AI readiness and opportunity audit
We assess which processes in your business are worth improving with AI, what data and integrations that requires, and when plain automation is the better choice. You get a readiness assessment, a prioritised case for what to do first, and a pilot plan — and you decide the next step.
What this audit is and what it answers
"AI audit" is currently the name of several different services. This one is about where AI can create value in your business and what needs to change before you invest — we don't start from a preferred tool, we start from how work actually gets done today: its volumes, delays, exceptions, costs and the consequences when something goes wrong.
AI Act compliance is a separate service — the AI Act technical compliance sprint, a short fixed-scope project that implements the duties your lawyer has identified. A brand-visibility audit for ChatGPT or Gemini is a different service again, from the SEO field, with a different goal. The full distinction between these three services, with examples, is in an AI audit in a company: what it covers, how long it takes and what you get.
This audit is the first phase of AI implementation for business — you can order it on its own, or as the starting point of a full project.
What we assess
Eight dimensions we check before you invest:
- Processes and actual tasks. Steps, handoffs, how many cases there are, exceptions, rework and the consequences of a wrong decision. Automating an unstable process accelerates mistakes rather than removing them.
- Information and data. Availability, quality, provenance, permitted use, freshness, formats, ownership and access. A promising use case can be blocked by fragmented records or unsuitable permissions.
- Existing software. Internal applications, SaaS, APIs, exports, licences and built-in AI capabilities. A capability you already pay for can beat a new platform or a custom build.
- Integration and architecture. How users and systems are identified, limits on how other software can use your systems (API limits), connectivity, the environments your systems run in, hosting constraints, activity logs, deployment and support. A demonstration is not evidence that an integration will hold up in everyday use.
- Endpoints and servers. Supported operating systems, patching, device management, browser compatibility — and server capacity where a workload actually needs it. Mixed operating systems or older devices are not automatic blockers for SaaS-based AI.
- People and operating readiness. Role-specific skills, the habit of checking results, backing from management, a process owner, the team's capacity to change how it works, and support arrangements.
- Risk constraints. Sensitive data, high-impact decisions, confidentiality, procurement, human oversight and initial regulatory screening. Detailed legal classification is your lawyer's call; the AI Act technical compliance sprint then implements the duties they identify.
- Economics. What the process costs today, how much people will realistically use the solution, implementation, licences, the cost of running the AI model, human review and ongoing maintenance. Time the team gets back is not automatically cash saved.
How we do it
- Define objectives and boundaries. Agree the target outcome, participating departments, constraints and evidence access.
- Observe and baseline the work. Interview the people who do and own the work, sample process records, and check the gap between how a process is supposed to run and how it actually runs.
- Inspect the foundations. Review architecture, data samples, identity and integrations. Where access allows, run targeted feasibility checks — we don't assume a product fits your systems just because of the brand.
- Build opportunity cards. For each candidate, record the problem, the user, the inputs, the proposed change, alternatives, risks, owner, dependencies and success measure.
- Compare options. Assess value, feasibility, risk and change effort. Prohibited or unacceptable uses are ruled out before ranking — regardless of how attractive the economics look.
- Produce a staged roadmap. Separate improvements that remain useful even if you do not proceed with AI, limited pilots and longer-term projects with uncertain outcomes. Define stop/go criteria and the evidence needed to proceed at each stage.
What you get
- A summary for management: where an AI investment has the strongest case, and in what order to act.
- A readiness assessment across the eight areas, showing how fully each rating is supported by evidence and how certain it is.
- A list of possible AI uses, with options to buy a ready-made tool, integrate, build, use plain automation, or put the data and process in order first.
- A ranked list of obstacles and quick wins, with owners and dependencies.
- Indicative business cases with ranges and assumptions, showing how the result changes with how fast people start using the solution and what checking results costs. Every estimate rests on evidence from your processes.
- A short plan for each pilot: scope, test data, success thresholds, human oversight, how to roll it back, and decision points.
- An implementation plan showing the order of work, plus a workshop to walk through and hand over the findings.
