Your data is ready for AI when you can find it, trust it, trace it, and control who sees it, and an AI system can do the same through metadata rather than tribal knowledge. Most companies pass one or two of those four checks, and the gaps show up as confident wrong answers or exposed data rather than as errors.
Why "ready" is the wrong frame, and the right one
AI readiness is often sold as a platform: buy the right warehouse, vector store, or assistant and you are ready. In practice, the model is the easy part. What decides whether an AI system gives useful answers is the same thing that decides whether your analysts do: whether the data can be found, trusted, traced, and controlled. The difference is that an analyst fills the gaps with experience, and an AI system fills them with a guess.
The four checks
1. Can you find it?
An AI system can only use data it knows exists and understands. That means a catalog with every important dataset, a named owner, and a description written for someone outside the team that built it.
Warning sign: finding the right table means asking the person who has been here longest.
2. Can you trust it?
Trust means tested data and agreed definitions. Pipelines should have quality checks that stop bad data before it reaches users, and headline metrics should have one definition, ideally in a semantic layer that an AI assistant can query rather than guess at.
Warning sign: two teams can bring different numbers for the same metric to the same meeting.
3. Can you trace it?
Lineage shows where every number came from and what depends on it. When an AI answer looks wrong, lineage is how you find out whether the model misread the data or the data itself was wrong. It is also how you answer an auditor, and how you know what breaks before you change a table.
Warning sign: tracing a board-level number back to its source takes days.
4. Can you control who sees it?
This is the check most AI projects fail quietly. Access policies built for dashboards often do not survive an AI layer. Two patterns cause most of the trouble:
- Identity flattening. The assistant queries data through one shared service account, so every user effectively gets the same, broad access. Each user's own identity should reach the warehouse, so existing row-level and column-level policies still apply.
- Retrieval that ignores permissions. Systems that search documents or records to ground an answer must enforce each user's access at retrieval time. If the search index holds everything and filters nothing, a well-phrased question can surface data the user was never allowed to see.
Warning sign: nobody can say which identity your AI pilot uses to query production data.
A five-question self-test
Answer these with a number, not a feeling. If you cannot find the number quickly, that is the answer too.
- How many datasets do you have, and what share of them has a named owner?
- How many definitions of revenue, or your most important metric, are in use today?
- How long does it take to trace a figure in the board deck back to its source systems?
- What share of your production pipelines has automated quality checks that can stop a bad load?
- How many people and service accounts can read your most sensitive data, such as health, payment, or children's data?
If you handle regulated data
Health, payment, and children's data raise the stakes on the fourth check. Rules such as HIPAA, PCI DSS, COPPA, GDPR, and CCPA do not pause for an AI pilot. The safest pattern is to handle sensitive fields once, at the edge, through tokenization or redaction, so that most analytical and AI use never touches the raw values. Then check where your AI provider processes and stores data, and whether that stays inside the boundary your compliance commitments assume.
What to fix first
Start with access, because it is the only failure that can hurt you before anyone notices. Confirm how your AI tools authenticate and what they can reach. Next, define the ten to twenty metrics people will ask about most, and put them somewhere an assistant can query. Then catalog and assign owners to the datasets behind those metrics. Lineage can follow. You do not need to fix the whole estate before starting. You need the slice your first AI use case touches to pass all four checks.
Sid SrivastavaFounder of Millwright Data. He has run data platforms in semiconductor manufacturing, digital health, hospitality, and AAA games, on Snowflake, Databricks, and AWS.
