Dana is the Director of Talent Acquisition at a 600-person fintech company with a recruiting team of eight. She has spent the past two years getting AI into her workflow, drafting, summarizing, a screening assist, and it works. The question that keeps her up at night is different now: when the next regulation lands, or the next model generation arrives, or a vendor she depends on changes its terms, will her function bend or break? A future-readiness assessment answers that. It is not a grade on what she has built; it is a measure of how well her function can absorb change. In this project you will do what Dana did: score readiness across five dimensions, plot the gaps on a maturity matrix, convert them into named risks, and produce a prioritized three-year readiness roadmap you can actually fund.

Why Readiness Is a Different Question From Maturity

It is tempting to confuse "we use AI well today" with "we are ready for what comes next." They are not the same. A function can be highly mature on its current tools and still be brittle, dependent on one champion who could leave, locked into a vendor with no exit plan, or running governance that cannot update fast enough when a new bias-audit rule takes effect. Readiness measures adaptive capacity: the ability to learn, adjust, and keep operating fairly when the ground shifts. It is a property of the function, not of the software.

Dana frames her assessment around a blunt prompt: if the rules of the game changed in the next 12 months, where would we struggle? That framing keeps the exercise honest and stops it from becoming a self-congratulatory inventory of tools already in place. Notice what the prompt does structurally. It forces every score to be justified against a hypothetical change rather than against current output, so a team that screens beautifully today but could not repoint its process inside a quarter scores low despite excellent results. That is the correct answer, and it is the answer a maturity assessment would never give you.

Write the prompt at the top of your worksheet before you score anything, and return to it every time a number feels generous. Readiness has to be argued from evidence of flexibility: how long the last policy change took, how many people could do the critical task, whether there is a second option for anything you depend on.

Step One: The Five Dimensions You Score

Dana assesses readiness across five dimensions, each rated on a 1-to-5 maturity scale where 1 is ad hoc and reactive and 5 is institutionalized and self-improving. Using a shared scale lets her compare dimensions and, later, track movement over time. Before scoring, decide what evidence each dimension will be argued from, because a dimension without a named evidence source becomes an opinion with a number attached to it.

The evidence column is the part learners skip and the part that makes the assessment defensible. "Governance readiness 4" is a claim; "governance readiness 2, because the last policy update took a quarter and fairness monitoring runs only when someone remembers" is a finding. When you later ask a CFO to fund the roadmap, the second form survives the meeting and the first does not, because the evidence note is what converts a low score from an insult into a description of a mechanism that needs fixing.

Step Two: Anchoring the Scale So the Scores Mean Something

A 1-to-5 scale is only useful if the numbers have shared definitions, otherwise everyone scores 3 and the exercise produces a flat, uninformative line. Anchor the ends and the middle before you begin. A 1 is ad hoc and reactive: the thing happens when someone remembers or when a crisis forces it. A 3 is defined and repeatable: there is a documented way it is done and it usually gets done. A 5 is institutionalized and self-improving: it happens on a cadence, has a named owner, and gets revised on the basis of its own results without anyone escalating.

Dana scores each dimension honestly, writes the evidence behind the number, and notes the target she wants to reach within three years. The target is a separate judgment from the score and deserves its own thought, because not every dimension should aim at 5. A deliberate, sufficient 3 on a dimension that is not your binding constraint is a better answer than a 5 you will never fund, and writing the target down forces you to say out loud how good is good enough. Ambition spread evenly across five dimensions is the same as no priorities at all.

Step Three: A Worked Example, Dana's Scored Maturity Matrix

Here is Dana's completed matrix. Read it as a shape rather than as a report card, and notice that the evidence column is doing most of the analytic work.

Her average lands near 2.6 of 5, but the average is the least useful number on the page. The pattern is what matters: a strong, willing culture sitting on top of weak capability, governance, and partnership foundations. That shape tells Dana exactly where to invest, and it warns her that her greatest risk is brittleness in the unglamorous foundations, not a lack of enthusiasm. A function with the opposite shape, solid foundations and a resistant culture, would need an entirely different roadmap built around change leadership rather than around training and process.

Look also at the gap between current and target on each row. Capability and governance each need to move two full points, while strategy, culture and partnership each need one. Those gap sizes are the raw material of sequencing, because a two-point move is a multi-year program and a one-point move is often a single decision plus a calendar entry.

