Enterprise AI readiness is an assessment of how prepared an organisation is to deploy AI safely, measurably and sustainably on its own data and processes. Readiness is not about choosing a model; it is about the right use case, clean data with clear owners, access rules, the legal framework, infrastructure, an evaluation method and an operating model. This checklist is designed so that leadership, IT, data and legal teams can make decisions from the same picture.
- Use caseMeasurable business value
- Evaluation and auditAcceptance criteria, logs, human review
- Model and applicationAssistant, RAG, integration
- Access and securityRole-based permissions, protection
- Data and infrastructureInventory, classification, servers
Use-case selection and scoring
The first use case shapes how the organisation sees AI. Instead of a technically impressive but unmeasurable use case, choose one with ready data, manageable risk and a result the business unit notices. Scoring candidate use cases against the same criteria moves the discussion from opinion to evidence.
| Criterion | Question | High score means |
|---|---|---|
| Business value | Which process benefits, and who? | Clear, measurable gain |
| Data readiness | Does the data exist and is it accessible? | Clean data with an owner |
| Risk | What is the impact of a wrong answer? | Low, under human control |
| Effort | How much integration and change effort? | Limited, uses existing systems |
Data inventory and classification
AI is only as useful as the data it can reach and only as safe as the data that is protected. The inventory shows which data lives in which system, who owns it, how current it is and which confidentiality class it falls into. Document management, ERP, MES, quality, maintenance, CRM and shared folders all go into this inventory.
| Class | Example | AI use |
|---|---|---|
| Public | Published catalogue | Unrestricted |
| Internal | Procedures, instructions | Internal users |
| Confidential | Recipes, costs, contracts | Authorised roles, logged |
| Personal data | Staff, customer information | With legal approval, minimal data |
Access control and role-based answers
An enterprise assistant should answer users only from information they are already authorised to see. This does not mean building a separate permission system for AI; it means carrying the existing permission structure into answer generation. Document, folder and record-level permissions should be enforced at the search and answer stages.
- Authentication should use the corporate directory (Active Directory, LDAP or SSO).
- Search results should be filtered by the user's permissions before an answer is generated.
- When a document's permissions change, the assistant's access should update too.
- Answers should show the source document, and the user should be able to open it.
- Admin roles, model settings and log access should be managed with separate permissions.
KVKK, data residency and the on-premise or cloud decision
In Türkiye, processing personal data with AI must be assessed under Law No. 6698 on the Protection of Personal Data (KVKK). Where data is processed, whether it is transferred abroad, the purpose of processing and the duty to inform are legal questions. This guide is not legal advice; confirm your decisions with your legal team or data protection advisor.
- Data stays in-house
- Hardware investment and operation
- Can run on an isolated network
- You control model updates
- Fast start
- Scales with usage
- Data residency by contract
- Provider dependency
- Sensitive data in-house
- General tasks in the cloud
- Needs routing rules
- Two environments to manage
| Decision question | Points to on-premise | Points to cloud |
|---|---|---|
| Data sensitivity | Confidential, personal, regulated | Public, internal |
| Data residency | No transfer abroad wanted | Manageable by contract |
| Network | Isolated or restricted | Internet access acceptable |
| Team | Has infrastructure skills | No operations load wanted |
| Usage | Continuous, predictable | Variable, experimental |
The OREL AI approach from ORELSIS aims to run enterprise AI, model and data together, on the organisation's own servers. Whichever option you choose, write down the data processing map and the authorisation rules.
Infrastructure sizing questions
Infrastructure needs vary with model size, number of users, concurrent use, expected response time and document volume. Ask the right questions before quoting numbers; sizing is done with the answers to these questions and with real load tests.
- How many people will use the system, and how many will ask questions at the same time at peak?
- What response time is acceptable? How long is the user willing to wait?
- Which languages and what answer length are needed?
- How many documents and how much data will be indexed, and how often will they be updated?
- Will the model run on a single server or in a redundant setup?
- Does the GPU hardware fit the power, cooling and rack capacity of the current data centre?
- Will test, training and production environments be separate?
- Who will manage backup, monitoring and update processes?
