Data readiness before choosing a model: 8 questions that decide whether your AI project delivers

Why choosing a model is the wrong first question

The demo is convincing. An AI assistant answers a request for a quote in seconds, and the sample data is clean. The only open question seems to be which tool to buy.

In your own company, things look different. The same customer address sits in three systems with three different versions. The current price list is on the network drive, an older one in the sales team's inbox. The assistant now gives answers that sound convincing and are still wrong. That isn't the model's fault. It reads from your data, and your data isn't ready.

According to Bitkom (the German digital industry association; in German), 36% of companies use AI, up from 20% a year earlier. A further 47% are planning or discussing its use (604 companies with 20 or more employees, surveyed in summer 2025). Among the obstacles, respondents name a lack of technical know-how (53%), a lack of staff resources (51%), data protection requirements (48%), the traceability of results (38%) and their quality (36%). Several of these points come down to your own data situation: who may see what, where does an answer come from, and is it correct?

Models can be swapped. Your data situation stays with you. Whatever you choose today, you may replace next year. Customer lists, price versions and access rights stay. If you start with the choice of model, you will meet the uncomfortable questions again in the pilot, when time and budget are already committed.

So here are eight questions about your data. In companies without their own data team, four of them are particularly easy to neglect. We mark them as focus questions: Who owns the data? Which source counts as the truth? Who may see what? How do you measure the quality of the answers?

How to use the checklist in about an hour

For a first honest look, one focused hour is enough if three things are prepared.

One specific use case. Rather than checking "AI in the company", check one task that takes time today, such as draft replies to requests for quotes or finding valid procedural instructions. All eight questions refer to this one case.

Three perspectives at the table. Management decides on priority and names owners. Someone from the business unit knows which list is maintained and which is just lying around. Whoever looks after IT, internally or externally, knows where data is stored and who has access to what.

A traffic light per question. Green means settled, with a name and a location. Amber means patchy or dependent on a single person. Red means open or contradictory. If in doubt, the worse colour applies. For every amber and red, note in one sentence what is missing.

The hour does not replace an audit. But you will see where it hurts.

Question 1: What question should the AI answer?

"We want to use AI in sales" is an intention. A use case needs more than that. Which data is needed, who is responsible for it and how you measure good answers only follow from the purpose. A well-cut case has one user group, one type of question (you could write down five real examples from last week), two or three likely sources and a benefit for people you can name.

A broad case immediately depends on every open problem area. A narrow one has the same problems, just fewer of them.

Traffic light for question 1:

• Green: the case fits in one sentence, with user group, type of question and sources. Everyone understands the same thing.
• Amber: the purpose is clear, the user group or data set not yet.
• Red: the sentence begins with "In general, the AI should help us …", or each person describes something different.

Question 2: Where is the data really stored today?

The IT overview lists two or three systems. In daily work, knowledge is spread across more places: the CRM (as complete as sales keeps it), the ERP (maintained, but hard to access), email inboxes with special terms, network drives with several versions of the same contract, Excel lists on individual computers and knowledge in people's heads, such as which customer gets which exception. If you go through these places with the business unit and IT, you usually notice that the last three are decisive and missing from the first list, because nobody thinks of them as a system.

Also distinguish the form. Structured data answers "What did customer X order last quarter?". Documents and emails answer "Which warranty rules apply to product line Y?". If the decisive information exists only in emails or in people's heads, that changes the effort considerably.

Three folders help as a grid: business context (what do we sell to whom, under which rules), data (customers, orders, documents) and work instructions (processes, approval rules, templates). Often only the "data" folder is filled. The AI then knows your prices, but not the rules by which you give discounts.

Traffic light for question 2:

• Green: all relevant places are named and assigned to the three folders.
• Amber: the places are known, but important parts are scattered across inboxes or individual files.
• Red: the decisive knowledge isn't written down anywhere and exists only with individual employees.

Question 3: Who owns which data?

Focus question 1 of 4.

Ask the group: if there are two addresses for the same customer in the database, who decides which one is correct? Often there is silence, then "sales handles that" or "that's IT's job". Data that belongs to everyone belongs to no one. In daily work, experienced employees fill the gaps from memory. An AI doesn't fill any gaps. It reads what is there.

