AI Strategy Consulting and AI Readiness Assessment: From Mandate to a Running Workflow

An AI readiness assessment inspects four areas: the data a workflow would read, the systems of record it would feed, the people who would own it, and the policy that governs it. The output is a written report with a ranked list of candidate workflows and a plain statement of what has to change before the first build.

Data means the sources. For a monitoring desk that is regulatory feeds, agency and government dockets, and the published industry notices someone on your team reads by hand today. For a proposal team it is procurement and RFP portals and the shared inbox. For marketing it is the review feeds and the CRM. We record which sources are public, which are approved, and which carry confidential material that must stay inside the firewall. Systems means the record of truth: HubSpot or Salesforce, the ERP, the scheduling or ticketing portal, Microsoft 365 or Google Workspace. Every candidate workflow is mapped to the system it feeds, because an agent that cannot write to the ledger is not yet a workflow.

People means the desk. We interview the coordinator, analyst, or manager who watches the sources and produces the first drafts, and we time where the hours go. We also look for the internal champion with a personal automation account, because that person is usually the first owner. Policy means what exists now: platform accounts, data classification, any AI use guidance, and the audit expectations of your regulator or customers. The common pattern is strong systems, a capable desk, no sanctioned platform, and no policy. The report says so plainly, ranks the candidate workflows, and states what has to change in each area before the first build starts.

We rank workflows by one rule: the work has language or pattern shape, and it has a natural point where a human already checks it. Reading a notice, triaging an inbox, and drafting a first pass qualify. Pricing a deal or approving a filing does not. The rule produces three workflows to build first, not thirty.

Language shape means the input is text a model can read: a public filing, an RFP, a customer email, a review, a transcript. Pattern shape means the input repeats in a form a model can recognize: an order confirmation, an invoice, a queue update. A natural human check means someone already reviews this work before it moves downstream, so the stop point exists and the agent inherits it. Work that fails either test stays with people. A portfolio that skips this rule produces a long list of agents that never ship, because the first one picked needs a developer, a new data source, or a decision nobody is willing to hand over.

The three we mark first follow a shape that works across industries. One monitoring brief: an agent that watches a source and delivers a ranked summary each morning, with the items that matter flagged for a person. One first-pass document workflow: an RFP, a regulatory filing, or an inbound proposal read and summarized against your checklist before anyone opens it. One repeatable operational task: the inbox triage, the review reply draft, the order confirmation logged to the system of record. The friction audit comes before any of this, and before anything is bought. We time the manual work, count the sources, and rank by hours and risk, then decide what to buy.

AI governance consulting turns the three rules into a policy security can enforce: sanction the platform, keep confidential data inside the firewall, and every agent stops for a person. The written AI policy for companies in regulated industries adds approved sources, data classification, a written check and a named owner per workflow, and audit logs.

Sources come first because they are the easiest place to leak. The policy names which sources are public (government registers, agency dockets, and published industry notices), which are approved internal sources (the CRM, the shared inbox, the document library), and which are confidential and stay inside the firewall entirely (contract terms, customer records, pricing, and anything under a nondisclosure agreement). Data classification then follows each workflow: what it reads, what it writes, and where the model runs. A workflow that reads only public notices and writes a ranked summary to an inbox sits in a different class from one that reads customer records, and the policy says which platform and which model each class is permitted to use.

The written check and the named owner are the clauses a regulator reads. For every workflow the policy states, in a literal checklist, what the person confirms before an output moves downstream, and it names the person. In our own regulatory watch agent the check is four lines and the review email ends with the words the agent stops here, followed by a request to reply RELEASE or HOLD. The audit log records every run, every decision, and who made it, in a store the owner and the auditor can both read. Governance written this way is not a brake on the program. It is the reason security signs and the reason the first workflow launches already compliant.

Sanctioning the platform means choosing one or two platforms your IT and security teams stand behind, starting with the ones you already run, opening the enterprise account, and granting the desk permission to build. Microsoft Copilot Studio, Make.com, n8n, and Zapier cover nearly every first workflow. Google Cloud Run enters only when a step outgrows them.

The choice follows the tenant and the workflow map from the assessment. Copilot Studio fits an organization that lives in Microsoft 365 and wants agents inside Teams and SharePoint under the identity and data controls it already administers. Make.com and n8n fit workflows that cross many systems, with visual scenarios the owner can read and a module for Claude, OpenAI, or Google Gemini as the one thinking step. n8n can be self-hosted when data residency requires it. Zapier fits simple handoffs where the team already knows it. We recommend one or two, never five, because the platform sprawl of a personal account per champion is the shadow IT the policy exists to end.

Code belongs at the edge, not the start. The first workflow belongs on a low-code or no-code platform the owner can read, and if it needs a developer to start, it is the wrong first workflow. When a step outgrows that platform, a scoring model with many fields, a document parser, a transcript pipeline, our practice builds that step as a small Google Cloud Run service the scenario calls, and the client owns the repository. Our own intake pipeline runs this way: Make.com scenarios post each call and form to a Cloud Run service where Claude scores ICP tier, urgency, and a follow-up recommendation, and HubSpot receives the result. The visual workflow stays readable by the owner. The code stays small, documented, and inside your account.

The AI roadmap is five moves in order: learn the fundamentals free first, audit the friction, pick three workflows, write the check before you deploy, and name one owner per workflow. Then build. The fractional chief AI officer retainer carries the plan past the first workflow with quarterly reviews, portfolio refreshes, governance updates, and build capacity.

Move one costs nothing. Before any platform is bought, the desk completes the free fundamentals: Anthropic Academy AI Fluency, Google Prompting Essentials, Oracle Agentic AI Foundations 2026, Harvard CS50 AI, and MIT 6.S191. The education is free and the first workflow the desk builds itself is low-code or no-code, so there is no budget excuse left. Move two is the friction audit from the assessment. Move three picks the three workflows by the selection rule. Move four writes the check before deployment, as a literal checklist, because the same facts and the same model produced three different answers under three prompts in our own monitoring build, and the triage was wrong until the deciding test came first. Move five names one owner per workflow.

Then build. The first workflow goes live on the sanctioned platform with a runbook, a test log, and a trained owner. That artifact is the point of the roadmap, and it separates a plan that ends in something running from a mandate that ends in a deck. Past the handoff, the fractional chief AI officer retainer keeps the program moving without a full-time hire. Each quarter our practice reviews what ran, what stalled, and what the audit logs show; refreshes the ranked portfolio with the desk; updates governance as platforms, models, and regulations move; and brings build capacity for the next workflows on the list. Leadership gets an AI strategy consultant who reports quarterly. Fractional marketing leadership, a fractional CMO, is offered on the same retainer model at /services/fractional-cmo.