AI Readiness Questionnaire | Sacramento, CA

About this questionnaire

This questionnaire helps us understand your organization's current position, comfort level, and expectations regarding the use of Artificial Intelligence (AI) tools. Your responses guide how our team uses and recommends AI on your behalf, and help us ensure AI is deployed in ways that align with your security, privacy, compliance, and cultural preferences.

This is not a contractual or legal document. It is intended to support transparent service delivery and to give you a structured way to think through decisions you will eventually need to make anyway.

If you do not have a definitive answer to a question, choose the option closest to where leadership leans today. We will refine the answers together.

Estimated completion time: 10–14 minutes.

Read this first

Why Businesses Need To Draft an AI Acceptable Use Policy

A 9-minute read that gives you the framing you will need to answer the rest of this questionnaire accurately — licensing tiers, data classification, agents and connectors, and the AI Adoption Roadmap.

Read the blog post →

Have you reviewed the companion blog post, "Why Businesses Need To Draft an AI Acceptable Use Policy"?

Yes — I have read and understood the blog

No — please send me the link before I continue

No problem. You can read the post here: Why Businesses Need To Draft an AI Acceptable Use Policy. Feel free to continue now and finish the questionnaire either way — we will follow up with the link by email as well.

Section 1 — Organization & Contact

Company name

Your name

Your job title

Email address

Are you authorized to make decisions about AI policy for your organization?

Yes

No, but I can route this to the right person

Not sure

Section 2 — Industry, Regulation & Operations

These questions give us the operating context for our recommendations. The same AI tool may be appropriate for a marketing agency and inappropriate for a law firm or healthcare provider — and a recommendation for an org with an internal IT team looks different from one for an org running on outsourced support.

Primary industry

Please specify your industry

Which categories of regulated or sensitive data does your organization handle?

PHI — Protected Health Information (HIPAA)

PII — Personally Identifiable Information

Cardholder data (PCI)

Customer financial data (GLBA scope)

Controlled Unclassified Information / Federal Contract Information (CMMC scope)

Attorney–client privileged communications

Trade secrets / proprietary intellectual property

Student records (FERPA)

None of the above

Unsure

Select all that apply. This shapes which AI tools and tiers we can recommend.

Are you subject to any of the following compliance frameworks?

HIPAA / HITECH

SOC 2

PCI-DSS

GLBA / FTC Safeguards Rule

CMMC 2.0 / NIST SP 800-171

ISO 27001

State privacy laws (CCPA / CPRA, etc.)

Industry-specific

None / unsure

Please specify the industry-specific framework(s)

How are your IT and security operations currently managed?

Internal IT staff (one or more dedicated IT employees)

External managed services provider (MSP)

Mix of internal IT and external vendor support

Outsourced security operations / SOC

Individual project-based vendors (no ongoing managed relationship)

No formal IT support — managed informally

Other

Select all that apply. This helps us understand your operating context and where AI governance work fits in your existing setup.

Please describe how IT is managed

Section 3 — Current Policy State

Does your organization have a written policy governing the use of AI?

Yes — a formal written policy exists

Informal guidance only (no formal written policy)

No, we do not currently have an AI policy

Unsure

Includes any formal AI Acceptable Use Policy or equivalent. If a written policy exists, you will be able to share a link in the next question.

If a written policy exists, please share a link

If it is easier to email us a copy, leave this blank and we will follow up.

When was the policy last reviewed or updated?

Within the past 6 months

6–12 months ago

12–24 months ago

More than 24 months ago

Unsure

Section 4 — Leadership Posture

Two questions about leadership: their appetite for AI, and their appetite for the risk that AI introduces. Those are not the same thing.

Leadership AI Interest Level

AI-Positive / Eager — actively exploring and encouraging adoption

AI-Cautious — interested, but concerned about security, privacy, or compliance

AI-Neutral — no strong opinion; use only where clearly beneficial

AI-Concerned — prefer to avoid AI; only use if explicitly approved

AI-Restricted — AI use is generally not allowed

How leadership feels about adopting AI, independent of risk concerns.

Leadership AI Risk Tolerance

AI-Risk-Averse — leadership views AI as high risk and prefers to avoid use wherever possible

AI-Risk-Cautious — concerned about security, privacy, or compliance risks and expects tight controls

AI-Risk-Balanced — recognizes both risks and benefits and is comfortable with reasonable guardrails

AI-Risk-Tolerant — believes benefits generally outweigh risks and is comfortable with broader use

AI-Risk-Embracing — actively accepts AI-related risk as part of innovation and growth

How much risk leadership is willing to accept in exchange for AI's benefits.

Has leadership communicated a position on AI use to staff?

Yes, formally (written communication or all-hands)

Yes, informally (verbal guidance, team meetings)

Don't know

Section 5 — Use Cases & Incidents

Tells us what AI is actually being used for today, what you plan next, and whether anything has gone sideways so far. Risk and value both vary dramatically by use case.

Which AI use cases are CURRENTLY active at your organization?

Writing / drafting (emails, documents, marketing copy)

Summarization (meetings, documents, threads)

Research and information gathering

Coding / development assistance

Data analysis / reporting

Customer-facing chatbots or assistants

Internal knowledge search / Q&A across company data

Image, video, or audio generation

Translation

Agentic workflows (AI taking actions on a user's behalf)

Other / unsure

None yet

Which use cases are you CONSIDERING in the next 6–12 months?

Writing / drafting

Summarization

Research and information gathering

Coding / development assistance

Data analysis / reporting

Customer-facing chatbots or assistants

Internal knowledge search / Q&A across company data

Image, video, or audio generation

Translation

Agentic workflows

Other

None planned

Please specify the other use case(s) you are considering

Which departments are using or planning to use AI tools?

