Is Your Business AI Ready?

Businesses that fail to prepare for AI will fall behind competitors. Learn how to roll it out safely now.

Introduction

For business owners and financial directors, the question isn't whether to adopt AI, but how to do it safely, strategically, and in compliance with UK regulations right now.

According to research from McKinsey and PwC, businesses that successfully integrate AI can see productivity improvements of up to 40% within two years, whilst those that delay risk falling behind. And no one wants that.

That said, rushing to adopting AI without proper preparation can expose your organisation to data breaches, regulatory penalties, or operational disruptions that far outweigh any potential benefits making getting ready a vitally important step in the journey.

Use this guide to prepare your business for AI safely, strategically, and with the right safeguards in place.

• What should we automate first?

• What governance do we need for AI?

• What should be included in an AI policy?

• How to update Contracts for AI

• How to prepare my data for AI?
• How to assess AI suppliers and tools?

What should we automate first?

The first step towards using AI is nothing to do with AI. It's all about looking at your business. The most productive AI projects solve operational headaches first.

Take a step back and work out where AI could actually earn its keep. That starts with finding your bottlenecks. It's not as exciting as rolling out the shiny new toy, but patience and preparation will pay dividends.

Map your core processes and pinpoint the tasks that are

• slow
• repetitive
• expensive
• that suffer from decision or action delays

Common culprits include invoice processing, customer enquiries, data entry and reporting.

Prioritise the areas with the highest frequency, biggest business impact, and clearest fit for automation.

What governance do we need for AI?

Next up is the governance piece; and it's important to get this right. It's how you'll evidence your responsible approach to AI should anything ever go wrong. Robust AI governance isn't just about ticking a compliance box either, it's about protecting your business, your staff, and your customers.

Accountability

Start by establishing ownership and responsibility. 

The ICO's framework for AI and data protection, makes clear that businesses remain fully accountable for decisions influenced or made by AI systems. That means you need documented governance structures that establish accountability, oversight, and rules.

Your governance framework should designate specific roles and responsibilities including:

• Who approves new AI tools?
• Who regularly reviews their suitability and relevance? (The technology landscape changes rapidly, and tools that were appropriate six months ago may present new risks today. The National Cyber Security Centre (NCSC) recommends quarterly reviews of AI tools)
• Who monitors their performance and impact?
• Who responds if something goes wrong?

Documentation

Documentation is critical. It provides evidence for regulatory compliance, audit purposes, and incident investigation. It also helps staff understand your AI landscape quickly and apply your rules consistently.

You should have the following documents in place, with a regular review schedule:

• An AI policy for your organisation
• Contracts that reflect the use of AI (for staff, suppliers, and customers)
• AI risk assessments
• A documented process for approving the use of AI tools
• Approved and denied AI tool lists

What should be included in an AI policy?

Your AI policy serves as your day-to-day guide for staff that translates your governance framework into something meaningful. 

1. Start with a clear statement about your position on AI and why you've adopted it. Are you embracing it to remain competitive? Are you actively avoiding it for environmental reasons?

2. Next clearly state which specific platforms and services your organisation has vetted and authorised for use. Platforms can either be specifically referenced in the policy or you can have an addendum that is simply referred to and is updated elsewhere.

3. Equally important is making clear that unapproved tools should not be used for business purposes without explicit authorisation.

4. Define precisely what types of information staff can and cannot input into AI systems. Confidential client data, financial information, personal data protected under UK GDPR, commercially sensitive information, and security credentials should be explicitly prohibited from entry into AI tools—even approved ones—unless specific data processing agreements are in place.

5. Your policy should address the appropriate use cases for AI. For example, AI might be approved for drafting initial versions of routine documents, analysing trends in anonymised data, or generating ideas for marketing campaigns, but not for making final hiring decisions, determining customer creditworthiness, or creating legally binding contracts without human review.

6. Include clear guidance on disclosure and transparency, i.e. that customers should be informed that AI is in use.

7. Finally, establish a clear process for staff to request approval for new AI tools or use cases. This keeps your AI landscape manageable whilst allowing innovation. Include reporting procedures for when things go wrong—staff need to know how to report AI errors, unexpected outputs, or potential data breaches without fear of reprisal.

How to update contracts for AI

Adopting AI isn't like adopting any other tool. It has major contractual implications and as such, your employment contracts and customer agreements will probably need to be updated to reflect its use.

Staff employment contracts

For staff employment contracts, you'll need to add clauses that govern AI usage as a condition of employment. We recommend seeking the advice of a legal and/or HR expert but as a guide we think that contract updates are likely to include:

• Acknowledgement that staff have read and will comply with your AI policy
• Restrictions on using unauthorised AI tools for business purposes
• Requirements to protect confidential information from being entered into AI systems
• Clarity around how AI-generated work is attributed and who owns the intellectual property. If a staff member uses AI to create marketing copy, designs, or code, your contract should specify that the output belongs to the company, not the individual or the AI provider. This isn't always straightforward—current UK law doesn't clearly address AI-generated IP, so your contracts need to be explicit about expectations.

