Skip to content
Book a consult

Insights  /  Platforms

Data readiness for AI: what matters (and what doesn’t)

Pragmatic guidance on data quality, access controls, and operational metadata.

Sopra Labs AI  ·   ·  8 min read
SopraLabs AI Readiness Hero

Key takeaways

  • Data readiness belongs to a use case, not to a company. The question is whether the specific data one use case reads is accurate enough, current, findable and properly restricted.
  • Ignoring data is a real risk. Gartner predicts that “through 2026, organizations will abandon 60% of AI projects unsupported by AI-ready data” (Gartner).
  • Access controls come first. An AI assistant can surface whatever a user is already permitted to see, so permissions that were too broad for years become visible on day one.
  • Four facts about each data source are enough to start: its owner, its source, when it was last updated and how sensitive it is. A perfect enterprise data model, a single platform and cleanup of unused data can wait.

The data program arrives before the use case

The steering committee has one AI item on the agenda. The head of customer service wants an assistant that drafts replies to routine questions, working from the returns policy, the product manuals and two years of resolved tickets.

The data team’s assessment arrives first. The company’s data is not ready. Customer records sit in three systems. Product codes do not match between finance and the warehouse. The recommendation is a data foundation program: one platform, one enterprise data model, twenty-four months, with AI use cases to follow.

The CFO asks which of those problems would stop the service assistant from working. There is a pause. The assistant would not read customer records from finance or product codes from the warehouse. It would read policies, manuals and tickets.

Nobody in the room is wrong. They are answering different questions.

“Fix the data” is the right worry at the wrong scope

The data team’s caution is well founded. In a Gartner survey reported in February 2025, 63% of organizations either did not have, or were unsure whether they had, the right data management practices for AI. Its forecast is blunt: “through 2026, organizations will abandon 60% of AI projects unsupported by AI-ready data” (Gartner).

Surveys from software vendors point the same way. Informatica polled 600 data leaders for its 2026 report, and 57% viewed data reliability as a key barrier to moving AI projects from pilots to production (Informatica). Informatica sells data management software, so treat the number as evidence from an interested party.

The trouble is the word “ready”. Drexel University’s LeBow College of Business and Precisely, a data software company, surveyed 505 data and analytics leaders at large enterprises in the second half of 2025. In that survey, 88% said they have the data readiness needed for AI, and 43% named data readiness among their biggest obstacles (Drexel LeBow and Precisely). Those two answers sit together comfortably only when “ready” has no fixed meaning.

Gartner’s own definition is narrower than its headline. Data “must be representative of the use case,” its analyst says, covering what is needed “to train or run the AI model for the specific use.” Readiness describes data in relation to one use. It does not describe a company.

That explains the twenty-four-month plan. Ask a data team whether the company’s data is ready for AI, with no use case attached, and it can only answer for all data and every possible use. The honest answer is no, and the honest remedy is enormous. The size of the program follows from the size of the question.

One part of the worry deserves full strength: access. Microsoft’s documentation says its assistant “only surfaces organizational data to which individual users have at least view permissions” (Microsoft). Permissions are the settings that decide who can open what. Ones set too broadly years ago stay harmless while nobody goes looking. An assistant goes looking on every request.

The Australian government’s evaluation of its 2024 Microsoft 365 Copilot trial is plain: “Use of Copilot enabled some participants to access documents that they should not have had permission to access” (Digital Transformation Agency).

Scope readiness to the use case

Start with what the use case reads. Name the specific sources the first use case needs. For the service assistant, that is the returns policy, the manuals and the resolved tickets. That list is the scope of the readiness work. In a use case portfolio, data readiness belongs in each entry’s feasibility score. It is not a gate in front of the whole portfolio.

Ask four questions of each source. Is it accurate enough for this use? Is it current? Can the tool find it? Can the right people, and only the right people, see it? “Accurate enough” depends on the stakes: a draft that a person reviews tolerates more error than an automatic refund. NIST’s generative AI profile asks for the same discipline: “Review and document accuracy, representativeness, relevance, suitability of data used at different stages of AI life cycle” (NIST AI 600-1, MP-2.3-002). Retire superseded versions too, because an assistant may quote any copy it finds.

Fix permissions before you switch anything on. Access controls are the rules that decide who can open a file, a folder or a record. Review them for every location the assistant can reach, starting with anything shared company-wide. Microsoft’s deployment guidance tells administrators to find “sites and files that are overshared, ownerless, inactive, or contain sensitive data that could be surfaced by Copilot” (Microsoft).

Record four facts about each source. Metadata is information about data, like the label on a file box. Four fields carry most of the load: who owns the source, where it came from, when it was last updated and how sensitive it is. A spreadsheet is enough. NIST suggests that AI system inventories include “Data provenance information (e.g., source, signatures, versioning, watermarks)” (NIST AI 600-1, GV-1.6-003). Provenance means where data came from and how it has changed. The owner is the person who gets the call when the assistant quotes something wrong.

Leave the rest alone for now. A perfect enterprise data model, a single platform and cleanup of data that no use case touches may all be worth doing for other reasons. None is a precondition for the first use case. Gartner’s analyst makes a related point: “AI-ready data is not ‘one and done.’” It is a practice that improves “based on existing and upcoming AI use cases.”

The usual objection is that working one use case at a time produces a patchwork, and the big program arrives anyway, later and messier. That happens when each use case invents its own rules. Keep the four questions and the four fields identical every time, recorded in one place. Each use case then leaves behind a slice of data that is clean, owned and documented. The sources that keep reappearing show where a platform investment would pay. The larger program may still come, funded by evidence of demand.

The same meeting, a smaller question

Back in the steering committee, the CFO’s question becomes the agenda. What does this use case read, and is that ready?

The answer fits on one page. Three sources. One outdated policy version to retire. One shared folder to lock down. Three owners to name. The work is measured in weeks.

The data foundation program is not rejected. It waits for evidence. The data team was right that data matters. It was the scope of the question that needed fixing.

The opening scenario is a composite of common patterns, not a client engagement. SopraLabs reviews data alongside stack, security and governance in the AI Readiness Assessment module of our services.

Frequently asked questions

What does “AI-ready data” mean?

AI-ready data is data fit for one specific AI use: accurate enough, current, findable by the tool and restricted to the right people. Gartner also ties readiness to the use case, saying data “must be representative of the use case” (Gartner). There is no general certificate of readiness for all of a company’s data.

Do we need to clean up all our data before using AI?

No. Clean and govern the data the first use case will read, then extend the work as each new use case is approved. Gartner describes AI-ready data as “not ‘one and done’” and as a practice that improves “based on existing and upcoming AI use cases” (Gartner).

Will an AI assistant show employees files they should not see?

It can, if existing permissions are too broad. Microsoft states that its assistant “only surfaces organizational data to which individual users have at least view permissions” (Microsoft), so the exposure comes from access that was already granted. The Australian government’s trial evaluation warned that “Without the appropriate data infrastructure and governance in place, the use of Copilot may further exacerbate risks of data and security breaches” (Digital Transformation Agency). Review access before rollout.

What is operational metadata, and how much do we need?

Operational metadata is basic descriptive information about a data source. Four fields are enough to start: owner, source, date last updated and sensitivity. NIST’s generative AI profile suggests keeping data provenance information, such as source and versioning, in the AI system inventory (NIST AI 600-1).

Sources

Keep reading

Browse all insights