they end in a short list of actions rather than a long report that sits in a drawer.
This guide sets out what those dimensions are, how Australian government and professional bodies describe them, how scores are usually read, and how to turn the gaps into a plan you can start on Monday.
Calibreforumcalibreforum.auTurn AI Readiness Into a 90-Day PlanCalibre Forum’s structured survey gathers employee insights and produces a scored report with a clear 90-day action plan for your organization.Explore the AI readiness assessmentTL;DR
- A framework defines the dimensions, questions and scoring rules. A checklist is the question list. A model is the maturity scale you score against.
- Australian guidance consistently looks at business priority, workflows, people and consultation, governance and oversight, data, and security and privacy.
- Scores only help if each dimension is read separately. A strong total can hide one weak area.
- Your staff already know which AI tools are in use. A framework that ignores their answers misses the biggest blind spot.
- Finish with a 90-day plan, then reassess on a regular rhythm.
Table of Contents
- What an AI readiness framework is, and how it differs from a model or checklist
- The dimensions a framework should assess
- Governance, privacy and security in an Australian assessment
- A framework you can apply: dimensions, questions and evidence
- How AI readiness scores are determined and read
- Why staff answers belong in the framework
- Turning gaps into a 90-day plan
- Moving from pilot to scale
- Our perspective
- What the Calibre Forum assessment gives you
- Reassessing over time
- FAQ
- Sources
What an AI readiness framework is, and how it differs from a model or checklist
The three terms get used interchangeably, and that causes confusion when you compare tools.
- Framework: the whole approach. It defines what you measure (dimensions), what you ask (criteria), and how you score and act on the results.
- Checklist: the list of yes/no or evidence questions inside a framework. Useful for a quick self-check.
- Model: the maturity scale, such as stages from early to advanced, that tells you what a score means.
The National AI Centre frames readiness in practical terms. It describes checking whether people can use and oversee AI, whether workers have been consulted, whether use is transparent, whether training needs are understood, whether impacts and risks can be raised, and whether external skills are available. It also says readiness needs clear oversight, accountability and knowledge of obligations, with scrutiny proportional to the proposed use.
Notice what is missing from that definition: GPU budgets and data lakes. For most small and mid-sized businesses, readiness is about people, process and control long before it is about infrastructure.
The dimensions a framework should assess
Frameworks differ in labels but overlap heavily. One Australian readiness model assesses four core domains, Strategy, Organisation, Data and Technology, using criteria, lifecycle-stage assessment and a spider diagram to show preparedness and prioritize uplift. Other frameworks split the same ground into five, six or seven pillars. The count matters less than coverage.
Here is a practical set for a business in Australia or New Zealand.
Strategy and business priority
The Australian Government’s proof-of-concept-to-scale checklist tests strategic alignment: a link to a business priority, measurable success criteria, expected costs and benefits, required approvals and reuse opportunities. In plain terms: what problem is AI solving, how will you know it worked, and who signed off?
Workflows and people
The National AI Centre recommends reviewing end-to-end workflows, because AI often changes how work is done. Its questions ask whether workflows can adapt, whether workers were consulted, whether roles may change and whether teams are willing to adjust their processes.
The Government checklist adds design questions: fit-for-purpose AI selection, user needs, early stakeholder engagement, a named business owner, workforce implications, a decision register and a lessons-learned log.
Governance and accountability
The Australian Institute of Company Directors’ 2026 checklist recommends that boards understand current AI use, including AI features inside third-party products, assess investment needs and strategic value, and discuss risk appetite. It also recommends senior accountability, proportionate approval processes, board-update arrangements, targeted metrics, and a practical AI policy that restricts unapproved tools from receiving sensitive organizational data.
You do not need a board to use this. For a 40-person firm, the owner or general manager is the board.
Data
The Governance Institute of Australia lists data-quality and provenance controls among its recommendations, alongside an accountable AI owner, an AI strategy, training, ongoing risk assessment, model testing before deployment, monitoring for behavioral change and meaningful human intervention. For a small business, the data question is usually simpler: what information are staff pasting into which tools?
Technology and tool usage
This dimension asks which AI tools are actually in use, approved or not, standalone or built into software you already pay for. It is the dimension most often assumed rather than measured. We return to it below.
