AI Readiness Assessment: A Checklist for Kitchener-Waterloo SMBs

By the LaunchLen Web Solutions Team · Kitchener, Ontario · Last updated: October 11, 2026

Most small businesses don’t need an AI strategy. They need to know which one or two problems AI could actually help with, whether their data and systems can support it, and what could go wrong. That’s what an AI readiness assessment is for.

This article gives you a checklist you can work through yourself, in plain language, across five areas. It also gives you a simple outline for an AI use policy, and a way to turn what you find into a short, realistic roadmap. You don’t need a technical background to use it. You need the people who do the work, an honest afternoon or two, and a willingness to write things down.

What an AI readiness assessment covers

An AI readiness assessment is a structured look at whether your business is in a position to use AI well, and where it would be worth starting. It isn’t a sales pitch for a particular tool, and it isn’t an IT audit of every system you own.

A useful assessment answers five questions:

1. Processes: Which tasks are worth improving, and are they a good fit for AI?
2. Data: Is the information AI would need accurate, accessible and appropriate to use?
3. Systems: Can your current tools connect to what AI would need?
4. Risk: What personal, confidential or high-stakes information is involved, and what rules apply?
5. People: Who will own, use, check and maintain AI-assisted work?

Frameworks such as the US National Institute of Standards and Technology’s AI Risk Management Framework, which organizes AI risk work into four functions (govern, map, measure and manage), are written for organizations of every size. You don’t need to adopt one formally, but they’re useful reference points if you want more depth.

The checklist

Work through each section with the people closest to the work. Mark each item yes, partly or no, and note the evidence. “Partly” is the most useful answer, because it shows you where the work is.

Processes and pain points

• [ ] We’ve listed the tasks that take the most staff time each week, and who does them.
• [ ] For each task, we know whether it’s rule-based (the same steps every time), judgment-based (it needs interpretation) or a mix.
• [ ] We can describe each task step by step, including the exceptions.
• [ ] We know what a mistake in each task would cost: a minor annoyance, an unhappy customer, a financial or legal problem.
• [ ] We’ve identified at least one task that’s repetitive, text-heavy and low-risk enough to be a sensible first experiment.
• [ ] We know how we’d measure improvement, such as time spent, turnaround, error rate or backlog, compared with how the work is done today.

Tip: if a task is purely rule-based, ordinary automation may do the job better than AI. Our guide to AI process automation vs RPA vs agentic AI explains the difference.

Data quality and access

• [ ] We know where the information for our priority tasks lives: email, shared drives, spreadsheets, a CRM, accounting software, paper.
• [ ] That information is reasonably current, consistent and complete.
• [ ] We know who owns each data source and who’s allowed to see it.
• [ ] We know which data includes personal information (about customers, employees or others) or confidential business information.
• [ ] We have, or can create, a clean set of approved content (FAQs, policies, product or service details) that an AI assistant could rely on.
• [ ] We know how long we keep data, and we delete what we no longer need.

Systems and integrations

• [ ] We have an up-to-date list of the software and services the business uses, and who manages each one.
• [ ] We know which of our key tools offer integrations or APIs (ways for other software to connect).
• [ ] We know which tools already include AI features we’re paying for, or might be using without realizing.
• [ ] Accounts use individual logins (not shared passwords), and multi-factor authentication is turned on where it’s available.
• [ ] Our website, email and core systems are kept updated and backed up.
• [ ] For any cloud or AI service we’re considering, we know where data is stored and processed. Our guide to Canadian data residency for AI and cloud covers the questions to ask.

The Canadian Centre for Cyber Security’s baseline controls for small and medium organizations are a practical reference for the security basics in this section.

Security, privacy and an AI use policy

• [ ] We know which privacy laws apply to us. For most Ontario private-sector businesses that’s PIPEDA, and health information custodians also have PHIPA obligations.
• [ ] We know which AI tools staff are already using, including free personal accounts.
• [ ] We have rules about what information must never be entered into AI tools.
• [ ] We’ve checked whether our AI tools use our inputs to train their models, and changed the settings where needed.
• [ ] Any customer-facing AI is limited to approved information and tells people they’re dealing with an AI, with an easy route to a person.
• [ ] If we use AI to screen, assess or select job applicants and have 25 or more employees, we know Ontario requires that to be disclosed in publicly advertised job postings.
• [ ] We have a written AI use policy (see the next section).

The Cyber Centre’s guidance on generative AI recommends measures like usage policies, staff training, multi-factor authentication and care with the information entered into AI tools. The Office of the Privacy Commissioner of Canada’s principles for generative AI are also worth reading if you handle personal information.

People and training

• [ ] Someone is clearly responsible for AI decisions in the business, even if it’s a part-time role.
• [ ] Each AI-assisted process has a named owner who checks the output and handles problems.
• [ ] Staff understand what AI tools are good at, where they tend to make mistakes, and that they’re accountable for work they send out.
• [ ] The people who do the work have been asked what would help them, not just told what’s coming.
• [ ] We have time set aside to learn, test and adjust, not just to install.

