AI readiness for SMEs: how to work out where to start

The first question almost all SMEs ask themselves about artificial intelligence is "which tool do I buy?". It's the wrong question, or rather: it's the second. The first is "where are we now?". Without that answer, every tool is a gamble — and AI projects abandoned in the first ninety days almost always start here: they began from the tool, not from the starting point.

The good news is that "where we are" isn't a feeling: it can be measured. For years analysts and vendors have built AI readiness models — an organisation's readiness to adopt AI usefully and sustainably. It's worth understanding how they work, because for an Italian SME the result is almost always counterintuitive.

Two ways of measuring AI maturity

The assessment tools split into two families, which answer two different questions.

1. Maturity models: "what stage are we at, overall"

They give a shared vocabulary and a one-line answer. The Gartner AI maturity model describes five stages: Awareness (occasional experimentation, no coordination), Active (first pilots, growing leadership interest), Operational, Systemic, up to Transformational (AI is embedded in the way the company works).

The Deloitte maturity framework uses five similar stages, but with one extra idea that for an SME is precious: it separates the score into two domains — the AI foundations (data, technology, skills) and the AI strategy (governance, risk, KPIs, culture of innovation). Splitting the score into these two axes surfaces why a company is stuck, not just a number: it often happens to have decent foundations and non-existent strategy. A single score would hide it.

2. Weighted scorecards: "where exactly the gap is"

Cisco's AI Readiness Index measures six pillars with different weights — infrastructure (25%) and data (20%) are the two heaviest, followed by strategy, governance, talent and culture — and places the company on a scale: Pacesetter (fully ready), then Chaser, Follower, down to Laggard (unprepared). The merit of a scorecard is that it doesn't just say "you're behind": it says on which lever you're behind.

For an Italian SME the constraint is strategy, not infrastructure

Here comes the figure that upends the instinct. In its 2025 index Cisco observes that 75% of Pacesetters report staff with adequate AI skills, against just 16% of all the others. What separates those who make it from those who fall behind isn't the technology estate: it's the skills and culture gap.

There's a detail to read critically, though. Cisco's weighting — infrastructure plus data make up 45% of the score — reflects an enterprise perspective, where the bottleneck is often infrastructure. For an Italian SME the reality is almost the opposite: infrastructure is rarely the constraint. The tools that are useful today are largely cloud-based, consumption-priced, accessible without a data centre. The real constraint is upstream: undefined objectives, no project owner, processes not ready. In a word, strategy and governance — not hardware.

Translated: if you adapt a model designed for large enterprises, shift the weight from infrastructure and data towards strategy, governance and culture. For an SME that's where it's won or lost.

A short tool, not an audit

You don't need a big-consultancy assessment. For an SME the right format is short — ten, fifteen questions — and combines the two families seen above:

• One stage question per domain (Deloitte style, two domains: foundations and strategy): it gives a plain-language answer — "you're at stage X of 5" — on each axis, instead of a single opaque score.
• A scorecard weighted on the dimensions (Cisco style, but reweighted for SMEs: strategy, governance and culture weigh as much as or more than infrastructure and data): it indicates which function is the real bottleneck.

The result isn't a number to frame: it's a direction. It tells you which department is best to start from and with what level of attention to compliance.

From the score to the first department

A useful assessment ends with an operational direction, not with a diagnosis. In practice:

• If a function with repetitive, high-frequency processes emerges — typically sales, marketing or operations — that's where a first pilot has the best value/risk balance.
• If instead the weak point is governance, the first step isn't a tool: it's making the risks clear. First you look at the compliance overlay — EU AI Act, GDPR, risk taxonomy — and then you choose what to automate. The order matters: automating without controls is the fastest way to have to stop later.

It's exactly the scheme we work with: first understand where you are, then graft AI in at the right point of your business, with the right controls around it. Not a tool imposed from above, but a graft that takes.

Where to really start

If you had to remember one thing: don't start from the tool, start from the position. Measure which stage you're at on the foundations and on the strategy, identify the department with the most useful gap to close, and assess the risk before choosing the technology. It's a two-minute journey for the first answer, not a two-month one.

We've turned this method into a self-serve, free assessment: answer a few questions and get an indication of which department is best to start from in your company. Take the AI-readiness assessment — then, if it makes sense, let's talk.

The data cited come from the methodologies published by Cisco, Gartner and Deloitte, are aggregated and self-reported by the respective sources, and should be read as direction, not as a promise of results. This article is for orientation and does not constitute legal advice or a compliance assessment.