Step Four: Reading the Pattern to Set Priorities

A matrix is only useful if it changes what you do next. Dana reads hers and draws three conclusions. First, capability is the binding constraint: a brittle, two-person knowledge base undermines everything else, so it gets first priority. Second, governance readiness is a compliance risk, not just an efficiency one, because evolving standards like New York City Local Law 144's requirement for annual independent bias audits of automated employment decision tools, EEOC scrutiny of algorithmic hiring, and GDPR transparency duties will keep arriving, and a function that takes a quarter to update a policy will always be late. Third, her strong culture is leverage: because the team embraces change, capability and governance investments will land on willing ground rather than meeting resistance. Prioritizing by pattern, not by average, is what turns an assessment into a plan.

The binding-constraint idea is what stops a roadmap from becoming a wish list. A binding constraint is the dimension whose weakness caps the value of improving any other. Dana could write a superb adaptive strategy, but with fluency concentrated in two people, executing any change still routes through the same two calendars, so improving strategy first would produce a better document and no more capacity to act on it. Ask of each weak dimension: if I fixed everything else and left this alone, would the function still stall? The dimensions that answer yes go first, regardless of which are easiest to fund.

Step Five: Turn Each Gap Into a Named Risk

To make the priorities concrete, Dana turns each weak dimension into a named risk with a likelihood, an impact, and an owner, so the roadmap that follows is anchored in consequences rather than scores. This is the translation step that gets the work funded. A leadership audience does not act on "capability readiness is a 2." It acts on "if either of our two AI power users leaves, throughput drops and adoption stalls, and nobody else can pick it up."

Writing the gaps as risks, not just low scores, is what makes leadership willing to fund the roadmap. Two details repay attention. The regulatory-lag likelihood is written as "medium and rising" rather than as a fixed value, because the trend is itself the argument. And single-vendor exposure carries a low likelihood with a high impact, exactly the profile organizations habitually defer and then regret.

Step Six: Building the Three-Year Readiness Roadmap

Dana converts the gaps into a sequenced roadmap, targeting the weakest, highest-risk dimensions first while protecting her cultural strength. Each year names the moves, the owner, and the score movement it is supposed to produce, which is what makes the roadmap checkable rather than aspirational.

Year 1, close the capability and governance floor. Broaden AI fluency beyond two people by training the full team of eight and cross-training a second governance owner so no single departure stalls the function. Rewrite the governance process so a policy can be updated in weeks, not a quarter, and move fairness monitoring to a fixed quarterly cadence with a named owner. Target movement: capability 2 to 3, governance 2 to 3. Notice that Year 1 buys down the two risks with high impact and medium likelihood, and that the governance fix is a change to the process for changing things, which is the most leveraged kind of readiness investment there is.

Year 2, mature monitoring and reduce vendor risk. Stand up a standing fairness dashboard reviewed monthly, add scenario planning to the strategy with semi-annual reviews, and reduce single-vendor dependence by qualifying a backup screening provider and joining a peer practitioner network for early regulatory signal. Target movement: governance 3 to 4, strategy 3 to 4, partnership 2 to 3. The partnership moves belong in Year 2 rather than Year 1 because they are the slowest to pay off and the least urgent, but they are also the ones that shorten every future response time by telling Dana what is coming before it arrives.

Year 3, institutionalize adaptability. Make readiness a recurring practice: re-score the matrix annually, fold an external advisor or academic relationship into the partnership mix, and embed continuous improvement so the function self-corrects. Target movement: capability 3 to 4 and culture 4 to 5, with the whole matrix now sitting at 4 or above except partnership at a deliberate, sufficient 3. That last clause is the discipline the whole roadmap depends on. Dana is explicitly declining to push partnership to 4, because the risk it addresses is bought down enough at 3 and the effort is better spent elsewhere.

Step Seven: Make the Assessment a Practice, Not an Artifact

A readiness assessment ages. The scores describe a function at a moment, against a change environment at that same moment, and both move. Dana schedules the re-score annually with the same scale, the same five dimensions and, importantly, the same evidence questions, because comparability is the entire value of a repeated measure. Changing the dimensions between rounds feels like refinement and destroys the trend line you were building.

The re-score also audits the roadmap. Each year named a target movement, so the following year's scoring tests whether the investments produced what they promised. Where a dimension did not move, there are only two honest explanations: the intervention was not delivered, or it was delivered and did not work. Both are useful, and both are lost if the matrix is scored once and filed. Add one trigger outside the annual cadence: re-score a dimension immediately when a material change lands in it, such as a new regulatory obligation or the loss of the person who was your entire depth in a critical task.

