AI readiness starts with data

Boardroom conversations about artificial intelligence usually start with the use case: a customer service assistant, demand forecasting, automated contract review. The proof of concept works in the demo. Three months later the project is stalled because the team discovered that the customer master has four versions, nobody knows which system holds the correct price, and the order history lost two years in a migration.

This script repeats so often that it should already be in the plan. AI readiness depends on strategy, people, and technology, but the factor that stalls projects most in mid-sized companies is the state of the data.

What research says about readiness

Jöhnk, Weißert, and Wyrtki (2021) interviewed experts to identify organizational AI readiness factors. They grouped the results into five categories: strategic alignment, resources, knowledge, culture, and data. The data category includes availability, quality, accessibility, and data flow between systems.

The study's contribution is to show that readiness is not a single trait. A company can have strong executive sponsorship and a culture open to experimentation and still not be ready, because the data needed for the chosen use case does not exist in the form the model requires.

Data management is the foundation, with an established reference

The DAMA-DMBOK, published by DAMA International, is the most widely used reference for organizing data management. The second edition (2017) describes knowledge areas that include data governance, architecture, modeling, storage, security, integration, master and reference data, data quality, and metadata.

You do not need to implement every area before using AI. But some are prerequisites for any serious use case.

• Governance: who owns each data domain and who decides on definitions and access.
• Master data: a trusted version of customer, product, supplier.
• Quality: known metrics for completeness, accuracy, and timeliness of the data that will feed the model.
• Metadata: a minimal glossary stating what each field means and where it comes from.
• Security: data classification and access rules, especially for personal data.

Risk and compliance come in early

The NIST AI Risk Management Framework (AI RMF 1.0), published in 2023, organizes AI risk management into four functions: govern, map, measure, and manage. It is voluntary and sector-agnostic, which makes it a useful structure for companies without specific regulatory obligations yet. ISO/IEC 42001:2023 goes further and specifies requirements for an AI management system, in the same format as other management system standards, which eases integration with an existing ISO 9001 or ISO/IEC 27001.

On the regulatory front, the European Union adopted Regulation (EU) 2024/1689, known as the AI Act, with obligations tiered by risk level. Companies that sell to or operate in Europe need to follow its application timeline. In Brazil, bill PL 2338/2023 was approved by the Senate in December 2024 and, at the time of writing, is still under consideration in the Chamber of Deputies, where it is being discussed by a special committee and has not yet reached a floor vote. The final text may change; what is already clear is that the risk-based classification logic is likely to remain.

For readiness, the practical consequence is simple: a use case involving personal data, decisions about people, or regulated sectors needs a risk assessment before the pilot, not after.

A three-question assessment

Before approving a use case, we recommend that the company answer three questions in writing about the data involved.

Question	Readiness signal	Warning signal
Does the data exist and is it accessible?	Source identified, with owner and documented access	"It is in each branch's spreadsheets"
Is its quality known?	Completeness and accuracy metrics measured in recent months	Nobody knows the share of incomplete records
Is the use permitted?	Legal basis recorded, sensitivity classification, vendor contract reviewed	Personal data sent to an external service without analysis

If two of the three answers fall in the warning column, the AI project is really a data project. That is not bad news. Fixing the data for a specific use case often creates value before any model: reports that finally reconcile, records that stop duplicating, decisions that no longer depend on whoever built the spreadsheet.

Data readiness checklist

• Critical data domains mapped, with a named business owner.
• Minimal glossary for the fields used in priority use cases.
• Quality metrics measured periodically for those fields.
• Personal data inventory and legal basis recorded under the LGPD, Brazil's data protection law.
• Risk classification criteria for use cases, inspired by the NIST AI RMF or ISO/IEC 42001.
• Someone responsible for tracking regulatory developments in Brazil and export markets.

AI readiness is a composite measure. But if you have to choose a single starting point, start with the data the first use case will consume. That is where most projects discover, too late, what should have been assessed at the beginning.