RAG and document assistant preparation
RAG (Retrieval-Augmented Generation) is a method in which the model first finds relevant sections in the organisation's documents and then answers based on them. RAG quality is limited by document quality: outdated, conflicting or ownerless documents produce wrong answers.
- 01QuestionUser and role
- 02Permission-aware searchOnly accessible documents
- 03Relevant sectionsCurrent version
- 04Answer generationGrounded in sources
- 05Answer with sourcesWith document links
A document management system such as OREL DMS already holds version, approval and ownership information; this makes it easier for the assistant to answer only from the current version.
Evaluation set and acceptance criteria
Whether an AI system is good is shown not by impressions during a demo but by an evaluation set prepared in advance. The evaluation set consists of real user questions, correct answers and the sources of those answers.
- 01Collect real questions
Collect questions asked in daily work from business units. Add easy, hard and ambiguous questions, and questions whose answers are not in the documents.
- 02Write the correct answer and source
For each question, a subject matter expert writes the correct answer and the document it is based on.
- 03Define the criteria
Define criteria such as accuracy, faithfulness to sources, completeness, no permission violations and “I don't know” behaviour.
- 04Agree on the acceptance threshold
Decide with the business unit and the risk owner, before testing starts, at what level the pilot will be accepted.
- 05Rerun on every change
Whenever the model, settings or document set change, rerun the same set and compare the results.
For questions whose answers are not in the documents, the system saying “I could not find this information” is an important behaviour that should be measured separately in the evaluation.
Human review, audit logging and security
If an AI suggestion turns into a decision or a record, there should be human approval at that step. Which decisions require human approval should be written down based on risk. Every query, the sources used, the generated answer and the user's action should be written to an audit log.
AI-specific security risks
- Prompt injection: steering the model with instructions hidden in documents or user input.
- Data leakage: the model giving an unauthorised user an answer containing confidential information.
- Excessive agency: tools connected to the assistant being able to do more than needed.
- Fabricated answers: information without a source presented in confident language.
- Sensitive data in logs: questions and answers kept in logs without protection.
The OWASP risk list for large language model applications is a good starting point for assessing these threats. Organisations that want to set up an AI management system can review the ISO/IEC 42001 standard.
Common mistakes: enforcing permissions only in the user interface; indexing all shared folders without cleaning them; going live without an evaluation set; letting the assistant use tools with write access without human approval; keeping logs that nobody reviews; bringing in the legal team at the end of the project.
Pilot plan and roles
A pilot is a trial of the chosen use case in real work with a limited user group, a limited document or data scope and a predefined duration. The goal of the pilot is not to show that the technology works but to see whether the acceptance criteria hold in real use. Keep the scope narrow: one business unit, one document family or one process step is enough. As the scope widens, finding the cause of errors gets harder.
| Role | Responsibility |
|---|---|
| Executive sponsor | Goal, budget, prioritisation decisions |
| Business unit owner | Use case, success criteria, acceptance |
| Subject matter expert | Evaluation set, correct answers, sources |
| IT and infrastructure | Servers, identity, network, backup |
| Data and document owner | Data quality, versions, classification |
| Legal and information security | KVKK, contracts, security tests |
Hold a short weekly review during the pilot: track user feedback, evaluation set results, security findings and open items in the same list. At the end of the pilot, one of three decisions is made: roll out, run a second round with an adjusted scope, or stop the use case. The criteria for this decision should also be written down before the pilot starts; otherwise the pilot turns into an experiment with no clear end.
Change management and operating model
If users do not trust the system, even the best model goes unused. Explain to users what the system can do, what it cannot do, how to verify an answer and how to send feedback. Naming a key user in each business unit makes sure questions and feedback reach the right place.
- 01MonitoringUsage, errors, response time
- 02FeedbackUsers and key users
- 03AnalysisWith the evaluation set
- 04ImprovementDocuments, settings, model
- 05ReleaseControlled versioning
- 01
Conclusion
Enterprise AI readiness is complete when you have the right use case, classified data with clear owners, answers that respect permissions, legal confirmation, measurable acceptance criteria, human review and a continuous operating loop. Reuse these lists for every use case. With OREL AI, OREL DM and OREL DMS, ORELSIS brings the data, document and AI layers together inside your organisation.