Separate two roles. Technical responsibility runs the system and grants access. Business ownership decides what is correct in terms of content. IT can make sure the item database is running, but not whether the prices in it are right. An AI project needs the second role.

For each source from question 2, enter a person's name; a department name is not enough. In "sales", everyone relies on someone else to maintain it. This person does not enter every record themselves. They decide when in doubt and notice when quality slips. Be alert when you hear "everyone maintains their own". For an AI, that produces several truths side by side.

Traffic light for question 3:

• Green: a person is fixed for every source needed, and they know it.
• Amber: there are names for only some of the sources, or the assignment isn't recorded anywhere.
• Red: the question triggers a debate, or the answer names a department instead of a person.

Question 4: Which source counts as the truth?

Focus question 2 of 4.

The CRM holds the new customer address, the ERP still has the old one, and the field sales team's Excel list has a third with a typo. The same goes for prices: the price list from the spring, a quote with a special discount in the inbox, the price after the last increase in the ERP. Experienced people know which list to trust. An AI that reads from all sources gives different answers to the same question, each one equally convincing. Nobody notices until the letter comes back or the customer insists on the spring price.

Here is how to proceed:

1. List the data types the use case needs: customer master data, prices, product texts, delivery terms.
2. Define one leading source for each data type, for example addresses from the CRM and prices from the ERP. The owner from question 3 decides this.
3. Mark every other location as secondary or exclude it for the AI. If in doubt, exclude it. One source fewer rarely costs answer quality. One contradiction more almost always does.

Such contradictions usually arise at the handovers between tools, where data moves by export instead of through an interface, or someone creates "a quick list of their own". The AI doesn't cause these breaks. It makes them visible sooner.

Traffic light for question 4:

• Green: a leading source is defined for every data type, and copies are marked or excluded.
• Amber: leading sources are known but not formally defined, or copies flow in unchecked.
• Red: for at least one data type, nobody can say which source applies, or the answer is "depends who you ask".

Question 5: Who may see what?

Focus question 3 of 4.

Access rights have grown over the years. That little went wrong was often because nobody had the time to search through other people's folders. An AI assistant has that time.

How this is handled for a widely used office assistant is described by Microsoft in its product documentation: the assistant can only summarise or reference content that the individual user has access to. What it finds is determined by the existing permissions, and it changes nothing about them. That also means every unnoticed permissions error becomes visible with AI. If the salary list sits in a folder accidentally shared with everyone, the assistant will answer, when asked, what a colleague earns. The problem in that case is the sharing setting.

Check personnel files, customer terms, management documents and ongoing negotiations specifically. Three questions help.

Are the permissions maintained? Who has access to the folder with personnel documents today? "We'd have to look that up" is not a green answer.

Does the solution adopt these rights? Some solutions read with the rights of the individual user, others with a technical shared account that sees everything. Get written confirmation of which applies. In the second case, you need a separate rule on what the AI may reach.

Is personal data marked? The GDPR sets out the principle of data minimisation for this (Article 5(1)(c)). What it means for your systems is for your data protection officer to assess. From a project point of view, the matter is usually simple: an AI for requests for quotes doesn't need personnel files. Exclude such sources.

Where the data is processed is a separate topic and not covered here.

Traffic light for question 5:

• Green: the rights of the sources needed have been checked, the solution demonstrably adopts them, and unnecessary personal data is excluded.
• Amber: the rights are roughly known but unchecked, or it is unclear whether the solution works with user rights or a shared account.
• Red: nobody knows who can access sensitive folders, or the solution sees everything.

Question 6: How current and complete is the data?

An AI doesn't sort out what is outdated. If the price list from three years ago sits next to the current one, it can quote both. Question 4 settles which source applies; question 6 settles whether that source is maintained. Look at the last modified date, at files like "Quote_final_v3_new.docx" next to "Quote_final.docx", at duplicates and empty mandatory fields. How to do that for customer data in 90 minutes is shown in the 90-minute data check for customer data.

Then the sample test: pull ten random records or documents, not the ones that come to mind first, and check each one with the person from the business unit. If eight are clean, the light tends towards green. If three are, you know where the work lies.

More important than the clean-up before the pilot is who maintains the data afterwards. Without ownership it goes out of date again, and the answers gradually get worse. Clarify who is responsible, how often it is checked and how old versions are archived so that the AI no longer finds them.