Governance, privacy and security in an Australian assessment
If you operate in Australia, a readiness framework that skips privacy and security is incomplete. The Department of Employment and Workplace Relations’ Third-Party AI Assessment Framework indicates what to include: privacy and data-protection obligations, secure handling and managed access, accountable roles, impact assessment, fairness, transparency, contestability, human oversight and ongoing monitoring, scaled to risk, lifecycle stage and deployment context. It points to the Privacy Act, OAIC de-identification guidance, the Protective Security Policy Framework, the Information Security Manual, ISO/IEC 27001:2022, secure-by-design practices and zero-trust principles, all applied proportionately.
The Government checklist reduces this to three governance questions: are ethical, privacy and security issues addressed, does an oversight framework exist, and has an appropriate impact assessment been completed?
The Government’s impact-assessment material goes further. It asks organizations to record input data, security and monitoring measures, transparency arrangements, stakeholder consultation, logging, explainability, human oversight and how AI outputs affect human decisions. It treats privacy risk as changed handling of personal information, and security risk as including sensitive data, third-party access, external storage or transfer, access records and incident response.
CSIRO organizes responsible-AI assessment around use-case analysis, governance indicators and detailed questions linked to Australia’s eight AI Ethics Principles. It lists them as human, social and environmental wellbeing, human-centred values, fairness, transparency and explainability, privacy and security, contestability, accountability, and reliability and safety.
For deeper dives on the practical side, we have written on AI data governance, an AI security checklist and AI risk mitigation for Australian businesses.
A framework you can apply: dimensions, questions and evidence
The table below turns the sources above into a working structure. Score each row on its own.
| Dimension | Question to answer | Evidence that proves it |
|---|---|---|
| Strategy | Is each AI use tied to a business priority with a success measure? | A written use case with a metric and an owner |
| Workflows | Do we know how work flows end to end, and what AI changes? | Documented process maps, consulted staff |
| People | Are staff trained, consulted and able to raise concerns? | Training records, a channel for raising issues |
| Governance | Is someone accountable, and is there an AI policy? | Named owner, approved policy, approval process |
| Data | Do we know what data goes into which tools? | A register of tools and data types |
| Security and privacy | Are access, storage and incident response covered? | Access controls, an incident plan, impact assessments |
| Tool visibility | Do we know every AI tool in use, including built-in features? | Staff survey results compared with the approved list |
The National AI Centre also publishes planning tools and templates for checking AI readiness, documenting AI tasks and processes, and setting AI-use rules and governance. They are a sensible starting point for the paperwork.
How AI readiness scores are determined and read
Scoring rules vary. One widely cited example is the TDWI AI readiness guide, which scores five dimensions separately at up to 20 points each, for a maximum of 100. It reports that most scores fall between 40 and 70, identifies 50 as a watershed benchmark, and stresses that dimension scores can differ from each other.
Its stages per dimension run: 5 or less is Pre-embarkation, 6 to 10 Strategizing, 11 to 14 Standardizing, 15 to 18 Succeeding, and 19 to 20 Transforming.
Three habits make any scoring system more useful:
- Read each dimension on its own. A 70 made of 19 for strategy and 5 for governance is a risk, not a pass.
- Score on evidence, not intention. “We have a policy” earns points only when staff know it exists.
- Compare against yourself over time. An external benchmark is a rough guide. Your own movement from one quarter to the next tells you more.
Why staff answers belong in the framework
Most frameworks are completed by one or two senior people. That produces a tidy score and a blind spot: leaders rate what they believe is happening, not what is happening. The AICD checklist asks boards to understand current AI use, including AI features in third-party products. That is hard to do from the top alone.
This is the gap our assessment is built to close. We survey every staff member anonymously about the AI tools they use, their workflows and how tools connect to other systems, then combine the responses into one scored report. Because answers are anonymous, people tend to describe real behavior rather than the approved version. Nothing is installed, and no individual data is collected. Our AI security assessment guide explains how that surfaces shadow AI, and AI security awareness covers what staff need to know once you have the picture.
Turning gaps into a 90-day plan
A score is only useful if it changes what you do next. The Government checklist supports planning with a business priority, measurable success criteria, expected costs and benefits, approvals, steps for development, validation, integration and testing, and funding for a production pathway. The Frontiersi model uses readiness profiles to baseline capabilities, highlight uplift priorities and inform governance design.
Here is a simple way to shape ninety days from your results.
- Days 1 to 15: fix visibility. List every AI tool in use and what data touches it. Name an accountable owner.
