A mid-market business asking whether it is ready for AI is usually asking the wrong question at the wrong size. The readiness frameworks on the market were mostly drawn for large enterprises with a data team, a head of AI and a governance committee. A firm of 120 people has none of those, and an assessment that scores it against them mostly measures what it lacks. The useful question for a firm that size is narrower: which two or three uses of AI would pay here, what would have to be true for them to work, and who would own them.
The gap is real and it is measurable. The Office for National Statistics reported in July 2026 that around 35% of UK businesses with 10 or more employees used at least one AI technology by June 2026, up from around 12% in late 2023, and that adoption remains shallow: adopters used around 1.6 AI technologies on average. The DSIT AI Adoption Research, surveyed in early 2025 and updated in February 2026, found only 34% of businesses planning to adopt AI felt ready to implement it.
This guide covers how to scope an AI readiness assessment for a mid-market firm: what it should check, who needs to be in the room when there is no data team, how long it should take, what you should hold at the end and when not to commission one at all. It does not repeat the dimension-by-dimension scoring and red-flag thresholds already set out in our voice AI readiness assessment guide, and it leaves maturity benchmarking to the capability maturity model.
This guide is written by the team behind DATS, the five-stage AI consulting system DILR.ai runs, from Discover and Diagnose through to Scale and Run. Or see the AI operating model engagement, which covers governance, RACI and lifecycle once you know what you are building.
What is an AI readiness assessment for a mid-market firm?
An AI readiness assessment for a mid-market firm is a short, structured review of whether a business of roughly 50 to 250 people can put specific AI uses into production and run them. Done well, it checks candidate use cases, the data each one needs, who would own it and the rules that apply, and it ends in a ranked shortlist rather than an organisation-wide score against an enterprise maturity model.
The mid-market label needs a working definition, because UK sources draw it differently. In this guide it means firms from about 50 employees up to the employee limit in the Companies Act 2006 medium-sized test, under which a company qualifies as medium-sized when it meets two or more of a turnover test, a balance sheet test and an average of not more than 250 employees. That is our working definition for this article, not a statutory category for AI purposes.
What separates a mid-market assessment from an enterprise one is not the questions but the operating assumptions behind them. An enterprise assessment can assume there is a data platform to audit, an architecture function to sign off integrations and a risk team with a standing view on model use. A mid-market assessment cannot. The same questions get answered by fewer people, from less documentation, and the assessment has to be designed so that the answers still arrive.
Most of the work, at this size, is narrowing. A firm with a finance team of six, an operations lead and an outsourced IT provider does not need a view on every AI idea anyone has had. It needs to know which few ideas survive contact with its own data and its own people. Our enterprise AI consulting guide covers the wider question of when outside help is worth buying at all.
Why is AI readiness different for a mid-market firm?
AI readiness is different for a mid-market firm because the constraints sit in different places. Mid-sized UK businesses adopt AI less often than large ones, firms of 100 to 249 staff cite missing expertise more than other sizes, and fewer of their staff use AI than in smaller firms. In our view, an assessment that ignores firm size over-weights technology and under-weights people and ownership.
The size gradient in adoption is clear in the official figures. The ONS article found that 28% of businesses with 0 to 9 employees reported using at least one AI technology, compared with 49% of those with 250 or more employees. DSIT's survey of 3,500 private-sector businesses with at least five employees reached the same conclusion from a different angle: 36% of large and 23% of mid-sized businesses were currently using AI, against 14% of micro businesses.
The constraint that bites hardest in the middle is expertise. Among businesses with 100 to 249 employees, the ONS reported that around 18% said insufficient expertise had delayed adoption, which it singled out as the size band where that barrier was most evident. Across all businesses with 10 or more employees, 41% reported no barriers at all in the previous three months, so the picture is not uniform: some firms are simply getting on with it.
Depth of use tells a related story. DSIT found that among businesses already using AI, the average share of staff currently using it was 38% in micro businesses, 26% in small ones, 18% in medium-sized ones and 20% in large ones. Medium firms adopt AI as an organisation more often than micro firms, but a smaller share of their people use it, much as in large firms. In our reading, that points at ownership and rollout as much as technology, and a readiness assessment should be built to test it.