Your Deliverable

Finish this project with a short document, not a deck. It contains the scored matrix with all five dimensions, each carrying a current score, a three-year target, and an evidence note that says what the number is based on. It contains a paragraph reading the pattern, naming your binding constraint and your leverage. It contains a risk table converting each weak dimension into a named risk with likelihood, impact, and an owner. It contains a three-year roadmap in which each year lists specific moves and the score movement they are meant to produce. And it contains a re-score date on a calendar with your name against it.

Then run one test before you circulate it. Take the dimension you scored highest and try to argue it down a point using only evidence of flexibility, not evidence of performance. If you can, your scoring drifted back toward maturity somewhere, and the other scores probably drifted too. Fix them before the document goes out, because a readiness assessment that flatters the function is worse than none at all: it converts an unknown weakness into a documented strength and removes the reason anyone would look again.

Anti-Patterns

Scoring your tools instead of your ability to change. The assessment turns into an inventory: which AI capabilities are deployed, how well they perform, how satisfied users are. It happens because that data exists and is flattering, while readiness evidence has to be dug out and is not. What goes wrong is that a function with excellent current output and no capacity to repoint itself scores high and is left alone, until a regulation or a vendor change arrives and the assessment turns out to have measured the wrong thing entirely. The counter is the framing prompt, held in view throughout: if the rules of the game changed in the next 12 months, where would we struggle, and what is the evidence?

Scores without evidence notes. Every dimension gets a number and none gets a sentence explaining what the number rests on. It happens because scoring is fast and evidence-gathering is slow, and because an unexplained number cannot be argued with in the room. What goes wrong shows up later in two places: the scores drift upward under social pressure since nothing anchors them, and the funding conversation collapses because a number carries no mechanism a leader could agree to fix. The counter is a hard rule that no score is recorded without a specific, checkable observation attached, such as how long the last policy change took or how many people can perform the critical task unaided.

Managing to the average. The assessment produces a single overall readiness score, and the discussion becomes about moving 2.6 to 3.0. It happens because one number is easier to report upward and looks like a metric. What goes wrong is that averaging destroys the shape, which is the only part of the matrix with diagnostic value. Dana's 2.6 could equally describe a function that is uniformly mediocre everywhere, and that function needs a completely different roadmap from hers. The counter is to report the dimensions individually, always, and to treat any request for a single headline number as a request to be told less.

Targeting 5 on everything. Every dimension gets a target of 5 because anything less looks like settling. It happens in the drafting minute when targets are typed quickly and nobody wants to write down a modest ambition. What goes wrong is that uniform targets erase the prioritization the scoring just produced, the roadmap becomes a list of everything, and the first resourcing conversation kills the whole thing as unrealistic. The counter is Dana's partnership target of 3, chosen deliberately as sufficient. Force yourself to justify each target against the risk it buys down, and accept that a good roadmap declines to maximize something.

A matrix that never becomes a roadmap. The assessment is completed, presented, admired, and filed. It happens because the scoring is intrinsically satisfying, it feels like a deliverable, and the translation into funded work is a harder, more political task involving other people's budgets. What goes wrong is that the gaps you have now documented are still gaps a year later, with the added problem that the organization has written proof it knew. The counter is the risk table: no weak dimension leaves the assessment without a named consequence, an owner and a year, because leadership funds risks and does not fund scores.

Scoring once, or rewriting the instrument between rounds. Either the matrix is never re-scored, or it is re-scored with improved dimensions and a better scale. It happens because the first version always looks crude in hindsight. What goes wrong is that you lose comparability, which is the only way to tell whether last year's investments worked, and you also lose the ability to detect drift in the direction that matters most, a dimension quietly falling as people leave. The counter is to freeze the dimensions and the anchors for at least three cycles, record improvements as notes for a future version, and add an out-of-cycle re-score trigger for material changes such as a new obligation or the loss of your only expert.

