AI readiness in companies: meaning, checklist and roadmap for SMEs in the DACH region

According to Statistik Austria, 30 percent of Austrian companies with ten or more employees already use artificial intelligence, up from nine percent in 2021. The EU average is 20 percent. In Germany, Destatis reports 26 percent, and 36 percent among companies with 50 to 249 employees. The numbers suggest momentum. Use is not yet value, though. A company can have a dozen AI tools in use and still not a single workflow that has measurably improved because of them.

That gap between experimenting and real value is what the term AI readiness describes. My thesis: in SMEs, AI readiness rarely fails because of technology or budget. It fails because the knowledge AI is supposed to work with lives in people's heads and conversations, and nowhere else. That is why the question of knowledge belongs at the start of the roadmap.

Many consultancies see it differently and start with infrastructure, tool selection or an AI strategy on slides. That is not wrong, it just comes in the wrong order. A cleanly rolled-out tool without access to the relevant knowledge produces well-phrased, generic answers. Teams try it, find nothing they did not already know, and go back to the old way of working.

What AI readiness means

AI readiness describes a company's ability to use artificial intelligence effectively, safely and lawfully, and to create lasting value from it. So it is about the conditions that let AI tools change something, and less about the tools themselves.

My yardstick: a company is AI-ready when it can select, implement, measure and scale an AI use case without starting from scratch every time.

AI readiness is not something you reach once and then have. The bar moves with every new technology and every new rule, most recently in summer 2026 with the Digital Omnibus on the EU AI Act.

Where the term comes from

Maturity models have a long tradition in management. The best known is the Capability Maturity Model, which Watts Humphrey developed for software engineering at Carnegie Mellon University's Software Engineering Institute from the mid-1980s and published as the book Managing the Software Process in 1989. Digitalisation brought models for digital readiness, in Germany for example acatech's Industrie 4.0 Maturity Index.

Since generative AI broke through at the end of 2022, AI readiness has become a term of its own. Consultancies, technology vendors and public bodies publish their own indices. Cisco's 2024 AI Readiness Index, for example, found that only 13 percent of companies surveyed worldwide are fully ready to capture AI's potential. The dimensions in these models are very similar. Where they differ is in how much weight they give to knowledge.

The six dimensions of AI readiness

From the common models I derive six dimensions and weight them for companies of 50 to 500 employees, the ones we build RECO for. Each one can become the bottleneck.

Strategy and use cases

Is there a clear answer to which business problem AI should solve? Companies without prioritised use cases spread their budget across too many pilots. A company is ready when it has a short, prioritised list of use cases and can say how the value of each will be measured.

Data and knowledge

AI is only as good as the information it can access. In 2025, Gartner predicted that through 2026, organisations will abandon 60 percent of AI projects unsupported by AI-ready data. In SMEs, the problem is rarely the volume of data. It is the question of where the knowledge actually sits. Why a client gets a special price, why a project was set up differently, which solution did not work last time: none of that is in any system. It sits in people's heads and in meetings. If you do not capture that knowledge, you give AI little to work with.

Technology and infrastructure

Can your systems be reached through interfaces? Is there a cloud strategy, and where may data be processed? For many companies in the DACH region, hosting in the EU is a basic requirement, often for customers and the works council as well.

People and skills

Since 2 February 2025, Article 4 of the EU AI Act has required companies to look after the AI literacy of their staff. The Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) rewrote the article. Providers and deployers must now take measures to support the AI literacy of their staff, but they do not have to guarantee a specific level for each individual. The obligation has become more manageable; it has not disappeared. The Austrian figures show why the topic matters: among companies that do not use AI, lack of internal expertise is the most frequently cited reason, ahead of data protection concerns and legal uncertainty.

From a change and usability perspective, I add one point that competence models often miss. Training only helps if the tool fits the workflow. A tool that forces people to leave their usual application, copy content across and paste results back will soon be left lying around, however good the training was.

Governance, law and security

AI readiness also means having rules. Which tools are allowed? Which data may be entered? Who checks the results? On top of that come the GDPR, the EU AI Act, information security and works council co-determination. In Germany, Section 87(1) no. 6 of the Works Constitution Act (BetrVG) applies to technical systems designed to monitor employees' conduct or performance; in Austria, Sections 96 and 96a of the Labour Constitution Act (ArbVG) govern consent for control systems and personnel data systems. The NIST AI Risk Management Framework and the ISO/IEC 42001 standard for AI management systems offer guidance for your own rulebook.

Culture and leadership

The best technology fails if employees see AI as a threat or quietly use private tools. An organisation is ready when its leaders use AI themselves, talk openly about its limits and make successes visible. Our article on AI change management in SMEs describes how to measure acceptance.

The four maturity levels

For a quick assessment, I work with four levels.

1. Exploratory: individual employees use AI tools on their own initiative, with no rules and no measurement.
2. Experimental: first pilots are running, often driven by IT or one committed department. The benefit is noticeable but not proven.
3. Operational: several use cases are in day-to-day operation, with an AI policy, owners and metrics.
4. Strategic: AI is part of the business strategy, data and knowledge are maintained systematically, and new use cases emerge continuously.

