AI Readiness Assessment
Before you plug AI in, find out what it can see.
A fixed-fee review of your Microsoft 365, with written findings on what AI can access and what to fix.
Cyber Essentials Plus certified · Microsoft partner since 2009
Britain’s Top 50 Best Managed IT Companies · Trusted by well-run organisations across London
Know what AI can reach
Your staff are already using AI. The question is what it can reach.
Most firms we speak to are somewhere between quietly curious and already committed. A few Copilot licences. Someone in finance using ChatGPT on their own account. A partner who has started drafting in Claude. None of that is unreasonable. The problem is what sits underneath it.
Microsoft 365 permissions in a firm of twenty to a hundred people are almost never as tight as people assume. Folders shared once for a project and never unshared. A SharePoint site inherited from a structure nobody remembers designing. Files sitting in personal OneDrives that should have been in a team library three years ago. Sharing links sent externally that still work.
None of this causes a problem while people navigate by clicking. Nobody browses to a folder they were not looking for. AI does not navigate. It asks and it retrieves. Point a capable assistant at your tenant and it will surface anything a user is technically permitted to see, whether or not that permission was ever intended. Salary files. Board papers. Client matters. Deal terms. AI does not create the exposure. It finds the exposure you already have, and puts it in front of people.
Can you answer these today?
- Which AI tools are our staff actually using, including personal accounts?
- What information can those tools reach?
- Is anything confidential sitting where it shouldn't be?
- Has anyone built an AI agent, and what can it access?
- If something went wrong, could we investigate it?
Your actual environment
One assessment. One question answered.
The AI Readiness Assessment is a senior-led review of your Microsoft 365 environment built around a single question: if AI is connected to your business today, will it only find, surface, and use the information each person is entitled to access?
We are not anti-AI. The opposite. The firms that get the most from AI will not be the ones that deploy it first. They will be the ones with the information, security, and governance foundations to deploy it confidently. This assessment tells you where those foundations stand. It is not a questionnaire or a scorecard; it is our people looking at your actual environment.
Eight areas of AI readiness
What we review
AI use and plans
The tools in play now, including personal accounts, and what you want AI to do, for which teams, on which information.
Approved tools and shadow AI
Whether you have an approved list, and whether reality matches it.
Identity and permissions
Who can access what, whether access still reflects job roles, admin access, MFA, and conditional access. AI inherits every permissions mistake you have.
SharePoint and OneDrive
Where your information actually lives, personal OneDrives, external sharing, legacy access, and whether your structure can support controlled AI use.
Purview and data loss prevention
Whether your confidential, client, financial, and HR information is identified and protected: sensitivity labels, DLP policies, retention, and audit, and how developed each is.
Copilot configuration
Where Copilot is in use or planned: tenant settings, data implications, and the governance around it.
AI policy and governance
Whether you have a written AI policy, an approved-tool list, rules on client data, and human review of AI output.
AI agents
Whether agents already exist, who built them, what they can reach, and whether their creation is controlled.
A report you can act on
What you receive
A written report the leadership team can act on without translation. Shown on the page as a checklist card under "What you receive".
Your findings are presented and explained, so you know what is safe to proceed with, what needs restricting, and what needs fixing first.
- An executive readiness summary in plain English, with one of three outcomes: ready to proceed, ready with restrictions, or remediation required first.
- A readiness score for each area reviewed (good, average, or poor) covering permissions, SharePoint and OneDrive structure, Purview and labelling, data loss prevention, conditional access, Copilot settings, policy, and agents.
- Documented findings that separate configuration issues from policy, people, and process issues.
- A permission inheritance test: what AI can actually surface for sample users today, shown rather than described.
- A sanctioned-tool position: which AI tools your staff can use, which need further assessment, and which should stop now.
- A shadow AI picture: the AI already in use across the business, including personal accounts and connected apps.
- An agent inventory: any agents already built, who built them, and what they can reach.
- Prioritised recommendations: immediate risk reduction, what must happen before deployment, and medium-term improvements, in that order.
- A remediation roadmap, scoped so you can decide what to do, when, and with whom.
- A findings presentation, walked through with you, not just emailed.
Clear scope and costs
Fixed fee. Written findings. No obligation.
£950 fixed
For a standard Microsoft 365 environment.
Larger or more complex environments, or those with Microsoft Purview already in place, are typically £1,000 to £2,000. The size of your estate and how much Purview is already in place determine the scope. We confirm the fixed fee on a short discovery call before any work starts.
- Fixed scope, fixed fee
- Written findings and recommendations report
- Findings presented and explained, not just emailed over
- Remediation and implementation priced separately, only if you want it
There is no obligation to do the follow-on work with us. The report is yours either way.
Built for businesses like yours
Who this is for
Forward-looking, professional, ambitious, well-run organisations in and around London, from twenty to a hundred staff, that handle confidential information and want to use AI without finding out the hard way. For regulated firms, the report gives documented evidence of your AI governance position, the kind of answer due diligence questionnaires and insurers are starting to ask for.
Three clear steps
How it works
Discovery call
A short call to confirm your intended AI use, current tools, and Microsoft 365 scope. We confirm the fixed fee. No obligation.
Assessment
We review your environment, read-only, and talk to the people who matter about how AI is actually being used.
Findings and report
You receive the written report and we present it: what is safe to proceed with, what needs restricting, and what needs fixing first.
A client example: For a group of companies, an assessment provided the starting point for automating their shared accounts inbox with Copilot agents.
Your next step
Find out what AI can see in your business.
£950 fixed for a standard Microsoft 365 environment. A written answer to whether you are ready, and a plan if you are not.
Or call 020 3551 6262.
Your questions answered
Frequently asked questions
A review of whether your business can use AI safely: whether your permissions, information structure, and security mean AI tools will only see what each person should. Ours looks at the Microsoft 365 environment itself rather than asking you to fill in a questionnaire.
A maturity assessment scores your strategy and culture. This is a technical and governance review of your actual tenant, with a readiness score for each area and a list of what to fix. It is the foundation the strategy work sits on.
No. The assessment is read-only. We review configuration and information structure and we do not change anything on the day.
No. It makes the assessment more useful. We review what Copilot can currently reach and whether that matches what you intended.
Yes. We review all the AI use we can identify, including personal and consumer accounts, and give you a sanctioned-tool position covering everything in play. Businesses on Google Workspace get a separate AI and Agent Access Review.
£950 fixed for a standard Microsoft 365 environment. Larger or more complex environments, or those with Purview already in place, are typically £1,000 to £2,000. We confirm the figure on a short discovery call before any work starts, and remediation is always priced separately.
Whether your confidential, client, financial, and HR information is identified and protected: sensitivity labels, DLP policies, retention, and audit, and how far each is developed. For most firms our size we recommend labelling only the high-value areas, such as finance and HR, with warn-rather-than-block enforcement, and the report says where you stand against that.
You get the report and the roadmap. If remediation is needed we scope and price it separately. You can do it with us, with your existing IT partner, or in-house.
The report documents your AI governance position, findings, and remediation plan, written to be suitable for FCA-regulated firms and usable in due diligence responses.
Yes. Start with the permissions, information structure, security, and policy checks in our AI readiness article. The assessment is for when you want someone to check the answers in your actual Microsoft 365 environment.
For what comes next, explore our wider AI consultancy services, or request AI, Automation, and the Well-Run Business.
A short discovery call
Talk through your assessment
Confirm your intended AI use, current tools, and Microsoft 365 scope. We will confirm the fixed fee before any work starts. No obligation.
You can also call 020 3551 6262 or email hello@ratcliff.it.