A director of pharmacy at a regional health system sat down one Monday with a slide her chief operating officer had sent over the weekend. The slide had one line on it: "Where are we with AI?" She had a good answer for parts of it. Her specialty team was already using an AI-assisted prior authorization tool, and the turnaround on a prior authorization, which is the payer approval a medication needs before it will be covered, had dropped from roughly 25 minutes of staff back-and-forth to about 5. But she also knew the parts she could not answer. She did not know how many tools were in use across her sites, who had approved them, whether anyone was verifying their clinical output against the chart, or where the documentation lived if an accreditor asked to see it. She realized that the honest answer to "where are we with AI" was not a number; it was "I do not know, and that is the problem." That gap, between what is already happening in the workflow and what leadership can actually account for, is what a readiness assessment exists to close. This lesson is about how a pharmacy leader takes an honest inventory of that gap across four dimensions: the systems, the workflows, the governance, and the staff. You cannot build a roadmap, prioritize use cases, or make a business case on top of a foundation you have not measured, and the readiness assessment is how you measure it before you build anything on it.

Why Readiness Comes Before Strategy

It is tempting, when leadership asks about AI, to jump straight to the exciting part: the vendor demo, the pilot, the projected savings. That instinct is exactly backward, and the reason is worth dwelling on because it shapes everything in this level. AI in a pharmacy is not a greenfield project you start from nothing; it is almost always already happening, often invisibly, before any leader formally decided it should. A technician found a tool that drafts prior authorization justifications and started using it because it saved her an hour a day. A clinical pharmacist pasted a patient question into a general-purpose chatbot to get a plain-language explanation. A specialty coordinator is using a vendor portal whose AI features were switched on in an update no one read. None of these required a strategy meeting, and so the actual state of AI in the pharmacy is rarely the state leadership imagines. A readiness assessment is the discipline of finding out what is actually true before deciding what should be true.

This matters because every downstream decision inherits the accuracy of this one. A roadmap built on the assumption that AI use is centralized and governed will be wrong if, in reality, it is scattered and ungoverned. A business case built on projected savings will be undermined if the verification discipline it assumes does not exist. A URAC accreditation effort, the credential from the independent healthcare accreditor URAC's national Health Care AI Accreditation, will stall at the first request for evidence if the documentation was never created. The readiness assessment is not a formality you do to satisfy a template; it is the survey of the ground you are about to build on, and a building set on unmeasured ground does not stand. The strategic leader treats the assessment as the most honest hour of the whole effort, the one place where the goal is not to look good but to see clearly, because every later decision depends on the clarity earned here.

You cannot build a strategy on a guess about your own pharmacy. A readiness assessment replaces the guess with an honest inventory across systems, workflows, governance, and staff.

There is a second reason readiness comes first, and it is about credibility. A pharmacy leader who walks into a leadership meeting with a confident AI strategy but no honest assessment of the current state is building on sand, and experienced executives can smell it. The leader who instead says "here is exactly where we are, including the parts that are not governed yet, and here is how we close the gaps in sequence" earns a different kind of trust, the trust that comes from someone who has clearly looked rather than guessed. In a domain where the downside of overconfidence is a patient-safety event, the leader who shows they have measured before they recommend is the leader worth listening to. Readiness first is not just methodologically correct; it is how a strategist earns the standing to be believed.

Dimension One: Systems and Data

The first dimension to assess is the technical foundation: the systems the pharmacy runs on and the data those systems hold, because AI does not float above the pharmacy, it plugs into the dispensing system, the electronic health record (EHR) medication module, the prior authorization portal, and the data they contain. The assessment here is not about whether the pharmacy has the most modern systems; it is about understanding what the systems are, how they connect, and what AI can and cannot reach. A practical systems inventory asks: which core platforms run the pharmacy, which of them already have AI features (whether or not anyone is using them deliberately), how data moves between them, and where the protected health information (PHI), the patient data that privacy rules govern, actually lives and flows.

This inventory surfaces things leaders rarely know until they look. It is common to discover that a dispensing system or a payer portal quietly shipped AI features in a recent update, meaning the pharmacy is already an AI user whether or not it decided to be. It is common to find that data the pharmacy assumed was integrated actually lives in separate systems that do not talk to each other, which limits what any grounded AI tool can reliably do, because a tool can only ground its answers on data it can actually reach. And it is common, and important, to find that the pathways by which PHI would flow to an AI tool were never mapped, which is a privacy and security exposure hiding in plain sight. The systems-and-data dimension is, at heart, the question: what is the real technical surface that AI is operating on or could operate on, and what does that surface allow and forbid? You cannot reason about what AI can safely do in your pharmacy until you know what it can technically reach and where the patient data sits.