Practice

• Write the framing prompt and gather evidence before you score. Put "if the rules of the game changed in the next 12 months, where would we struggle" at the top of the page. Then collect five specific facts: how long your last policy change took, how many people can perform your most critical AI-assisted task unaided, when fairness monitoring last ran, whether any dependency has a named alternative, and how you learned about the most recent regulatory change affecting hiring.
• Anchor your scale in writing. Define 1, 3 and 5 for your own function before scoring anything, so that ad hoc, repeatable and self-improving mean the same thing on every row. Have a colleague score one dimension independently against your anchors; where you differ by more than a point, the anchor is not written clearly enough yet.
• Score all five dimensions with an evidence note each. Strategy, capability, governance, culture, partnership. No number goes in the cell until the sentence next to it names a checkable observation. Then add a three-year target per dimension and justify any target below 5 as deliberate rather than defeated.
• Read the pattern and name your binding constraint. Ignore the average. Ask of each weak dimension whether the function would still stall if you fixed everything else and left it alone. Name the one that answers yes, and name your strongest dimension explicitly as leverage you will spend.
• Convert each gap into a risk with likelihood, impact and an owner. Write the consequence as a sentence a leader would react to, not as a score. Mark any risk whose likelihood is rising, and treat low-likelihood, high-impact exposures such as single-vendor dependence as real rather than as someday problems.
• Sequence a three-year roadmap with target movements attached. Put the binding constraint and the compliance-linked gap in Year 1, slower-paying partnership and monitoring work in Year 2, and institutionalization in Year 3. For each year, write the score movement it is supposed to produce, then diary the re-score date that will check it.

Reflection

• If your single most AI-fluent person resigned tomorrow, what specifically stops, and for how long?
• How long would it genuinely take you to change a hiring policy today, measured from decision to the new practice being live, and how do you know?
• How did you learn about the last regulatory change that affected your hiring process, and was it early enough to act calmly?
• Which of your scores would you be least comfortable defending with evidence in front of your legal partner, and what does that discomfort tell you?

Glossary

• Future-readiness assessment. A structured scoring of how well a function can absorb change, producing a matrix, a risk translation and a roadmap. It measures capacity to adapt, not quality of current output.
• Adaptive capacity. The ability to learn, adjust and keep operating fairly when conditions shift. It is what readiness measures, and it is a property of the function's people, processes and relationships rather than of its tools.
• Maturity, as distinct from readiness. How well a function performs its current practice. A function can be mature and brittle at the same time, which is exactly the case this assessment exists to detect.
• Scale anchors. The written definitions of 1, 3 and 5, typically ad hoc and reactive, defined and repeatable, and institutionalized and self-improving. Without them, independent scorers cannot agree and repeated scores are not comparable.
• Evidence note. The checkable observation recorded beside each score, such as the elapsed time of the last policy change. It converts a score into a finding and is what makes the funding conversation possible.
• Target score. The three-year ambition for a dimension, judged separately from the current score. A deliberate, sufficient target below the maximum is a sign of real prioritization.
• The pattern. The shape of the matrix across dimensions, which carries the diagnostic value that the average destroys. A strong culture on weak foundations demands a different roadmap from uniform mediocrity at the same mean.
• Binding constraint. The dimension whose weakness caps the value of improving any other. Test for it by asking whether the function would still stall if everything else were fixed.
• Key-person dependency. The risk that critical capability is concentrated in one or two people, so a single departure stalls throughput and adoption. The standard fix is cross-training a second owner.
• Regulatory lag. The risk that a new obligation lands and the function cannot respond inside the compliance window because its change process is too slow.
• Single-vendor exposure. The risk that one provider changes terms or suffers an outage with no qualified fallback. Characteristically low likelihood and high impact, which is why it gets deferred and then regretted.
• Scenario planning. The strategy practice of naming plausible futures and the responses to each, plus review points frequent enough to act on them. Its absence is the usual reason a strategy scores as a snapshot.
• Peer practitioner network. External relationships with counterparts, advisors and academic contacts that provide early signal on regulatory and market change. Its function in a readiness roadmap is to shorten every future response time.
• Automated employment decision tool. The category of system that computationally screens or scores candidates, and the category to which Local Law 144's annual independent bias-audit requirement attaches.
• Re-score cadence. The annual repetition of the assessment using identical dimensions and anchors, plus an out-of-cycle trigger for material changes, which is what turns a one-off artifact into a practice.

Related Lessons

• Building Adaptive Capacity: Organizational Learning, Partnerships develops the underlying idea this assessment scores, and goes deeper on how external relationships build the capacity to absorb change.
• AI Evolution: What's Likely to Change? supplies the change environment your readiness is being measured against, and is worth reading before you set your three-year targets.
• Regulatory Landscape: GDPR, AI Act, Executive Orders, and Emerging Standards is the detail behind the regulatory-lag risk, and the reason governance readiness is scored as compliance rather than as efficiency.
• Hands-On Project: Develop a 2-3 Year AI Strategy is the companion project; this assessment tells you where that strategy is brittle, and the strategy is where several of these roadmap moves get funded.
• Hands-On Project: Design a Team Capability Building Program is how you actually close a capability-readiness gap once the matrix has named it as your binding constraint.
• Roadmapping: Phased Adoption, Capability Building, and Culture Shift covers sequencing multi-year change in more depth, including how to phase work so early wins fund later stages.