The two bars above come from two related DSIT questions put to two groups. Among organisations already using AI, 54% felt ready to scale their use. Among those only planning to adopt, 34% felt ready to implement, with 33% unsure and 32% not ready. DSIT found that neither readiness measure differed significantly by business size, so readiness is not simply a function of headcount. A firm commissioning its first assessment is, by definition, closer to the second group.
The wider adoption figures point the same way. McKinsey's State of AI (November 2025) reported that 88% of organisations use AI in at least one function, while about a third have it in production. For a mid-market firm, readiness is mostly about crossing that second line for one or two uses, not about matching the first figure.
What should a mid-market AI readiness assessment actually check?
A mid-market AI readiness assessment should check five things for each candidate use: whether a real business problem sits behind it, whether the data it needs exists and can be reached, whether a named person would own it, which rules apply to it, and whether the people affected would use it. Organisation-wide maturity, tooling inventories and abstract culture scores matter far less at this size.
Start with the problem, because that is where the evidence says firms get stuck. DSIT found that the most frequently cited reasons for not adopting AI were a lack of identified need and limited AI skills and expertise, and the ONS reported that difficulty identifying business use cases was among the most common factors preventing or delaying adoption in its earlier analysis. An assessment that opens with a technology audit before anyone has agreed which problem is worth solving will produce a long report about the wrong things.
Then check the data per use, not across the business. A mid-market firm rarely has a single data platform worth auditing. It has a finance system, a CRM, a shared drive and several spreadsheets that someone maintains by hand. The useful question is narrow: for this use, does the data exist, is it reasonably complete, and can a system reach it without a rebuild? The AI solutions page lists the kind of specific, data-bound problems we think are worth putting through this test.
Ownership comes next, and it is the question mid-market assessments most often skip. Every candidate use needs a named person who will be measured on it after go-live. If nobody in the firm will put their name against a use, that use is not ready, however good the data looks. We cover the decision-rights side of this in AI operating model versus centre of excellence.
The rules apply per use too. A use that processes customer personal data in a new way may need a data protection impact assessment, and the ICO's guidance on AI and data protection is the starting reference. A regulated firm will also have sector rules on top. The assessment does not need to complete that work; it needs to say which uses will trigger it, so the cost and time show up before anyone commits.
Finally, check adoption. The ONS found that only 11% of businesses with 10 or more employees said more than half of their workforce had received AI-related training. A use that depends on a team changing how it works needs that team represented in the assessment, or the roadmap will assume a behaviour change that never arrives.
Who needs to be in the room when there is no data team?
A mid-market readiness assessment needs the people who can say yes, the people who know where the work actually goes, and the people who can say what is technically possible. In a firm without a data team that usually means five or six people covering sponsorship, operations, technology, risk, finance and the team whose work would change, with several roles often held by one person.
DILR's own placement diagnostic page lists six roles for its version: an executive sponsor, a head of operations, a head of engineering or platform, a head of risk, compliance or legal, a finance partner and a champion from the team whose work would change. It puts the time cost at about two hours a week spread across those six people. In a mid-market firm the same six seats exist, but they are filled differently.
The technology seat is the one most often empty. Many firms of this size rely on an outsourced IT provider or a single systems manager. That person should still be in the room, because integration questions decide which uses are cheap and which are expensive, and an outside provider's contract terms can rule a use in or out. If the provider cannot attend, the assessment should list the integration questions for them in writing rather than guess.
The risk seat is often a finance director or company secretary wearing a second hat. That is fine, as long as they are asked the per-use questions above rather than a generic policy question. The champion seat matters more than its title suggests. Among medium-sized firms already using AI, DSIT recorded an average of 18% of staff using it. In our view, a champion from the affected team is how an assessment hears early whether a use will actually be taken up.
The same discipline underpins our AI operating model design, which turns the owners named in an assessment into decision rights, gates and rules before the first build starts.
How long should a mid-market AI readiness assessment take?
