Are we ready for AI? Ten questions before you introduce it
This list is written for organisations from 10 people upwards: associations, law firms, family businesses, federations, education providers, public bodies. It measures whether the organisation is ready to start, not whether a particular product fits. It awards no score, and at the end there is no suggestion of what you should buy. Below about ten seats the administrative problem a platform solves does not yet exist; above that the answers only get longer, because more departments and an IT lead of your own have a say.
Print it out and fill it in together in one meeting. Put a name and a date next to every question. If questions stay open, that is a result too: the open question is your next step.
Size and forms of employment
How many people does the rollout affect, and in what relationship do they stand to the organisation?
How many people are meant to work with it daily, how many only occasionally?
Count heads, not positions. Seats are assigned per person, and occasional use creates the same effort for onboarding and support as daily use.
12 daily, 20 occasionally, 48 not at all.
Which of them are not permanent employees?
Volunteers, mini-jobs, working students, board members, freelancers, temporary staff. The form of employment decides who is bound by instructions, who can be committed to an internal rule and who may receive a seat at all.
5 volunteers, 2 working students, board in an honorary role.
Who decides on the rollout, and whose approval is still missing?
At this size a single person often decides. If not, write down the second body by name: board, general meeting, supervisory board, funding body. Otherwise a missing approval only surfaces after the selection.
Management decides, board resolution still pending.
If fewer than ten people would work with it daily, postpone the rollout. Writing rules, onboarding people, maintaining seats: that effort falls due with three people just as it does with thirty, and in both cases the one person responsible carries it. With thirty users it pays off; with three it is out of all proportion. There is no upper limit; from around a hundred people more departments and an IT lead of your own come into it, and questions 1 to 3 then have to be answered per department.
Shadow AI inside the organisation
What is already in use without anyone having approved it. That is the starting point every rollout begins from.
Which AI tools are already running inside the organisation without approval?
Ask the room, and do not threaten consequences. Otherwise the answer is "none" and you plan past reality. Private accounts on work devices, browser extensions and translation services belong in the list.
Two chat accounts in marketing, transcription in the office.
What data has already gone into them?
Applications, personnel files, quotes, contracts, member and donor data, health data. For the special categories under Art. 9 GDPR the event cannot be undone. Note separately what you know and what you suspect.
Application documents, probably a medical report as well.
Is there a written rule on what may be entered and what may not?
One page is enough if it names which data never belongs in such a tool, who is asked in case of doubt and what to do after a mistake. A verbal announcement is not a rule, because nobody can hand it to a new colleague.
No. There was a verbal announcement in the spring.
If question 6 is open, the internal rule comes before the selection of a tool. Otherwise the new tool only moves shadow AI somewhere else. You can write that rule yourselves, and it needs nobody from outside.
Data processing and co-determination
Two duties that fall before the first processing. Which co-determination right applies is decided by the type of employer.
Who reviews the data processing agreement, and by when?
Art. 28(9) GDPR requires it in writing and Art. 28(3) sets out what it must contain, both before the first processing. Reviewing means: sub-processors, processing locations, deletion periods, rights of instruction. Read what is contractually assured, and keep advertising claims separate from that. A specific data centre is rarely assured in such contracts, and where the assurance is missing it is missing even when the product page suggests otherwise.
Data protection officer, by the end of the month.
Which staff representation do you have, and when do you sit down with it?
The trigger is the same everywhere: a technical system suitable for capturing behaviour or performance. Suitability is enough, nobody needs the intention. In a private-sector business that means the works council under section 87(1) no. 6 of the Works Constitution Act (BetrVG), and the result is a works agreement. In a public body it is the staff council under section 80(1) no. 21 BPersVG or the state equivalent; for a Catholic employer the employee representation under section 36(1) no. 9 MAVO; for a Protestant one the representation under section 40 MVG-EKD, where the result is called a service agreement. Where there is no body at all, a written internal rule adopted and communicated by management takes its place. Involving the representation late means negotiating from the weaker position. An assessment, not legal advice.
Employee representation in place, slot in the meeting on the 14th.
If there is no name and no date next to 7 or 8, this axis is unanswered. "We will do that later" is not an answer here, because both duties apply before the first seat is handed out.
Operations and ownership
What happens after rollout day, every week, without anyone celebrating it.
Who owns it afterwards, and how much time does that person have per week?
Creating and revoking seats, answering questions, noticing misuse, onboarding newcomers. Art. 4 of the AI Act (EU) 2024/1689, applicable since 2 February 2025, obliges deployers to ensure a sufficient level of AI literacy among their users. Write down a name and a number of hours per week, or the task will be left undone.
IT coordination, two hours per week, deputy unresolved.
How will you tell in three months that it was worth it?
Name two processes that should get faster or better, and write down how long they take today. Without the figure for today, any later assessment is a matter of taste.
Draft quotes and minutes. Today: two days, three hours.
Question 9 decides how operations go. If nobody with time in the calendar can be found, the rollout will sit idle after a few weeks, however carefully you selected. A second name as deputy belongs there too.
How to read the four findings
There is no overall score. Put the four findings side by side and decide from there what comes next.
- If all four axes are answered, selecting a tool is the smaller part of the work.
- If one axis is open, close it before you ask for proposals. Otherwise you negotiate about something you cannot yet describe.
- If three or four axes are open, you are not ready yet. That is a result too. Knowing it now takes considerably less effort than noticing it after the rollout.