Closing

The value of this project is not the number Dana ends up with. It is that she can now answer a question she previously could only worry about. Before the assessment, "will we cope with what comes next" was a feeling. After it, it is five scores with evidence behind them, three named risks with owners, and a sequenced plan whose first year addresses the two exposures that would hurt most. The worry has not gone away, but it has been converted into work.

The parts of this deliverable that will be tempting to skip are the ones that carry the weight: the evidence note under each score, the risk translation that gets the roadmap funded, the deliberately modest target that proves you prioritized, and the re-score date that tests whether any of it worked. Skip those and you have a well-designed matrix describing a moment nobody will revisit. Include them and you have a function that notices its own brittleness before something else does.

Key Takeaways

• Readiness is adaptive capacity, not current maturity. A function can run today's tools well and still be brittle. The question is whether it can absorb the next regulation, model generation, or vendor change without breaking, and the framing prompt that keeps the scoring honest is: if the rules changed in the next 12 months, where would we struggle?
• Score five dimensions on a shared 1-to-5 scale with written anchors. Strategy, capability, governance, culture, and partnership. Define what 1, 3 and 5 mean before you start, or independent scorers will not agree and repeated rounds will not be comparable.
• No score without an evidence note. "The last policy update took a quarter" is a finding; "governance is a 2" is an opinion. The evidence is what stops scores drifting upward and what makes the funding conversation possible.
• Read the pattern, not the average. Dana's 2.6 average hides the real story, a strong culture on weak capability and governance foundations. The shape of the matrix, not its mean, tells you where to invest first.
• Prioritize the binding constraint and spend your strength as leverage. A two-person knowledge base and slow-to-update governance are the gaps that undermine everything else, so they lead the roadmap; a strong culture is what makes those fixes land on willing ground.
• Translate every gap into a named risk with likelihood, impact and an owner. Leadership funds consequences, not scores. Mark rising likelihoods, and do not defer low-likelihood, high-impact exposures such as single-vendor dependence.
• Treat governance readiness as compliance, not overhead. Evolving standards like NYC Local Law 144's annual independent bias audits of automated employment decision tools, EEOC scrutiny of algorithmic hiring, and GDPR transparency duties keep arriving. A function that takes a quarter to change a policy will always be late.
• Set targets you will defend, including modest ones. Dana's deliberate, sufficient 3 on partnership is what proves the roadmap prioritized. Uniform targets of 5 erase the prioritization the scoring just produced.
• Make readiness a recurring practice. Re-score annually with identical dimensions and anchors, add an out-of-cycle trigger for material changes, and use each round to audit whether last year's investments produced their promised movement.

Frequently Asked Questions

Who should do the scoring? Is a self-assessment credible? A self-assessment is credible exactly to the extent that its evidence notes are, which is why the evidence discipline matters more than the identity of the scorer. Score it yourself first, since you have the access, then have at least one person outside the function score two or three dimensions independently against your written anchors, ideally someone from legal or data who sees your process from a different angle. Where you differ by more than a point, the disagreement is the most valuable output of the exercise, because it usually reveals either a loosely written anchor or a piece of evidence one of you did not have.

My function is much smaller than Dana's. Do all five dimensions still apply? Yes, and in a small function the pattern usually gets sharper rather than blurrier. Capability readiness in a two-person team is almost always a 1 or 2, since the key-person dependency is structural rather than accidental, and partnership readiness matters more, not less, because external networks are how a small team gets the early regulatory signal a large one would get from an in-house legal group. What scales down is the response, not the assessment: cross-training may mean documenting a process so one person can cover another rather than hiring depth, and a governance fix may mean naming a fixed monthly slot rather than standing up a committee. The obligations attached to the tools you use do not shrink with headcount, which is precisely why the assessment is worth doing at small scale.

How do I score a dimension where I genuinely do not know the answer? Score it low and say why. Not knowing how long your last policy change took, or who besides one person can run your critical AI-assisted task, is itself evidence of low readiness, because a function with mature practice in a dimension can usually answer questions about it quickly. Record the unknown as the evidence note, then put the act of finding out into Year 1 of the roadmap as a specific task with an owner. The failure mode to avoid is scoring a 3 as a placeholder for uncertainty, which is how a matrix ends up flat and uninformative. An honest 2 with "we do not currently track this" beside it is far more useful, and it tends to produce faster action than a confident number would.