Executive / Leadership

Sales

Marketing

Operations

Finance / Accounting

Customer Service / Support

Legal / Compliance

Engineering / Product

Other

Please specify the other department(s)

Has your organization experienced any of the following AI-related incidents?

Sensitive or confidential data was entered into a consumer AI tool

Regulated data (PHI, PII, CUI, etc.) was processed by an unapproved tool

AI-generated content with errors reached a client or customer

An AI tool acted in a way nobody on the team had approved

A client raised a question or concern about AI use on their account

A vendor or insurance carrier raised an AI governance question

An incident that does not fit the categories above

None of the above we are aware of

Unsure

Honest answers help. These incidents are common, and you are not alone if any apply. We treat all responses confidentially.

Please describe the incident

Section 6 — Tools & Licensing

Approved AI Tool Licensing Level

Private inference platform (e.g., hatz.ai) — Lowest risk (dedicated environment, no model training feedback)

Enterprise / Tenant-bound — Lower risk (org-managed, data remains within tenant, DPA/BAA available) (Recommended)

Business / Team — Moderate risk (paid commercial plans with some organizational controls)

Free / Consumer — Higher risk (personal or consumer plans with limited governance)

Mixed — varies by department or use case

None approved

Different editions of AI tools offer different security, privacy, and governance controls. Select the licensing level your organization permits today.

Permitted Scope of AI Use

Browser chat LLM only — Lower risk (Recommended)

Browser + approved application installs (e.g., Claude Desktop, Copilot apps)

Browser + applications + connections to company data and systems

Not yet defined

How broadly AI may be used by staff.

Which AI tools are explicitly APPROVED for use today?

For each tool, please list: tool name, who is approved to use it (all staff or specific roles), and whether it is connected to company data or systems. Examples: Microsoft 365 Copilot, Claude Enterprise, ChatGPT Enterprise, GitHub Copilot, hatz.ai, etc.

Are any AI tools explicitly PROHIBITED?

List any tools that staff have been told not to use, and the reason if known.

Section 7 — Data Classification

Risk depends as much on what data goes into AI as on which tool is used.

Which categories of organizational data may staff input into approved AI tools today?

Public information only (Recommended)

Internal non-sensitive (drafts, notes, general business info)

Confidential (financial data, client lists, contracts)

Regulated / sensitive (PHI, PII, CUI, customer financial data)

All of the above, with no restriction

Not yet defined

Does your organization currently classify or label data (e.g., Public / Internal / Confidential / Restricted)?

Yes — data is actively classified and labeled (Microsoft Purview or similar)

Partially — informal classification only

Unsure

Section 8 — Connectors & Agentic AI

Connecting AI to company systems and granting AI permission to act on behalf of staff dramatically changes the risk and value profile. We want to understand where you are today.

Have AI tools been connected to any of the following company systems?

Email (Microsoft 365 / Google Workspace)

File storage (SharePoint, OneDrive, Google Drive, Box, Dropbox)

CRM (Salesforce, HubSpot, Dynamics, etc.)

ERP / Accounting (NetSuite, QuickBooks, Sage, Dynamics, etc.)

Line-of-business applications

Calendar / scheduling

Ticketing or project management (Jira, Asana, Monday, etc.)

None

Unsure

Includes Copilot connectors, MCP servers, third-party integrations, plug-ins, browser extensions with system access, etc.

Has your organization deployed AI agents that take actions on a user's behalf?

Yes — in production

Yes — in pilot or test

No, but actively considering

Unsure

Examples: an AI that sends email, schedules meetings, posts in chat, files tickets, modifies records, or executes multi-step workflows without a human approving each step.

Section 9 — Governance & Enablement

Do you have an internal AI Advocate or Champion?

If yes, please provide name(s) and title(s). This is the person(s) who would coordinate AI policy decisions internally.

Has staff received formal AI training in the past 12 months?

Yes — most or all staff

Yes — limited to certain roles

Don't know

Where would you place your organization on the AI Adoption Roadmap today?

Pre-Crawl — No formal AI policy, no defined approved tools, AI use is ad hoc

Crawl — Written AUP in place, team trained on basic AI chat adoption with approved tools

Walk — Custom agents, scoped workflows, and process automation operational with human checkpoints

Run — Full agentic AI adoption, multi-step workflows acting on systems

Unsure

Our framework for AI maturity. Pick the stage that best describes where you are today, not where you want to be.

How would you like Leverage IT to support your AI strategy?

Help us draft or refine our AI Acceptable Use Policy

Recommend approved tools and licensing for our needs

Provide staff training and lunch-and-learns

Audit current AI tool usage and identify Shadow AI

Build connector or agent solutions for our team

Stay reactive — we will reach out when we need help

Anything else we should know?

Specific concerns, prior incidents not captured above, vendor relationships, board-level mandates, etc.

What happens next

Within five business days of receiving your completed questionnaire, your Leverage IT advisor will send you a one-page AI Readiness Snapshot. This summarizes where your organization sits today on the AI Adoption Roadmap, the most important gaps and risks we observed, and a short list of recommended next steps. The Snapshot is yours to keep, regardless of whether you choose to engage us for any follow-on work.

Questions? Reach out to your Leverage IT advisor or call our office:
Sacramento (916) 984-6243 | Reno (775) 324-7300 | leverageitc.com

Start your AI Acceptable Use Policy here

About this questionnaire

Section 1 — Organization & Contact

Section 2 — Industry, Regulation & Operations

Section 3 — Current Policy State

Section 4 — Leadership Posture

Section 5 — Use Cases & Incidents

Section 6 — Tools & Licensing

Section 7 — Data Classification

Section 8 — Connectors & Agentic AI

Section 9 — Governance & Enablement

What happens next

Northern California

Northern Nevada