AI Readiness on Your Terms – Start with One Real Use Case

AI automation can improve a business workflow, but only when the organisation has the people, information, safeguards and decision processes needed to use it responsibly. This background briefing explains what AI readiness means for Australian SMBs and why governance starts with one real use case.

AI readiness is the capability to decide where, why and how AI should participate in a business - and what evidence, people and safeguards are needed before its role expands.

That definition matters because access to AI is no longer the difficult part. A business can open an account, switch on a feature or buy a product quickly. The harder questions begin when that tool becomes part of real work - What is it being asked to do? Which information may it use? Who checks the result? Who remains accountable? What evidence would justify continuing, changing or stopping?

AI automation may be the desired result for a particular workflow. AI governance is how the business keeps that use purposeful, accountable and under control. AI readiness connects the two.

Ready for what use, on whose behalf, with which information, under what controls, and with what evidence that it works?

AI adoption is not the same as AI readiness

Australian SMBs are already making decisions about AI, whether or not they have written an AI strategy.

The National AI Centre's SME AI Pulse reported that 43% of Australian SMEs had some level of AI adoption across December 2025 to February 2026. Each monthly wave surveyed at least 400 SME owners and decision-makers and weighted results by industry, state and employee size (National AI Centre, 2026).

That figure measures reported adoption. It does not show that every use creates value, protects information, has an accountable owner or is ready to scale. In the same reporting period, non-adopters identified low trust, uncertain relevance and not knowing how to begin. Among adopters, checking outputs internally was more common than explaining AI use to customers or providing a route for customers to raise concerns.

The OECD reaches a similar high-level conclusion internationally. Its 2025 discussion paper reports that SME AI adoption remains lower than adoption of other digital technologies and lower than adoption among larger firms. It identifies connectivity, data and compute, skills and finance as important enablers, while arguing that support should differ according to a firm's digital maturity, complexity of use and scope of application (OECD, 2025).

Buying access to an AI product is therefore not the same as building the organisational capability to use it well.

What research says about AI readiness in SMBs

Research on organisational readiness consistently treats AI adoption as more than a technology purchase.

Jöhnk, Weißert and Wyrtki (2021) identified readiness factors across strategic alignment, resources, knowledge, culture and data through interviews with 25 AI experts. Uren and Edwards (2023) similarly found that technology readiness alone was insufficient; people, process and data affected the longer organisational journey towards AI adoption.

SMB-focused research adds a further warning - enterprise models cannot simply be made smaller. Oldemeyer, Jede and Teuteberg's (2025) systematic review of SMEs identified 27 perceived implementation challenges, including knowledge, cost and infrastructure. The review highlights how starting conditions, including data availability, differ across company sizes.

Taken together, this work gives businesses a useful map of the factors that matter. It does not produce one universally validated readiness score. It also does not tell us enough about how Australian SMB decision-makers at different organisational scales describe readiness in their own words.

The Australian SME AI Pulse tracks adoption and reported barriers, but it is not a qualitative comparison of how firms with 20, 80 or 160 people make AI decisions. The international literature identifies organisational and environmental factors, but the sources reviewed for this briefing do not directly compare the practical readiness needs of Australian SMBs across the three size bands used in this project.

That is the modest gap this series will explore.

Our working hypothesis - readiness changes with organisational scale

Based on Adrian's experience working across the managed-services and SMB landscape, we expect AI-readiness needs to differ across three working groups

• 20-59 employees;
• 60-119 employees; and
• 120-200 employees.

These are project categories, not validated market standards.

Our working hypothesis is that smaller organisations will often rely more directly on an owner or director and use relatively informal decision processes. Middle-sized organisations may need clearer operational ownership and coordination across teams. Larger SMBs may require more formal decision rights, records, security review and cross-functional oversight because more people, systems and customers can be affected.

We also expect the desired outcome to differ. A smaller firm may be looking for a quick improvement to a defined task. A middle-sized firm may be considering workflow automation across a team. A larger SMB may be trying to coordinate several AI uses across existing systems and management structures.

These are propositions to test, not findings. Article 2 will report what three participating businesses - one from each working group - actually tell us, subject to informed consent and the limitations of three selected cases.

Start with one real use case for AI automation

"Adopt AI" is too broad to assess. A specific workflow is a more useful unit.

For example, consider this illustrative workflow, not a customer finding

Allow a service coordinator to create a first draft of a weekly internal status report from approved, non-sensitive project notes.

That proposal is narrow enough to examine. The business can ask what work is being delegated, what remains human work and whether the result is worth the new risks and review burden.

In this series, we use three related terms

• AI assistance means AI helps a person complete part of the work.
• AI augmentation means AI extends what a person or team can understand or accomplish.
• AI automation means AI performs defined parts of a workflow with reduced or structured human intervention.