A mid-market AI readiness assessment that ends in a usable decision takes, in our experience, four to six weeks of elapsed time, with about two hours a week from each of a handful of people. Shorter exercises risk ranking the ideas that were easiest to describe. If one runs much longer, check whether the scope has drifted into building, which belongs after the decision.
There is a floor because the work has stages that cannot run in parallel. You have to hear from the people who run the work before you can map where AI might sit, and you have to map it before you can audit the data behind each use. DILR's placement diagnostic page states that four weeks is the minimum for proper interview coverage and the risk and regulation scan, and that a four-week version covers the same steps with fewer interviews. In our view, a firm of 80 people with a short idea list is the natural candidate for the shorter version.
It also helps to set the clock against how long firms already take. DSIT found that 71% of businesses that had adopted AI had been considering it for around a year before deploying. A four to six week assessment is not the slow part of that year. What tends to stretch the year is the absence of a decision: ideas circulate, a few tools get trialled, and nobody is asked to commit to one use with an owner and a measure.
What an assessment should not do is overrun into a pilot. If, by week five, someone is building a prototype, the assessment has stopped being an assessment. Building belongs after the decision, with its own owner and success measure. The embedded delivery team versus project consulting comparison covers the choice of how to staff that next step, and our AI execution office is one way to run it.
What should a mid-market firm hold at the end of an AI readiness assessment?
At the end of an AI readiness assessment a mid-market firm should hold a decision it can act on: a short ranked list of uses with an owner and a measure for each, a list of uses deferred until something specific changes, and a list of uses to stop. If the output is only a maturity score or a long list of ideas, the assessment has not done the job a firm this size needs.
The ranked list should be short. DILR's diagnostic, for example, ends in three placements sequenced over twelve months, each with an owner and go-live criteria. For a mid-market firm, two or three is, in our view, the realistic ceiling. The ONS found adopting businesses used around 1.6 AI technologies on average and that only 10% of adopters used AI extensively, so a short list does not leave a firm behind a crowd that is moving fast.
The deferred list is where a lot of the value sits. A use that fails one test today, usually data or ownership, should be written down with the condition that would bring it back. That stops the same idea being re-proposed every quarter with nothing changed, and it gives the firm a reason to fix the underlying problem, whether that is a messy CRM or a missing owner.
DILR's diagnostic page notes that the do-not-do list is often the page a finance director reads first, and with reason. Writing down why an idea was dropped is cheaper than funding a pilot to find out. It also protects the shortlist: once the weaker ideas are formally parked, the team's attention goes to the few that survived.
Ask, too, for the working papers. The scoring behind each decision should be open to you, in a form your own team can rerun next year without the assessor. A readiness assessment whose reasoning lives only in the assessor's slides is a dependency, not an asset. Our page on how we approach AI sets out why we agree the measure first and design governance before the build.
When should a mid-market firm not commission an AI readiness assessment?
A mid-market firm should not commission an AI readiness assessment when it has no live business problem it expects AI to help with, when it only needs a benchmark for a board paper, or when it has already chosen one specific use and simply needs to build and measure it. In each case a different, smaller step will give a better answer for less of the team's time.
The first case is more common than vendors admit. DSIT found that over half of UK businesses (51%) did not see AI as relevant to their organisation. Some of those firms are wrong, but some are right for now, and a paid assessment will not change that. If nobody in the leadership team can name a process that costs too much time or loses too much money, start with that conversation internally before paying anyone to look.
The second case is a benchmark. If the board wants to know how the firm compares with peers, a maturity survey or a self-assessment against a published model answers that question faster. The voice AI capability maturity model explains how a maturity model differs from a readiness assessment, and DILR's own diagnostic page says plainly that a readiness or maturity assessment is the right choice if you only need a benchmark.
The third case is a firm that already knows what it wants to build. If a single use has an owner, data and a measure, the next step is a scoped pilot with clear go-live criteria, not another review. The question there is whether to approve spend before every condition is met, which our board-level AI investment decisions guide covers.