Dimension Two: Workflows

The second dimension moves from the systems to the work itself: the actual processes by which prior authorizations get submitted, orders get verified, patients get counseled, and operations get run. The reason workflows are their own dimension is that AI does not deliver value in the abstract; it delivers value by changing a specific step in a specific process, and you cannot assess readiness for that without understanding the processes as they really run, not as the policy manual says they run. The workflow assessment maps the high-value pharmacy processes and asks, for each, where the time actually goes, where the errors actually happen, and where a human judgment is genuinely required versus where a human is doing rote assembly that a tool could draft.

This is where the prior authorization process earns its place as the recurring example, because it is the clearest case of a workflow where the assessment reveals a large, quantifiable opportunity. Mapping the prior authorization workflow honestly shows where the roughly 25 minutes per request actually went: assembling the clinical justification from the chart, matching the request to the payer's criteria, the back-and-forth of denials and resubmissions. Seeing where the time goes is what makes it possible to see where AI could compress it to about 5 minutes, and, just as importantly, where it absolutely could not, namely the clinical assertion and the verification, which remain the pharmacist's. A workflow assessment that maps both the compressible administrative burden and the incompressible clinical judgment is doing exactly the right thing, because the whole strategy depends on collapsing the first without ever touching the second.

The workflow dimension also surfaces something a systems inventory cannot: the human reality of how work gets done under pressure. It reveals the workarounds, the steps people skip when the queue is long, the places where verification is already thin because there is no time. This matters enormously for AI readiness, because dropping an AI tool into a workflow that already cuts corners under pressure does not fix the corner-cutting; it accelerates it. A leader who assesses workflows honestly learns not just where AI could help but where the existing process is fragile enough that adding speed without adding verification discipline would make it more dangerous, not less. That insight, where speed is safe and where speed is hazardous, is one of the most valuable things the entire readiness assessment produces.

Dimension Three: Governance

The third dimension is the one most pharmacies score lowest on, and it is the one that most determines whether AI use is safe or reckless: governance. Governance is the set of deliberate decisions and structures that determine how AI is selected, approved, deployed, monitored, and corrected in the pharmacy, as opposed to AI use that simply accretes from whatever individual staff happened to adopt. The governance assessment asks a set of uncomfortable but essential questions. Who decides whether a new AI tool gets used here? Is there a policy on what AI may and may not be used for with patient data? When an AI tool produces clinical output, who is required to verify it, and is that requirement written down? If an AI-related error reached a patient, who would be accountable, and is there a process to catch and correct it? When an accreditor or board asks for evidence of governed use, what document gets handed over?

For most pharmacies early in their AI journey, the honest answers to these questions are some version of "no one decided," "there is no policy," "verification is assumed but not required in writing," and "there is no document." That is not a reason for shame; it is the normal starting point, and naming it honestly is the entire point of the assessment. The danger is not being ungoverned at the start; the danger is being ungoverned without knowing it, because that is how an organization ends up having adopted AI broadly while being unable to demonstrate that it did so safely. The governance assessment converts an invisible gap into a visible, addressable one. It is also the dimension most directly tied to the URAC user track, the accreditation pathway for organizations that deploy and use AI tools rather than build them, because that track is fundamentally an external check on whether a pharmacy's governance is real and documented. A pharmacy that scores its governance honestly and finds it thin has not failed; it has found exactly the gap the rest of the strategy will close.

The cardinal rule as a governance test

One specific governance question deserves to be called out, because it is the spine of the whole program: is the cardinal rule operationalized? The cardinal rule is that AI supports the pharmacist's judgment and never replaces it, that an AI-surfaced signal, a flagged interaction, a suggested renal dose adjustment, a drafted coverage justification, is a prompt to think and never a verdict to rubber-stamp. Almost every pharmacy will say it believes this. The governance assessment asks the harder question: is it enforced? Is there a written requirement that a competent human verifies AI clinical output before it affects a patient, and is there evidence that verification actually happens? The gap between believing the cardinal rule and operationalizing it is one of the most important things a readiness assessment can expose, because a belief that is not built into the workflow and the documentation is, to an accreditor and to a patient, indistinguishable from no rule at all.

Dimension Four: Staff and Competency

The fourth dimension is the people: the pharmacists, technicians, and coordinators who actually use the tools, and whether they are competent to use them safely. This dimension matters because AI readiness is ultimately a human capability, not a technical one. A pharmacy can have good systems, mapped workflows, and a governance policy on paper, and still be unready if the people using AI do not understand its failure modes well enough to catch them. The staff assessment asks: do the people using AI understand what it is good at and where it fabricates? Can they recognize a hallucinated coverage criterion, a wrong renal dose, or a fabricated interaction when the tool produces one with the same confident tone it uses when it is right? Is there any training, and is there any record of who has been trained and to what standard?