Writing a simple AI use policy for your team

A small business AI policy doesn’t need to be long. One or two pages that people actually read beats a twenty-page document nobody opens. The Government of Canada’s guide for federal institutions on using generative AI groups its advice under six “FASTER” principles: fair, accountable, secure, transparent, educated and relevant. It’s written for government, but it’s a helpful checklist for any organization.

A practical outline:

1. Purpose. Why the policy exists: to use AI in ways that help the business without putting customers, staff or the business at risk.
2. Approved tools. Which AI tools are approved, which account types to use (business accounts rather than personal ones) and how to request a new tool.
3. Information rules. What must never be entered: for example, customer personal information, employee records, passwords, financial details and confidential documents, unless a tool has been specifically approved for that use.
4. Human review. Which kinds of AI-assisted work need a person to check them before they go out, such as anything sent to customers, published online, or involving money, legal terms or hiring.
5. Transparency. When to tell customers or others that AI was used, including on chatbots.
6. Accountability. The person sending or publishing the work is responsible for it, whether or not AI helped.
7. Who to ask. A named person staff can go to with questions or concerns, and how to report a problem.
8. Review date. When the policy will be revisited. AI tools change quickly, so plan on at least once a year.

Have a qualified legal or privacy advisor review the policy, especially the information rules, if you handle sensitive data.

From assessment to roadmap

Once you’ve worked through the checklist, turn it into a short roadmap:

1. List the opportunities that came up, especially tasks marked as repetitive, low-risk and measurable.
2. Score each one on value (time saved, fewer errors, faster response) and effort (data clean-up, integrations, training needed). Simple high/medium/low ratings are enough.
3. Note the blockers. If many items came back “no” in data, systems or security, fixing those may be the real first project.
4. Pick one pilot. Choose something valuable but low-risk, set a measure of success, and decide in advance how long the trial will run and what “good enough” looks like.
5. Set guardrails for the pilot: what data it can use, who reviews the output and what happens if it goes wrong.
6. Review and decide. After the pilot, keep it, change it or stop it, and then pick the next item.

Write the roadmap down in plain language. A one-page plan you can explain to a partner or a lender is worth more than an impressive slide deck.

Getting a second opinion

Plenty of businesses can work through this checklist on their own. If you’d rather have an outside view, our IT consulting page explains how we approach AI readiness and technology roadmaps, and our AI solutions and cloud and hosting pages cover what implementation can look like. LaunchLen Web Solutions Inc. is a web and AI development team. Based in Kitchener, serving Waterloo Region and businesses across Ontario. For the bigger picture on getting started, see our guide to AI for small business in Ontario.

FAQ

How long does an AI readiness assessment take?

It depends on the size of the business and how many processes you look at. A small team using this checklist can usually get a useful first pass done in a few working sessions, as long as the right people are in the room. A deeper assessment covering many systems or sensitive data takes longer. Agree on the scope before you start.

Do I need an AI policy if I only use ChatGPT?

Yes, a short one. Even one general-purpose AI tool raises the key questions: what information staff can enter, which account type they use, whether inputs are used for training, and who checks the output before it goes to a customer. A one-page policy answers those questions before they become problems.

Who on my team should be involved?

The owner or manager who can make decisions, the people who actually do the tasks you’re assessing, whoever looks after your systems and accounts, and anyone responsible for privacy, HR or finance if those areas are involved. The people doing the work often know best where the time goes and what can go wrong.

Is the assessment done on-site or remotely?

That depends on who’s doing it and what you agree. A self-assessment with this checklist can happen wherever your team is. Much of the work, such as conversations, reviewing documents and walking through systems on a shared screen, can be done remotely. If you work with an outside consultant, ask how they work. At LaunchLen, the format is agreed with you at the start of an engagement.

Talk through your results

Want a second view on your results, or help working out where AI could realistically help first? Let’s talk it through.

[Book a free consultation] → https://launchlenwebsolutions.ca/contact/
Call +1 226 899 4813 or email info@launchlenwebsolutions.ca.
LaunchLen Web Solutions Inc., Kitchener, Ontario.

This article is general information, not legal advice. For privacy, employment or other legal obligations, check the official sources below or speak with a qualified professional.

Sources

• National Institute of Standards and Technology (NIST), AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework
• Treasury Board of Canada Secretariat, Guide on the use of generative artificial intelligence (FASTER principles): https://www.canada.ca/en/government/system/digital-government/digital-government-innovations/responsible-use-ai/guide-use-generative-ai.html
• Canadian Centre for Cyber Security, Generative artificial intelligence (AI), ITSAP.00.041: https://www.cyber.gc.ca/en/guidance/generative-artificial-intelligence-ai-itsap00041
• Canadian Centre for Cyber Security, Baseline cyber security controls for small and medium organizations: https://www.cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and-medium-organizations
• Office of the Privacy Commissioner of Canada, Principles for responsible, trustworthy and privacy-protective generative AI technologies: https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/
• Office of the Privacy Commissioner of Canada, PIPEDA in brief: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/
• Government of Ontario, Personal Health Information Protection Act, 2004: https://www.ontario.ca/laws/statute/04p03
• Government of Ontario, Your guide to the Employment Standards Act: Requirements related to publicly advertised job postings (AI disclosure): https://www.ontario.ca/document/your-guide-employment-standards-act-0/requirements-related-publicly-advertised-job