The short answer
Readiness is about groundwork, not the model. Before investing, name the problem and its owner, find its data, show only the right people can see it, and plan how to check results and measure value. Score the nine areas below on evidence, not optimism.
Why groundwork matters
AI magnifies what is true: an assistant finds the outdated policy as easily as the current one and surfaces every folder shared too widely years ago.
Governance is part of readiness. Nigeria has no AI-specific law in force, but the Nigeria Data Protection Act 2023 (NDPA) applies to personal data used in AI (NDPC). The NDPC's GAID 2025 names AI: deployers must document their safeguards and include them in their annual compliance audit return, and a data privacy impact assessment is mandatory for uses such as automated decisions with significant effects (NDPC). Most hosted AI services process data outside Nigeria, so the Act's transfer rules usually apply too. Your organisation, not the system, stays accountable. Not legal advice.
The AI readiness worksheet
Tick an item only with evidence: a document, report, setting or named person.
Strategy and ownership
- Executive sponsor who can decide and remove obstacles
- Two or three written business goals for AI
- A business owner per use case, not only IT
- Budget splitting one-time build from ongoing licence and usage costs
- Budget shows which costs are priced in US dollars
Use cases
- Candidates scored on value, feasibility, data readiness, risk and cost
- First use case: frequent, contained, easy for a person to check
Data
- Location: you know where each use case's information lives
- Quality: key records current, obsolete versions archived
- Access: reachable through supported APIs, connectors or exports
- Sensitivity: personal, confidential and regulated data identified, labelled where tools allow
Systems and integration
- Core systems listed: Microsoft 365 or Google Workspace, ERP, CRM, line-of-business
- AI features built into those systems known, with a decision on each
- A test environment keeping AI trials away from live records
Identity and permissions
- Individual accounts for everyone, with multifactor authentication
- Content shared with "everyone" or all-staff groups reviewed
- Named owner for every site, team and shared drive
- Access removed promptly when people leave or change roles
Security
- Managed, patched devices for anyone using AI tools
- Logging on, and retained, for systems AI will touch
- Unapproved AI apps, browser extensions and add-ins detected or blocked
- AI apps you build tested for prompt injection and data leakage
Privacy and governance
- Policy: an AI acceptable use policy staff have read
- Register: approved AI tools and use cases, each with an owner
- Risk review: short assessment per new use case, including data protection
- Human review: rules for outputs affecting people, money or compliance
- Vendor terms on training, retention and processing location (often outside Nigeria) reviewed
- Sensitive-data deployment chosen: enterprise AI, your cloud or self-hosted open-weight models
People and skills
- Practical training on approved tools and their limits
- Champions in each team who share what works
- Someone accountable for each AI solution after launch
Measurement
- Baseline per use case: volume, time per item, error rate
- Success measures and a stop threshold agreed in advance
- A review date and an owner for the numbers
Frameworks to borrow
- Structure to grow into: the voluntary NIST AI Risk Management Framework: govern, map, measure, manage.
- Security and people: NITDA advises keeping personal, classified and confidential data out of public AI tools and using the tools your organisation has approved. Add to that: choose vendors carefully, limit what information you provide and train employees.
How to score your readiness honestly
| Score | Means |
|---|---|
| 0, not in place | Missing, or nobody can show it |
| 1, partly | Informal, some teams or systems only, or in one person's head |
| 2, in place | Documented, owned, could be shown to an auditor or board |
Score today, not the plan
A draft policy is a 1.
Ask who does the work
They often rate data quality and permissions lower than managers.
Lowest score, not average
Strong strategy does not make up for a zero on permissions.
Score per use case
Supplier invoices may be ready while shared drives are not.
| Your scores | Usually means | Next step |
|---|---|---|
| Mostly 2s, no zeros | Ready for a contained first use case | Proof of concept on your data, with accuracy and cost thresholds |
| A mix of 1s and 2s | Ready for a narrow, low-risk pilot | Pilot one use case, close gaps in parallel |
| A zero in data, permissions or governance | Not ready for AI that reads internal content | Fix that foundation first |
| Mostly 0s and 1s | Early stage | Policy, approved tools, permissions, data clean-up |
The bands are a rule of thumb, not a formal standard.
Rather talk it through? If your scores are mixed or hard to judge, we can work through the checklist with your team and tell you plainly what to fix first. Talk to a Promatics specialist
If you are not ready yet
That is normal: AI would only expose problems you already have. In order:
- Set rules nowStaff already use AI: policy, approved tools, off personal accounts.
- Fix permissionsReview content shared with everyone, name owners, remove stale access.
- Clean dataFor one use case, not the whole organisation.
- Measure the taskSo you can tell later whether AI helped.
- One use caseFrequent, easy to check and low in risk.
Guides: AI acceptable use policy, shadow AI and, if you plan Copilot, Copilot readiness. Tidier permissions and data reduce risk even without AI.
What usually goes wrong
- Scoring the plan, not the reality: the pilot then stalls waiting for data access.
- Starting with a platform: licences bought, often in dollars, before anyone agrees the problem.
- No owner after launch: accuracy, costs and permissions drift.
When to bring in help
Running this checklist yourself is fine, with a chatbot drafting questions if you like, and a small team using built-in AI under a clear policy may need nothing more yet.
Bring in a professional when AI will read internal documents or records, personal or regulated information is involved, you are choosing platforms, or a board or funder wants evidence. A checklist cannot open sharing reports or test what an assistant reveals to a junior employee.
Our AI strategy and readiness service does that: team interviews; a data, systems, identity and security review; a scored use-case shortlist; a 90-day plan with owners. We also deliver managed IT and cybersecurity, so the people who find gaps help close them.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Nigeria Data Protection Act 2023, Nigeria Data Protection Commission
- General Application and Implementation Directive (GAID) 2025, Nigeria Data Protection Commission
- AI Risk Management Framework, National Institute of Standards and Technology (NIST)
- National Information Technology Development Agency, NITDA
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.