This dimension connects directly to the accreditation, because staff competency is one of the things the URAC user track expects a pharmacy to demonstrate, and demonstration means documentation. A pharmacy where staff are, in fact, skilled AI users but where there is no record of training, no competency documentation, no evidence of the standard they were trained to, will struggle in a review, because to an external party, undocumented competence is indistinguishable from no competence. The staff assessment therefore measures two things that are easy to conflate but genuinely separate: the actual competence of the people, and the documented evidence of that competence. A pharmacy can be strong on the first and empty on the second, and a leader who finds that gap has found a high-value, low-cost fix, namely formalizing and documenting training the staff substantially already have.

There is a cultural reading of the staff dimension that a strategic leader should not miss. The staff assessment also reveals the organization's relationship to verification, whether the pharmacists treat AI output with appropriate skepticism or with dangerous deference. A team that has quietly come to trust an AI tool because it is usually right is a team drifting toward rubber-stamping, and that drift is invisible until something is assessed. The leader who measures not just whether staff can use the tools but whether they maintain the skeptical, verify-first posture the patient-safety asymmetry demands is measuring the single most important cultural variable in pharmacy AI. Tools change; the discipline of verifying every AI-touched dose, criterion, and interaction is what keeps a patient safe regardless of which tool is in front of the pharmacist, and the staff assessment is where a leader learns whether that discipline is present or eroding.

Turning the Assessment Into a Readiness Picture

An assessment that produces four piles of findings is only half done; the strategic work is synthesizing those findings into a readiness picture leadership can act on. The most useful synthesis is honest, specific, and dimensioned: for each of the four areas, where is the pharmacy strong, where is it weak, and what is the single highest-value gap to close first? A pharmacy might find, for instance, that its systems are capable and its staff are quietly skilled, but its governance is nonexistent and its workflows for verification are thin under pressure. That is a far more actionable picture than a single vague score, because it tells the leader exactly where to point the roadmap: govern the use that is already happening, and harden the verification the workflows are skipping.

The readiness picture should resist two opposite temptations. The first is the temptation to score the pharmacy generously to look ready, which defeats the entire purpose, because an assessment that flatters is worse than no assessment, since it produces false confidence that leads to building on weak ground. The second is the temptation to score so harshly that the pharmacy seems hopelessly behind, which paralyzes rather than mobilizes. The honest middle, naming real strengths and real gaps specifically, is what turns an assessment into momentum. A leader who can say "we are genuinely ahead on adoption and staff skill, genuinely behind on governance and documentation, and here is the order in which we close the gaps" has converted an honest assessment into the opening move of a strategy, which is exactly what the next lessons build: the roadmap that sequences the gaps, the prioritization that weighs impact against risk, and the business case that funds the work.

It is worth ending on what the readiness assessment is fundamentally for, because it reframes the whole exercise away from compliance and toward leadership. The assessment is not a report you file; it is the act of replacing what you imagine about your pharmacy's AI use with what is actually true, so that every decision that follows is grounded rather than guessed. The director who started this lesson unable to answer "where are we with AI" was not failing; she was, in that moment of honest uncertainty, exactly ready to do the most valuable thing a strategist can do, which is to go and find out, dimension by dimension, before recommending anything. The pharmacies that handle AI well over the next several years will not be the ones that moved fastest; they will be the ones that knew their own ground most honestly, and the readiness assessment is how a leader comes to know it.

Key Takeaways

• Readiness comes before strategy: AI is almost always already happening in a pharmacy before any leader formally decided it should, so the first strategic act is an honest inventory of what is actually true, not a vendor demo or a projected saving.
• Every downstream decision, the roadmap, the prioritization, the business case, and the URAC accreditation effort, inherits the accuracy of the readiness assessment, so a building set on unmeasured ground does not stand.
• Dimension one, systems and data, asks what AI can technically reach: which platforms run the pharmacy, which already shipped AI features, how data moves, and where protected health information (PHI) actually lives and flows.
• Dimension two, workflows, maps where time and errors actually go in real processes; the prior authorization workflow is the clearest case, showing both the roughly 25-to-5-minute administrative opportunity and the incompressible clinical judgment that stays with the pharmacist.
• Dimension three, governance, is where most pharmacies score lowest: who decides, what the policy is, whether verification is required in writing, who is accountable, and what evidence exists; the cardinal rule (AI supports judgment, never replaces it) must be operationalized, not just believed.
• Dimension four, staff and competency, measures two separate things: the actual skill of the people and the documented evidence of it, plus the cultural variable of whether the team verifies AI output skeptically or is drifting toward dangerous rubber-stamping.
• The synthesis must be honest and specific, naming real strengths and real gaps per dimension and identifying the single highest-value gap to close first, resisting both flattering over-scoring and paralyzing harshness.
• The readiness assessment is fundamentally an act of leadership: replacing what you imagine about your pharmacy with what is actually true, which is what earns a strategist the standing to be believed and grounds every later decision.