The boundaries will not always be neat. A tool may automate drafting while a person remains responsible for judgement, approval and communication. The goal is not to classify every use perfectly. It is to be explicit about the role AI will play.

For one proposed use, ask

• What problem are we trying to solve?
• Who will use the system, and who may be affected?
• What information may it access?
• What output or action is permitted?
• What must remain under human judgement or approval?
• How will errors be detected?
• What evidence would show that the workflow improved?
• Who can pause or stop it?

If those questions cannot be answered, the next step is discovery rather than deployment.

AI automation is a possible operating choice. AI readiness establishes whether the business can make that choice deliberately. AI governance keeps the resulting use accountable over time.

What AI governance means for one SMB use case

AI governance can sound like enterprise bureaucracy. The underlying idea is simpler.

Mäntymäki et al. (2022) define organisational AI governance as a system of rules, practices, processes and technological tools used to align an organisation's AI use with its strategy, objectives and values, meet legal requirements and follow its ethical principles.

For an SMB, we translate that definition as

AI governance is the practical system for deciding who owns an AI use, what information and actions are allowed, how the result is checked, what gets recorded, and who can pause or stop it.

That does not necessarily require a new committee. In a 30-person business, proportionate governance might be an accountable owner, a short policy, a list of approved tools and uses, defined data boundaries, a test process and an incident route. A higher-impact workflow in a 180-person business may require input from operations, IT, security, legal or privacy specialists and senior decision-makers.

The Australian Government's Guidance for AI Adoption - Foundations is particularly useful because it is designed for organisations starting with AI, using it in low-risk ways or new to AI governance. It tells organisations to adapt the guidance to their size, use cases and risk profile (Australian Government, 2026).

Its six essential practices are

1. decide who is accountable;
2. understand impacts and plan accordingly;
3. measure and manage risks;
4. share essential information;
5. test and monitor; and
6. maintain human control.

These practices answer the operational questions beneath readiness. Who owns the use? Who may be affected? What could go wrong? What should people be told? How will it be tested? Who can intervene?

The 2023 edition of NIST's voluntary AI Risk Management Framework (AI RMF 1.0) makes a complementary point. Its Govern function is cross-cutting - governance continues through mapping the context, measuring performance and risk, and managing what happens over the system's lifecycle (NIST, 2023). NIST notes that AI RMF 1.0 is being updated. Governance is not a document completed before launch and then forgotten.

What Australian SMBs need before automation expands

Current Australian privacy and cyber-security guidance turns those broad practices into more concrete questions.

The Office of the Australian Information Commissioner advises organisations to conduct product due diligence, consider how human oversight will work and provide clear information about AI use. It recommends, as a matter of best practice, that organisations do not enter personal - and particularly sensitive - information into publicly available generative-AI tools because of the complexity of the privacy risks (OAIC, n.d.).

The Australian Signals Directorate's small-business AI guidance, produced with New Zealand's NCSC and COSBOA, asks businesses to know

• what information can be shared safely;
• what data the tool collects and where it is stored;
• who owns the data;
• whether business data may be used to train models;
• where outputs will be fact-checked;
• what training staff receive;
• whether the vendor can demonstrate an appropriate security posture; and
• how an AI-related incident will be handled.

This is the practical connection between governance and automation. The more authority, information and system access an AI use receives, the more important those decisions become.

What we will test next

Rather than publish a finished AI-readiness framework first and find supporting examples afterwards, we are beginning with the evidence and showing how the practical tool develops.

We plan to hold three consented customer case-study conversations, one in each working size group. A common interview protocol will examine intended outcomes, current AI experience, candidate workflows, decision ownership, data, capability, evaluation and stopping conditions. Participants will be able to choose whether they are recorded, quoted, named or linked and will review attributed material before publication.

This is a practitioner case-study inquiry, not an institutionally reviewed academic research study. Three selected businesses cannot represent Australian SMBs or validate a universal readiness model.

Article 2 will report the bounded observations and what they change in our working hypothesis. Article 3 will then present the revised readiness profile and practical tool, including its evidence base and limitations.

A proposed readiness profile to test

Start with the proposed use, information and controls. At every step mark the strongest inspectable evidence - absent (no known practice), informal (discussed but not recorded), documented (an owner, rule or artefact exists), demonstrated (used with inspectable evidence), or unknown (investigate before proceeding).