Customer contracts

For customer contracts and terms of service, transparency is paramount. The ICO and The Competition and Markets Authority (the CMA) both emphasise that customers have a right to know when AI is being used, particularly in decision-making processes that affect them. Your customer contracts should disclose where AI is used in your service delivery, what decisions AI influences or makes, and what human oversight exists.

Make sure to include liability limitations and disclaimers specific to AI usage, especially around intellectual property. Whilst you can't contract out of fundamental legal responsibilities, your terms should clarify the scope and limitations of AI-generated advice, recommendations, or content. 

Customer contracts should also address data usage in the context of AI. Will customer data be processed by AI systems? Where is that processing performed? Will customer data ever be used to train AI models? According to UK GDPR requirements, you need explicit consent for certain types of AI processing, and your contracts must reflect these requirements clearly.

How to prepare my data for AI?

Data readiness is perhaps the most overlooked aspect of AI preparation, but it's fundamental to successful implementation.

Old data

AI systems fundamentally stupid. Or maybe more accurately they are ignorant. They need to be given context and understanding that you might just expect a human to have. For example, if a new member of staff asks Copilot a question about how to do something, Copilot might find a Standard Operating Procedure or a Customer Contract from 20 years ago and surface it as relevant. It won't think, "hold on, this is really old. I'll just ignore it".

This is why you need to run a comprehensive data audit. Look for the old data and clear it out. Fill in any gaps in data to ensure than AI can get a really solid understanding of your organisation and how it works.

Data locations

Next you need to identify where your business data currently resides. You likely have data in your financial system, CRM, email servers, shared drives, individual computers, cloud storage, and maybe even legacy systems. If you connect them all to an AI it will have a much richer pool of data to work with, and through API's it will be able to do more for you (with the huge cautionary tale of being careful about the power that you give an AI)

Access permissions

Now that you know what data you have, and where it is, you need to figure out who has access to it, to ensure that you don't accidentally surface information to people who shouldn't see it.

Map out who currently has access to each data repository. You'll likely discover that access permissions have accumulated over time, with former employees still having credentials, contractors with broader access than necessary, or departments accessing data they shouldn't. Although Copilot respects existing access permissions, that's worthless if they're not set correctly.

Data formats

Standardising your data formats and structures will really help AI. AI systems struggle with inconsistency—if your sales team records customer locations as 'Glasgow', 'Glasgow, Scotland', and 'G1 1AA' interchangeably, AI tools won't recognise these as referring to the same location. Establish and enforce data entry standards before implementing AI solutions.

How to assess AI suppliers and tools?

Selecting the right AI suppliers and tools requires rigorous due diligence that goes far beyond comparing features and pricing. The questions you ask potential AI suppliers can mean the difference between successful, secure implementation and a costly security breach or compliance failure. Digging into the T&Cs is imperative.

Data residency

Start with data residency and processing locations. Where will your data be stored and processed? For UK businesses, this isn't just a technical question—it's a legal one. Under UK GDPR, transferring data outside the UK requires specific safeguards. The ICO provides clear guidance that you remain responsible for protecting customer data even when it's processed by third parties, including AI suppliers.

Model training

Look to see whether your data will be used to train the platforms model. If so, could your confidential information end up informing responses given to your competitors? Many popular AI tools use customer data for model improvement by default. You need to be very sure that you can guarantee that this isn't the case for your data. Look for Opt-in or Opt-out settings availability or specific contractual terms that clearly state the usages of your data by the platform, especially if you're handling confidential business or customer information.

Security credentials

Examine the supplier's security credentials thoroughly. Do they hold Cyber Essentials or Cyber Essentials Plus certification—the UK government's baseline security standards? What about ISO 27001 certification for information security management? Have they undergone independent security audits? The National Cyber Security Centre provides guidance on evaluating supplier security claims—verify certifications independently rather than trusting supplier assertions.

Data portability

Consider vendor lock-in carefully. How easy is it to extract your data if you decide to change suppliers? Can you export your data in standard formats? What happens to your data when you terminate the contract? The CMA has highlighted concerns about AI vendor lock-in, particularly for small and medium-sized businesses with limited negotiating power already, so this is really worth thinking about.

Next Steps…

Preparing your business for AI isn't a one-time project—it's an ongoing process of assessment, implementation, and refinement. However, the first step is conducting a comprehensive AI readiness check that evaluates where your organisation currently stands across all the dimensions we've discussed.

IT Foundations specialises in helping Scottish businesses navigate AI readiness with practical, security-focused guidance tailored to organisations of your size.

Don't let your competitors gain a 40% efficiency advantage whilst you're still figuring out where to start. Get in touch with IT Foundations today to schedule your AI readiness check and begin preparing your business for the future with confidence.