Illustrative example
A hypothetical example, not a client description or a determination of any company's actual KSeF tax obligations. A Polish distributor wants an autonomous invoice-processing agent. We start by checking whether authorised KSeF/ERP access already provides the required data in structured form, meaning data split into named fields. Where it does, reading the invoice file (XML) and reconciling its data with fixed rules can remove the need for AI data extraction. For the remaining documents without such fields, such as scans, an AI data-extraction pilot is justified. Missing purchase-order references and limited options for writing into the ERP still require safe checks and human handling of exceptions — not unrestricted agent access. Before we extend the solution, we measure accepted entries, correction time and duplicate prevention. More on KSeF itself in accounting automation after KSeF.
Scope and what follows
Indicative planning range: one distinct part of the business (one business unit) and up to five processes, one to two weeks once evidence becomes available — the same range as the AI audit article and the implementation methodology. We confirm the exact schedule before the start, once the number of processes and the availability of data are settled. A company-wide analysis, detailed security testing (penetration testing), legal opinions and going live require a separate scope.
This is typically followed by data remediation, a single-process pilot, or a specialist audit (regulatory or security). The report has standalone value — it is the basis on which you choose the next step. The full four-phase methodology is set out in the implementation methodology, and the commitments that apply to every project in our standards.
The audit gives you an evidence-based decision: you know where the investment has the strongest case and how to test it in a pilot before you fund the full implementation. In-depth security testing and legal classification are separate pieces of work, each with its own scope.
Frequently asked questions
Do we need clean data across the whole company to start?
No. We assess the information needed for the chosen use case, rather than making perfect enterprise-wide data a prerequisite. Fragmented data in one area can still be enough for a sensible pilot elsewhere.
Will the audit recommend cutting staff?
The audit assesses work and its outcomes, not roles. We separate three things that are easy to confuse: the time the team gets back, service quality and actual cash savings. Workforce decisions stay with leadership and need their own consultation.
Can we do this without an in-house AI team?
Yes, provided process owners and the people responsible for your systems can supply evidence: case examples, data-export access, integration descriptions. The plan we propose reflects the team and support capacity you actually have — it does not assume specialists you do not employ.
How does this differ from the blog post?
It's the same audit — this page covers scope, deliverables and how to commission it; the blog post walks through the method step by step, including the process scoring card and a worked example. Worth reading both if you're considering ordering it.
Start with one process
A free consultation, after which you know which process to start with and what the audit will check in your business.
Free 20–30-minute call. Write or call, and we’ll reply with two time slots.
Let's check whether an audit makes sense
The message goes straight to our mailbox. If you would rather e-mail or call, both are above.
Thank you — your message has arrived.
We usually reply the same working day, at the latest the next one.
Information on data processing
The controller of your data is Actum Krzysztof Ploch, ul. Irzykowskiego 3/15, 01-317 Warsaw, Poland, contact@ploch.ai. We process the data from the form to reply to your message and — if you ask for one — to prepare an offer (Art. 6(1)(b) GDPR: steps prior to a contract, at your request), and in our legitimate interest in handling correspondence and protecting the form from spam (Art. 6(1)(f) GDPR).
The message goes to our mailbox and is not stored in any database on the site's server. The recipients of the data are the hosting provider and the e-mail provider. Solely to limit the number of submissions, we record a hash of the IP address on every attempt to send, and — if you have JavaScript enabled — already from the moment you start filling in the form. The hash does not reveal the address; the key needed to compute it never leaves the server. We keep the hash for one hour after the last use, and once that hour has passed it is deleted at one of the next uses of the form by anyone. We keep correspondence for as long as needed to handle the matter and thereafter until any related claims become time-barred.
You have the right to access, rectify, erase and port your data, to restrict its processing, to object to processing based on legitimate interest, and to lodge a complaint with the President of the Personal Data Protection Office (UODO). Providing data is voluntary, but without an e-mail address we cannot reply. Details are in the privacy policy.
Last updated: