Is Your Data Ready for AI? A Data Readiness Checklist for SMEs

Data readiness for AI means your information is findable, accurate enough, consistently structured, properly permissioned and safe to use for the job you want AI to do. It does not mean perfect data. For most Australian small and medium businesses (SMEs) with 10 to 200 staff, the question isn't "is all our data clean?" but "is the data behind this one use case good enough, and is it locked down properly?"

That distinction matters, because "our data's a mess" is one of the most common reasons leadership teams put AI on hold. Sometimes that's the right call. Often it's an excuse to wait for a data project that never starts.

This article is a practical checklist for testing data readiness one use case at a time. It sits alongside our complete guide to AI readiness assessments, which covers the wider picture of goals, people, tools and governance.

What "AI-ready data" actually means for an SME

AI-ready data is data that is good enough for a specific task, with the right people able to see it and the wrong people unable to. Readiness is judged per use case, not across the whole business.

A tool that drafts proposals from your past winning bids needs a tidy folder of good proposals. It doesn't care whether your CRM has duplicate contacts. A tool that forecasts job margins, on the other hand, lives or dies on consistent job codes and accurate timesheets.

So before anyone says "our data isn't ready", ask: ready for what?

The five tests of data readiness

Run every shortlisted AI use case through five simple tests. If it passes all five, the data is probably ready enough to start a pilot.

Findable

AI can only work with information it can reach. If your quoting history lives across three people's desktops, a shared drive and a retired server, the first job is gathering it in one place, not buying a tool.

Accurate

Ask the people who use the data every day whether they trust it. If the finance team re-checks every figure from the job system before invoicing, an AI built on that data will inherit the same problems, only faster.

Consistent

AI struggles when the same thing is recorded ten different ways. Inconsistent job types, free-text fields used for everything and naming conventions that changed three times are common culprits in established businesses.

Permissioned

This is the test most SMEs skip, and the one that bites hardest. AI assistants built into your workplace software typically see whatever the person using them can see. Microsoft states that Copilot "only surfaces organizational data to which individual users have at least view permissions", and Google says Gemini in Workspace "only retrieves relevant content in Workspace that the user has access to".

That's good design, but it exposes old permission mistakes. If a salary spreadsheet or a disciplinary file was shared with the whole company years ago, an AI assistant can make it far easier to find.

Lawful to use

If the data includes personal information, privacy law may limit how you can use it. This is covered in more detail below.

Check your Microsoft 365 or Google Workspace sharing first

Before switching on AI features across your business, review how files are shared. It's usually the quickest, highest-value data readiness task an SME can do.

Microsoft's own training material lists "Anyone" (the most permissive level) as SharePoint's default external sharing setting, and Microsoft's blueprint for preventing oversharing recommends finding and restricting high-risk sites and files before or alongside a Copilot rollout. Google publishes similar information in its generative AI privacy hub for Workspace.

A practical first pass for a business of 40 to 150 staff:

1. List the folders and sites holding sensitive information: HR, payroll, board papers, client files and pricing.
2. Check who can access each one, and remove company-wide or "anyone with the link" sharing that isn't needed.
3. Ask your IT provider to review your tenant's default sharing settings.
4. Archive or delete old content nobody needs, so it doesn't turn up in AI answers.
5. Decide who owns keeping this tidy from now on.

Some of Microsoft's more advanced tools for this need additional licensing, so check with your IT provider or Microsoft partner what your current plan includes.

Privacy and personal information in your data

If the Privacy Act applies to your business, it applies to personal information you use in AI tools, not just information you collect. The Act generally applies to businesses with annual turnover above $3 million, which can include many established SMEs, plus some smaller businesses such as private sector health service providers. This is general information only, so get advice for your situation.

The OAIC's guidance on privacy and commercially available AI products states: "Privacy obligations will apply to any personal information input into an AI system." It also expects businesses to take reasonable steps to keep personal information accurate, which matters when AI is drawing on your records.

Three practical questions for each use case:

• Purpose: Was this personal information collected for a purpose that covers this use?
• Minimum necessary: Can the task be done with names and identifiers removed?
• Retention: Are we holding personal information we no longer need? Under Australian Privacy Principle 11, covered businesses generally must take reasonable steps to destroy or de-identify personal information they no longer need.

If you plan to use AI to help make decisions that significantly affect people, such as screening job applicants, note that if the Privacy Act applies to you, new privacy policy transparency rules start on 10 December 2026. Our guide to AI policy for business explains what that means.

When "good enough" data is good enough

You don't need a data warehouse to start using AI well. Plenty of valuable first use cases run on data that's already in decent shape.

Good candidates when your core systems are messy:

• Drafting proposals, tenders or reports from a curated set of past examples
• Summarising meetings, long email threads or documents
• Answering staff questions from a small, reviewed set of policies and procedures
• Turning rough notes into consistent client updates

These use a small, hand-picked set of documents you can check, rather than years of system data. They build skills and confidence while the bigger data clean-up happens in the background.

Use cases that usually need cleaner data first include forecasting, pricing, anything that writes back into your finance or job system, and anything customers see without a person checking it.

A four-week data readiness sprint

For one priority use case, a focused sprint can tell you whether the data is ready to pilot. This is a typical shape, not a fixed recipe.

1. Week 1: Map it. Write down exactly which data the use case needs, where it lives and who owns it.
2. Week 2: Test it. Pull a sample and run the five tests above with the people who use that data every day.
3. Week 3: Fix the blockers. Tighten permissions, agree naming rules, remove what isn't needed and set a rule for keeping it tidy.
4. Week 4: Decide. Go to a pilot, fix more first, or choose a different use case that's better suited to the data you have.

The decision in week 4 is the point. A clear "not yet, here's why" is a far better outcome than a pilot that quietly fails because of the data.

Frequently asked questions

Do we need to clean all our data before using AI?

No. Clean the data behind the specific use case you're starting with. Business-wide clean-ups are worthwhile but slow, and waiting for one to finish can stall AI adoption for years.

Will AI tools see files our staff shouldn't?

Workplace AI assistants such as Microsoft 365 Copilot and Gemini in Google Workspace generally work within each user's existing permissions. The risk is that those permissions are already too broad. Reviewing sharing settings before rollout reduces that risk.

Who should own data readiness in an SME?

Usually a senior operations or finance leader, working with your IT provider and the people who use the data every day. Someone needs clear accountability, or the clean-up never finishes.

How NovoPro can help

Data readiness is one of the areas a NovoPro Opportunity Audit looks at. The aim is to find where AI and automation will make or save the most money, check whether your data and systems can support those opportunities, and give you a prioritised plan your leadership team can act on.

If you'd like a quick baseline first, the free six-minute AI Readiness Check is a self-assessment that shows where your business stands with AI today and where the biggest gaps are.

Written by Kesley Kernes, Founder and Principal Consultant of NovoPro. Kesley holds an MBA and a Lean Six Sigma Black Belt, previously established an RPA Centre of Excellence, and helps small and medium businesses across Newcastle, the Hunter and Australia use AI and automation to make and save money.