There is a broader point about capability behind all three cases. In its July 2026 article, the ONS restated its earlier analysis that firms with stronger management practices were more likely to adopt advanced technologies, and concluded: "This provides some evidence that organisational capability plays an important role in overcoming these barriers." For a mid-market firm, an assessment is worth commissioning when it builds that capability, by naming owners and forcing decisions, rather than when it only describes the gap.
What is the best AI readiness assessment for a mid-market firm in 2026?
The best AI readiness assessment for a mid-market firm in 2026, in our view, is the one that ends in a decision your own team can execute: a short ranked list with named owners, open scoring you can rerun, a per-use check of data and rules, and a time cost your people can absorb. Free self-assessments, ideas workshops and full consulting diagnostics each win in different situations.
These are our criteria, not an industry standard, and they are weighted for a firm without a data team:
- Ends in a decision. A ranked shortlist, a deferred list and a stop list, not a single score.
- Per-use evidence. Data, ownership and rules checked against each candidate use, not across the firm in the abstract.
- Open working. Scores and reasoning handed over in a form your team can rerun.
- Proportionate time. About two hours a week from each of a handful of people, over four to six weeks.
- Builders in the room. Senior practitioners who write production code, so feasibility calls are grounded.
Where alternatives win: a self-assessment or a vendor's readiness quiz is the right tool when the goal is a quick internal conversation starter or a benchmark. An ideas workshop is better when the problem is engagement rather than prioritisation, because it builds energy across teams. A large consultancy, such as Accenture, Deloitte, PwC or EY, can be the right choice for a mid-market firm owned by a private equity sponsor that wants the assessment aligned with its wider portfolio programme. Our Faculty AI alternative guide compares specialist and large-firm options for mid-market buyers in more detail.
Where DATS fits: strictly, DILR's placement diagnostic is not a readiness assessment at all. It suits a firm that wants a decision rather than a score, with two senior practitioners running interviews, mapping, a data and systems audit, a risk scan and open scoring over four to six weeks. Read more about the DATS consulting system, see the AI solutions we build and run, or browse more guides in our strategy category.
Can a mid-market firm run an AI readiness assessment itself?
A mid-market firm can run a first-pass AI readiness assessment itself, and doing so is a good test of whether an external one is needed. The internal version works best when one senior person owns it, the idea list is short, and each idea is checked against a real problem, reachable data, a named owner and the rules that apply. It struggles where nobody can judge technical feasibility.
The most common failure of a self-run assessment is that it ranks ideas by enthusiasm rather than evidence. Two habits help. First, write down for each idea the one number it would move and who agrees that number matters. Second, ask whoever runs your systems, in-house or outsourced, to mark each idea as easy, hard or unknown to connect. If most ideas come back unknown, that is the point at which outside help starts to pay. Our FAQ covers common questions about how we work.
Does an AI readiness assessment need a data protection impact assessment?
An AI readiness assessment is unlikely to need a data protection impact assessment of its own, because interviews and a data inventory are rarely high-risk processing. What it should do is flag which candidate uses will need one. Under UK GDPR, the duty sits with the controller where processing, particularly with new technologies, is likely to result in a high risk to individuals.
That duty comes from Article 35 of the UK GDPR, and it binds the business acting as controller, not the assessor. In practice, a use that profiles customers, screens job applicants or makes decisions about individuals may well need a DPIA before it goes live, so the assessment should record that requirement against the use and count the work in its timeline. Our approach to governance before the build explains where that work lands once a use is chosen.
Want to see how this works in practice? Read about our DATS methodology, see how the AI execution office ships placements into production, browse the AI solutions we build, or learn about Dilr.ai and the practitioners behind it. If you are weighing whether self-hosting matters for your data, see self-hosted AI for regulated industries, or simply talk to us.
Get a decision, not a score.
30-min scoping call · No deck · Confidential. We will tell you whether a diagnostic is worth it for a firm your size, and which uses look worth testing first.
Written by the Dilr.ai engineering team, practitioners who ship enterprise AI in production. Follow us on LinkedIn for shipping notes, or subscribe via the RSS feed.