In my assessment, most SMEs in the DACH region are currently between levels one and two. In Austria, according to Statistik Austria, 77 percent of companies that do not use AI have not even considered it. The step from level two to three is the hardest, because that is where enthusiasm has to turn into routine.

AI readiness checklist for SMEs

Answer the following questions honestly with yes or no. Every no points to a concrete area for action.

Strategy

• Do we have a prioritised list of AI use cases with an expected benefit in euros or hours?
• Is there one person in management responsible for AI?
• Is there a budget planned for the next twelve months?

Data and knowledge

• Do we know where our business-critical knowledge sits, including what only exists in people's heads?
• Is the relevant data accessible, up to date and reasonably clean?
• Are decisions and their rationale documented?

Technology

• Can our core systems be reached through interfaces?
• Have we settled in which data centres and countries data may be processed?

People

• Have all employees who use AI received basic training, and is it documented (Article 4 EU AI Act)?
• Are there internal contacts who support colleagues?

Governance

• Is there a written AI policy with approved tools and data rules?
• Do we have an overview of which AI systems are in use and which risk class they fall into?
• Is the works council involved, where one exists?

Culture

• Do leaders use AI themselves and talk about it openly?
• Are successes and failures shared?

I deliberately give no score with traffic-light bands. There is no solid basis for such a threshold, and the questions do not carry equal weight. Read the result this way instead: every question you answer with no is a concrete gap. Many no answers in strategy and governance mean you should first settle the policy, ownership and one clearly scoped use case. Few no answers across all blocks mean you are in a position to scale.

I put one rule above the total. If there is a no in the data and knowledge block, start there, however many yes answers you have overall. A pilot built on a knowledge base that does not exist will only measure that the knowledge base is missing.

A typical pattern looks like this. Budget, owners and training are in place, and the Microsoft 365 environment is tidy. What remains open is where the critical knowledge sits and whether decisions are documented with their reasons. On the total, such a company looks advanced, and the next pilot seems the logical step. By my rule, a knowledge map and a one-page policy come first, and only then a pilot, for instance for documenting customer meetings.

Roadmap: five phases to real AI readiness

This is how I would go about it. How long each phase takes depends above all on how quickly the works council, data protection and the business units come along. So I cannot promise you a credible duration, only the order.

Phase 1: assessment

Go through the checklist with management, IT, HR and a few business units. Find out which tools are already in use, including unofficially. Draw up a knowledge map: which roles hold knowledge that is documented nowhere? Our knowledge loss calculator helps put a euro figure on that risk.

Phase 2: set guardrails

Adopt an AI policy, name owners and start basic training for all employees. Involve the works council early. To start, a one-page document is enough, recording purpose, data processed, access rights and retention periods.

Phase 3: two pilots with clear measurement

Pick two use cases with high value and manageable risk, such as conversation documentation, proposal writing or internal knowledge search. Before you start, define how you will measure success: hours saved, lead time, error rate. Our article on AI agents in mid-sized companies shows how to move pilots into production.

Phase 4: scale what works

Move successful pilots into day-to-day operation and stop the others decisively. Build an internal network of AI contacts and record what you have learned, so the next use case goes faster.

Phase 5: anchor it

Make AI part of annual planning and the budget. Review the policy and the risk classification, and repeat the checklist. For the budget round, it helps to calculate what undocumented knowledge costs when a key person leaves; our post on calculating knowledge loss shows how.

Legal framework: what SMEs need to know in 2026

The EU AI Act has been in force since 1 August 2024 and takes effect in stages. Bans on certain practices and Article 4 on AI literacy have applied since 2 February 2025, and the rules for general-purpose AI models since 2 August 2025. Since 2 August 2026, most of the remaining rules apply, including the transparency obligations under Article 50.

The Digital Omnibus changed the timeline in summer 2026. Obligations for high-risk systems under Annex III, such as AI for selecting applicants or evaluating performance, apply from 2 December 2027. For high-risk AI in regulated products under Annex I, the date is 2 August 2028. Most SMEs use AI with low risk, but they should be able to show their literacy measures, transparency and their inventory of systems. Our article on the EU AI Act for SMEs has the details. This section is orientation, not legal advice.

In Austria, the RTR's AI service desk offers free guidance on the AI Act. For funding, look at the aws programmes and at KMU.DIGITAL from the Austrian Economic Chamber.

Common mistakes on the way to AI readiness

• Starting with the tool instead of the problem. A licence for everyone is not yet a strategy.
• Running too many pilots at once. A few well-measured pilots achieve more than many half-hearted ones.
• Underestimating data and knowledge. AI can only use what has been captured, and implicit knowledge from conversations is missing from most systems.
• Postponing governance. Shadow AI appears when rules are missing.
• Forgetting the people. Without training, workflows that fit and leaders who set an example, usage stays superficial.

Where I would start

For SMEs in the DACH region, the starting position is good. Austria is well above the EU average in AI use, and with the Omnibus the legal framework is clear enough to plan. If I could recommend only one step, it would be this: sit down with your leadership team, answer the three questions on data and knowledge, and write down the roles whose loss would hurt you most. The knowledge loss calculator works out what the knowledge in those roles is worth, using your own inputs.