The question behind the framework
Most organisations can list the AI initiatives they have launched. Far fewer can say whether the foundations exist to scale them safely. That gap is where AI programmes stall: the pilot succeeds, the scale-up fails, and the cause turns out to be data, governance, skills or operating model rather than the technology itself.
VERA — Verified Enterprise Readiness for AI — is built to find that gap before it becomes expensive. It asks one question: are the foundations in place to scale AI safely, and where exactly are they thin?
This page describes the model. The VERA AI Readiness Assessment Survey is the instrument that applies it, and its own page covers how an assessment is run and what it delivers.
Readiness is not maturity
The two terms are often used interchangeably. They answer different questions, and confusing them leads to the wrong plan.
| Comparison | AI readiness | AI maturity |
|---|---|---|
| The question | Are we prepared to scale AI safely? | How extensively do we already use AI? |
| Orientation | Forward-looking | Backward-looking |
| What it tests | Data, governance, security, talent, operating model | Use cases, models, adoption rates |
| Most useful for | Planning the next 12–24 months | Benchmarking what has already happened |
Readiness is the foundation; maturity is the scale. This framework answers the readiness question.
Five failure modes it is designed to detect
Five failure modes recur across enterprise AI programmes. Each is visible early if someone measures for it.
| Failure mode | What it looks like | Where it is scored |
|---|---|---|
| Data foundations cannot scale AI | Quality, integration and governance gaps surface only after the pilots succeed | Data |
| The AI security baseline is absent | No AI threat model, no prompt-injection defences, no AI incident response | Technology, AI Governance |
| Governance lags ambition | Alignment with ISO/IEC 42001 and national frameworks exists in policy, not in daily operation | AI Governance |
| Specialist talent is too thin | MLOps, AI security, AI ethics and GenAI product roles under-staffed against the operating model | People |
| Value tracking is missing | Initiatives launched are counted; value delivered is not | Process, Strategy |
How the framework is built
The framework divides the organisation into seven dimensions. Each carries a weight reflecting how often it decides whether AI succeeds or fails at scale. The weights sum to 100%.
| Dimension | Weight | Core indicators | What it examines |
|---|---|---|---|
| Data Foundation & Management | 18% | 8 | Data quality, integration, lineage, ownership and governance, and whether data is usable for AI training and retrieval |
| Technology & AI Infrastructure | 17% | 8 | AI platforms, compute, tooling, integration with core systems, scalability, cost control and built-in AI security |
| AI Governance, Ethics & Risk | 15% | 7 | AI policy and accountability, risk management, regulatory alignment, ethics, human oversight and the AI inventory |
| People, Culture & Skills | 13% | 7 | Leadership and sponsorship, specialist talent density, AI literacy, reskilling and change capability |
| Business Processes & Operations | 13% | 7 | Operating model and decision rights, use-case lifecycle, AI embedded in processes, benefits tracking |
| Strategy & Value Realisation | 12% | 7 | AI ambition and its link to corporate strategy, portfolio discipline, funding, leadership alignment |
| Customer & Service Experience | 12% | 6 | Customer or citizen experience as an AI objective, service design, trust, transparency and equity of access |
| Total | 100% | 50 |
Data carries the most weight because, in the framework's design judgement, weak data foundations are the constraint that most often stops AI programmes scaling after a successful pilot. Because any weighting embeds judgement, every report also shows an equal-weights comparison, and material differences between the two are discussed in the findings.
How a single indicator is scored
Every indicator is scored on five levels, each with its own written descriptor. Participants choose the description that is true today, not the one that is funded for next year.
| Level | General shape |
|---|---|
| L1 | Absent or ad hoc |
| L2 | Emerging, localised |
| L3 | Defined and repeatable |
| L4 | Managed and measured |
| L5 | Optimised, institutionalised |
The exact wording differs for each indicator. Three rules guide the choice between two levels:
- Score the whole scope, not the best part of it. One excellent business unit does not lift the enterprise.
- If a practice depends on one individual, it is not yet repeatable.
- If you are genuinely between two levels, take the lower one and record why.
Level 3 means defined, documented and repeatable: the practice survives the departure of the person who started it. For most organisations in most dimensions, that is a respectable and realistic position.
Why five written levels rather than a percentage? Percentages invite negotiation. Descriptors do not: either the description is true today or it is not. The same descriptors are used in every engagement, so movement from Level 2 to Level 3 at reassessment is a defined change, not a rounding difference.
Illustrative only — how one topic, AI incident response, might read at three levels:
- L2
- A security incident process exists; AI incidents are handled ad hoc inside it.
- L3
- AI incidents are defined, owned and documented in that process, and it has been tested.
- L4
- Defined, tested and measured, with post-incident review feeding model controls — and the records exist.
The evidence rule
This is the rule that separates the framework from a self-assessment survey.