1. Identify purpose and value. Name the user, baseline, benefit and evidence to continue. Pause if the user, output or business decision is undefined.
2. Assign accountability and governance. Name the owner, approver, reviewer and authority to stop. Pause if there is no accountable owner.
3. Build people and capability. Prepare people to frame work, judge outputs and escalate problems. Pause if staff or customers cannot report a problem.
4. Set data, privacy and records boundaries. Specify permitted data, sources, accuracy, retention and supplier use. Pause if sensitive or confidential data may be used without appropriate review.
5. Check security and suppliers. Bound identity, access, integrations, logging, contracts and exit. Pause if autonomous actions lack access boundaries, logs or a shutdown path.
6. Define evaluation and human oversight. Set test cases, acceptance criteria, review authority and recourse. Pause if a consequential decision lacks review, recourse or an evaluation method.
7. Plan lifecycle learning. Monitor changes and set revision, rollback or retirement triggers. Pause if there is no way to monitor, revise, roll back or retire the use.

What this briefing establishes - and what it does not

What is supported AI adoption by SMBs is substantial but uneven. Readiness depends on organisational, human, data, technical and environmental factors. Australian guidance treats accountability, impacts, risk, transparency, testing and human control as foundations for responsible use.

What remains open We do not yet know whether the three working size groups describe meaningfully different readiness needs, how the final assessment should adapt to those groups or whether automation will emerge as a shared priority across the participating businesses.

The readiness profile will remain a practical synthesis. It will not be a certification, legal opinion, compliance assessment or validated research instrument.

Selected sources

1. Australian Government. (2025). Guidance for AI adoption: Foundations. National AI Centre. https://www.ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-foundations
2. Australian Signals Directorate’s Australian Cyber Security Centre, New Zealand National Cyber Security Centre, & Council of Small Business Organisations Australia. (2026, January 14). Artificial intelligence for small business. https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/artificial-intelligence-for-small-business
3. Jöhnk, J., Weißert, M., & Wyrtki, K. (2021). Ready or not, AI comes—An interview study of organizational AI readiness factors. Business & Information Systems Engineering, 63(1), 5–20. https://doi.org/10.1007/s12599-020-00676-7
4. Mäntymäki, M., Minkkinen, M., Birkstedt, T., & Viljanen, M. (2022). Defining organizational AI governance. AI and Ethics, 2, 603–609. https://doi.org/10.1007/s43681-022-00143-x
5. National AI Centre. (2026, May 7). AI adoption insights: December 2025 to February 2026. https://www.ai.gov.au/news-and-insights/blog/ai-adoption-insights-december-2025-february-2026
6. National Institute of Standards and Technology. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST AI 100-1). https://doi.org/10.6028/NIST.AI.100-1
7. OECD. (2025). AI adoption by small and medium-sized enterprises: OECD discussion paper for the G7. https://doi.org/10.1787/426399c1-en
8. Office of the Australian Information Commissioner. (n.d.). Guidance on privacy and the use of commercially available AI products. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products
9. Oldemeyer, L., Jede, A., & Teuteberg, F. (2025). Investigation of artificial intelligence in SMEs: A systematic review of the state of the art and the main implementation challenges. Management Review Quarterly, 75(2), 1185–1227. https://doi.org/10.1007/s11301-024-00405-4
10. Uren, V., & Edwards, J. S. (2023). Technology readiness and the organizational journey towards AI adoption: An empirical study. International Journal of Information Management, 68, 102588. https://doi.org/10.1016/j.ijinfomgt.2022.102588

Author and AI-assistance note

Finlay McCall and Adrian Weir co-authored this article, combining human-AI collaboration research with MSP and SMB practice.

AI tools supported drafting and production. The named human authors are responsible for the concepts, evidence checks, editorial decisions and final publication approval.

Follow the opening release

Read Article 0 - Bringing Research and Practice Together

Articles 2 and 3 will follow the consented customer conversations. The practical tool has not yet been released.

About the authors

Dr Finlay McCall

Dr Finlay McCall is an educator and researcher specialising in human-AI collaboration. His PhD at the University of Canberra examined how curricula and courses can prepare people and AI systems to work together deliberately over time. Drawing on more than twenty years of teaching, he helps people and organisations build the judgement, routines and learning capability needed to use AI well. For Milnsbridge, he translates research into practical guidance for Australian businesses. Learn more at Finlay McCall website.

Adrian Weir

Adrian Weir is the founder and Managing Director of Milnsbridge Managed IT Services. He brings more than thirty years of technology experience across Telstra, Citibank and Unilever, as well as hands-on work with hundreds of Sydney businesses. For the Milnsbridge AI-readiness series, Adrian contributes practical knowledge of how organisations assess, adopt and manage technology, grounding the discussion in day-to-day business and service experience. Learn more at Milnsbridge team profile.

Finlay contributes the human-AI collaboration and evidence perspective; Adrian contributes business and IT support experience. Both authors are responsible for the final published work.

Hero image is an AI-generated editorial illustration and does not depict the authors or research participants.