- Days 16 to 45: set the rules. Approve a short AI policy that says which tools are allowed and what sensitive data must never go into unapproved ones.
- Days 46 to 75: close the highest-risk gaps. Start with the lowest-scoring dimension, usually security, governance or training.
- Days 76 to 90: train and measure. Brief staff on the new rules, set two or three metrics for use and risk, and book the next review.
Keep the list short. Three actions finished beat fifteen started.
Moving from pilot to scale
Many organizations have a handful of pilots and no route beyond them. For scale decisions, the Government checklist asks whether success criteria were met, tangible benefits were demonstrated, users support the solution, a production pathway and funding exist, testing and regression testing are planned, the design is scalable and resilient, and workforce impacts and breach-response arrangements remain covered.
AI also turns up in places leaders do not think of as AI. Video analytics security is one example, where camera systems gain analytical features that need an owner, clear data rules and a place in your tool register just like a chatbot does.
Our perspective
Most readiness frameworks we see ask the right questions of the wrong people. They are answered by a few leaders in a workshop, and the result describes the organization as management hopes it works.
We built our assessment around a different idea: the people doing the work are the best source of truth about AI use. When every staff member answers anonymously, you get a map of tools and workflows that no interview round could produce. We pair that with a scored report and a 90-day plan, because visibility without next steps just creates worry.
We keep the method deliberately light. No software to install, no individual data collected, and no compliance or legal claims. The aim is honest answers and a clear picture, so management can decide what to do first.
Anthony
What the Calibre Forum assessment gives you
If you want the staff-informed picture without designing a framework yourself, our assessment does the survey, scoring and planning. The one-off report costs A$1,990 and includes the combined scored report and the 90-day action plan. If you want to track progress, the annual membership at A$2,388 per year covers recurring quarterly assessments and reports. See what is in the report, how it works from setup to report, or go straight to the report pricing.
We also publish sector versions for managed service providers, medical clinics, recruitment agencies, aged care and NDIS providers and manufacturers.
Reassessing over time
Readiness is not a one-time certificate. The Government checklist calls for continuous monitoring and performance tracking, feedback loops for improvement, and feedback to refine a solution before scaling. The Governance Institute of Australia likewise recommends ongoing risk assessment and monitoring for behavioral change.
In practice, reassess on a fixed rhythm. Quarterly works well for small and mid-sized businesses because tools and habits change quickly. Each time, compare the same dimensions against the last result, check whether the 90-day actions landed, and add new tools that staff have started using. Our membership is built around exactly this quarterly cycle.
FAQ
What is the difference between an AI readiness framework and a checklist?
A framework is the full approach: dimensions, criteria, scoring and actions. A checklist is the list of questions inside it. A checklist is good for a quick self-check, but a framework tells you what the answers mean and what to do next.
How many dimensions should an AI readiness framework have?
There is no standard number. Australian sources use anywhere from four domains to a longer list covering strategy, workflows, people, governance, data and security. Choose a set that covers all of those areas and that you can score separately.
Does a small business need a formal framework?
Yes, in a lighter form. The questions are the same: who owns AI, which tools are used, what data goes into them and what rules apply. A short scored assessment with a written plan is enough for most small and mid-sized businesses.
How often should we reassess AI readiness?
Quarterly is a practical rhythm for most smaller organizations, because staff adopt new tools quickly. Keep the dimensions identical each time so you can see real movement rather than changes in how you asked the questions.
Sources
- Get ready for AI, National AI Centre
- Planning tools and templates, National AI Centre
- Guidance for AI proof of concept to scale: Appendix 1
- Governance in the Age of AI: Readiness and Responsible AI, Frontiersi
- A Director’s Guide to AI Governance: Checklist, AICD
- AI Governance white paper, Governance Institute of Australia
- Third-Party AI Assessment Framework, DEWR
- Artificial intelligence impact assessment tool
- The intersection of Responsible AI and ESG, CSIRO
- TDWI AI Readiness Assessment Guide
- Video analytics security
Recommended
- AI Readiness Assessment for Managed Service Providers
- AI Readiness Assessment for RTOs and Training Providers
- AI Readiness Assessment for Engineering Consultancies
- AI Readiness Assessment for Medical Clinics
General information only. Articles on this blog are written with the help of AI writing tools and published by Calibre Forum. They are not legal, insurance, tax or financial advice, so check anything important with a qualified adviser.