AI Readiness Is an Access Problem
Key Takeaways
Introduction
There’s a version of the AI readiness conversation that has become almost performative. A consultant arrives, inventories your equipment, checks your bandwidth, notes the age of your network gear, and produces a report telling you whether you’re “ready for AI.”
That exercise has some use. It answers a question most organizations don’t actually have.
Here’s what we’ve learned by deploying AI across our own operations before selling it to anyone else: unless you’re running genuinely primitive infrastructure (the ten-, fifteen-year-old stuff), your infrastructure is probably serviceable. Decent networking was never the bottleneck.
What actually determines AI readiness?
What actually determines whether AI delivers value is something narrower and much more practical: can your applications and the data inside them be exposed to a large language model in a way that is both rational and secure?
For example, when we connect a CRM to an LLM, and then a sales intelligence platform on top of it, certain tasks stop existing. Moving records between the two systems used to mean exporting a spreadsheet, running index-match lookups, reconciling by hand, hours of work that was often stale by the time it was finished. Now it’s automated.
Nothing about our network changed to make that possible. What changed was that both systems had API hooks into the model, and we understood the limits of what those hooks could do.
That’s the readiness question. Does a pre-built connector exist for the systems you depend on? If it does, do you understand what that connector can actually reach and, just as importantly, what it can’t? And if no connector exists, can someone build one for you?
What if no AI connector exists for your systems?
That last part is significant. Plenty of business-critical systems have no out-of-the-box AI integration. But an API can be built programmatically against most of them, and it can be scoped deliberately. For a financial system, for instance, you don’t need or want general ledger access exposed to a model. You need a limited, purpose-built set of functions that pulls exactly the transactional data a workflow requires and nothing else.
Scoped access is the AI vision, implemented responsibly.
Where does infrastructure still matter for AI readiness?
Here’s where the infrastructure question does come back: governance.
To connect a productivity environment to AI in any meaningful way, that environment has to be set up a certain way: governance, access control, authentication, MFA. All of it has to be right. The moment you make organizational data reachable by a model, every gap in your access controls becomes a gap in your AI deployment. (For how this plays out once agents can act, see our guide to agentic AI security.)
This is also the pattern we see when organizations come to us already worried. Individual employees have started using AI tools on their own. Nobody sanctioned it, nobody scoped it, and nobody knows what data has gone where. That’s the reason to get in front of it now. How Emerging AI Creates Cybersecurity Risk covers the exposure in more detail.
There is one genuine infrastructure consideration worth naming. If your data lives on premises, network optimization matters, because moving data to and from the model becomes a bottleneck. If everything is happening across the public internet, your only lever is bandwidth. You can’t tune what you don’t control.
What should an AI readiness assessment deliver?
The assessment we think is worth paying for is a consulting engagement that identifies where AI can meaningfully improve your operations.
Readiness still belongs in that conversation. Just as a network assessment tells you whether you’re equipped for the next step and surfaces vulnerabilities along the way, an honest AI assessment often concludes that three or four things need to happen before the interesting work can start. But readiness is the floor. Nobody competes on the floor.
What we’ve found is that the meat of AI is getting an outcome. Everything else is organizations trying to attach themselves to the category without delivering one.
Why we can say this
This comes from work we’ve already done. We’ve built proprietary software for a client who needed to bulk-retrieve and organize a very large document repository, and who didn’t initially know what they wanted the end state to look like. Part of the engagement was helping them define it. We’ve helped another organization get in front of unsanctioned employee AI use and build a governed position for the company as a whole. We build reusable skills once and share them across the organization, so nobody rebuilds the same workflow twice.
Frequently Asked Questions
What does AI readiness actually mean?
AI readiness is whether your applications and the data inside them can be exposed to a large language model rationally and securely. Unless your infrastructure is 10 to 15 years old, hardware is rarely the limiting factor.
Do you need new infrastructure to be ready for AI?
Usually not. Governance, access control, authentication, and MFA matter more. The one infrastructure exception is on-premises data, where network optimization affects how fast data moves to and from the model.
What should an AI readiness assessment include?
A useful assessment identifies where AI can meaningfully improve operations and what has to be true first, often three or four changes, rather than only a hardware checklist.
The Takeaway for IT Buyers
If you’re an organization that knows you should be doing something better with AI but don’t know what, that’s the conversation to have. What’s the first outcome worth going after, and what has to be true for us to get it? Let’s talk.