A Level 4 or Level 5 rating with no sighted artefact behind it is recorded as Level 3. Both figures are kept. The self-reported score and the evidence-capped score are reported side by side, and the gap between them is itself a finding.
| Counts as evidence | Does not count |
|---|---|
| Approved policies, standards and procedures, with an owner and a date | A plan, a business case or a draft awaiting approval |
| Audit, assurance or penetration-test reports | A slide describing an intention |
| Model cards, model registries, AI inventories | A tool that is licensed but not in use |
| Risk registers and recorded risk acceptances | A practice that happens informally or rests on one individual |
| Dashboards or KPI reports drawing on a live data source | A policy that has never been applied to an AI system |
| Committee or board minutes recording the decision | Confidence that the artefact exists somewhere |
| Signed contracts, vendor assessments, training and competency records |
The rule does three things. It removes the optimism gap: self-assessments tend to cluster at Level 4 because that is where people believe they are. It makes the score defensible: every rating above Level 3 traces to a named artefact, so the result can survive a board or regulator asking how you know. And it is not a criticism: a capped score is a statement about evidence, not competence. If the artefact is produced later, the score is revised and the change is logged.
Who scores each indicator, and how disagreement between them is resolved, belongs to the survey rather than the framework. The VERA AI Readiness Assessment Survey page sets out that protocol.
Deep-dive modules
Seven optional modules add up to 76 indicators behind the core, 126 in total if every module is used. They are added only where the core scores, the organisation's profile or its regulatory exposure show that more detail is needed. Most engagements use the core plus one to three modules.
| Module | Indicators | What it examines | Typically added when |
|---|---|---|---|
| M1 Generative AI & LLM Readiness | 12 | Foundation-model strategy, retrieval-augmented generation, agentic workflows, evaluation, hallucination controls | GenAI is deployed or planned |
| M2 MLOps & AI Engineering | 10 | Model lifecycle and registry, CI/CD for ML, monitoring, testing, serving, cost discipline | More than three production models, or an ambition to scale |
| M3 AI Security & Adversarial Robustness | 8 | AI threat modelling, prompt-injection defence, red-teaming, model supply-chain integrity | Production AI exists, or sensitive data is processed by AI |
| M4 Responsible AI & Regulatory Compliance | 10 | EU AI Act, NIST AI RMF, GCC AI ethics frameworks, fairness, human oversight, transparency | A regulated sector, ISO/IEC 42001 readiness, or EU AI Act exposure |
| M5 AI Procurement & Vendor Management | 8 | Third-party AI risk, vendor assurance, data use, IP and confidentiality in AI contracts | AI is sourced from vendors, which applies to most enterprises |
| M6 Sector Overlay | 8 | Sector-specific indicators, for example government and public sector | Sector rules drive the requirements |
| M7 ISO/IEC 42001 Readiness | 20 | AIMS scope, Annex A controls, documented information, internal audit, management review | Certification is the objective |
Module scores are reported alongside the core result. They do not change the overall readiness score by default.
From scores to a readiness stage
Indicator scores average into a score for each dimension. The seven dimension scores are multiplied by their weights and added together, giving one figure between 1.0 and 5.0. That figure places the organisation on the readiness journey.
| Overall score | Stage | What it means |
|---|---|---|
| 1.0 – 1.9 | Pre-Aware | Not yet ready to attempt AI; foundational gaps need addressing before significant investment |
| 2.0 – 2.9 | AI-Aware | Awareness exists and capability is partial; pilots risk failing if scaled prematurely |
| 3.0 – 3.9 | AI-Ready | Foundations in place; ready to scale specific use cases with managed risk |
| 4.0 – 4.4 | AI-Enabled | Operating with AI at scale; advantage materialising |
| 4.5 – 5.0 | AI-Native | AI is integral to the operating model and a differentiator |
The upper bands are deliberately narrow. Reaching and evidencing the top stages is meant to be demanding.
A stage is a band, not a badge. The dimension profile underneath it is what the roadmap is built from: two organisations can share a score of 2.8 and need entirely different plans.
How to read the score. It is not a grade. A low score on a first assessment is normal, and useful. An honest 2.4 produces a roadmap that works; an inflated 3.8 produces a plan that fails in its first year. It is a baseline: the same indicators, scored the same way at reassessment, make progress visible.
Anchored in recognised frameworks
The indicators map to ISO/IEC 42001:2023, the NIST AI Risk Management Framework and the EU AI Act. For organisations in the GCC they also map to national guidance, including the SDAIA AI Ethics Framework and Generative AI Guidelines, NCA requirements and the UAE AI Charter.
What the assessment is not
- Not an audit, and not a certification decision. ISO/IEC 42001 internal audit is separate, later work.
- Not an appraisal of individuals, teams or budgets.
- Not a count of AI use cases. That is maturity, not readiness.
- Not a score of the roadmap. It scores what is in place today.