For personal data, the GDPR also sets out the principle of accuracy (Article 5(1)(d) GDPR). Agree with your data protection officer how to implement it in your maintenance process.

Traffic light for question 6:

• Green: the sample is mostly clean, and one person is responsible for ongoing maintenance.
• Amber: the data is usable, but nobody has taken on ongoing maintenance.
• Red: even the sample shows many gaps, duplicates or old versions.

Question 7: Can the AI technically get to the data?

Question 5 settles what the AI is allowed to see. This one is about what it technically can see.

Can the data be extracted? A standard export as Excel or CSV is often enough for a first test. A documented interface (API) allows automatic retrieval. Whether your system has one, whether it is enabled and what it costs is something a conversation with your service provider will clarify. If data can only be got out by typing it up, that is a warning sign.

Are documents available as text or as images? A PDF created from a word processor is searchable; a scanned one first needs text recognition. Handwriting, stamps or skewed copies produce errors in the process, which the AI later passes on with confidence. The test usually takes only a few minutes: search ten documents for a word. If the search finds nothing, you are looking at a scan.

Are there isolated legacy systems? Typical signs: the vendor no longer exists, only one employee understands the system, the server is deliberately not connected to the network. Don't plan this source into the first pilot.

Traffic light for question 7:

• Green: the most important sources have an export or an interface, and the documents are searchable. A narrow pilot is then doable in weeks.
• Amber: some of it exists as scans or has to be fetched by export. The pilot needs a preparation step with its own time and an owner.
• Red: the decisive source is stuck in a legacy system with no way out. Then an integration project comes before the AI project, or you choose a case with an accessible source.

Question 8: How do you measure whether the answers are good?

Focus question 4 of 4.

In companies without a BI team, this is the point we most often see missing. After a successful demo the mood is good, and that is exactly when the decision gets made. If nobody has defined beforehand what a good answer is, gut feeling decides.

Set up a test catalogue before the first tool goes live:

1. Collect real questions, worded the way your employees or customers word them, including the vague and tricky ones.
2. Write down the correct answers, each with its source: price list, manual, contract.
3. Have experts approve them, meaning the people who give these answers today.
4. Test every new version against it, whether a new model, new documents or changed instructions.

Google Cloud recommends the same basic pattern for such systems: a test set of questions that covers real-world wording and complexity and is agreed with stakeholders and end users, plus a reference set of desired answers. Only one setting should be changed between two test runs.

Measure every answer against three criteria. Is it factually correct? A price that is almost right is wrong. Is the source traceable? The article calls this "groundedness": how far the answer matches the facts from the retrieved source documents. In practice, it means an employee can check instead of trusting blindly. And does the system recognise gaps in its knowledge? Include questions to which there is no answer in your data. The correct response then is "I have nothing on that". A system that invents a plausible answer here is more dangerous in daily use than one that more often says it doesn't know.

The reference answers are approved by the business owner from question 3. Without that person there is no yardstick, and the quality question ends up with someone who doesn't know the right answer.

Traffic light for question 8:

• Green: there is an approved catalogue of real questions with reference answers, and a named person is responsible for approval.
• Amber: individual example questions exist, but without documented answers or without defined approval.
• Red: quality is judged by impression, usually after the demo.

Evaluation: what your traffic lights mean

Don't calculate an average. What matters is where the reds are.

Red on question 1: back to the start. Without a clear purpose, the other seven can't be assessed.

Red on a focus question (3, 4, 5 or 8): now is not the time to compare models. Every model takes these gaps over unchanged. Clear them up first.

Amber on a focus question: you can start, with a condition. Before the pilot starts, the point gets a name and a date and is checked specifically during the pilot, for example with test questions aimed at exactly this gap. If two or more focus questions are amber, you are better off treating the result as red.

Red on question 2, 6 or 7: this slows you down but doesn't always block you. Often the case can be cut so that a single maintained and accessible source is enough.

Otherwise mostly green: you can start. If in doubt, cut the case even narrower. A pilot that reliably answers one type of request says more than one that half manages many.

Work on the red points pays off even without AI: a leading source helps sales immediately, maintained rights protect personnel files today, and maintained personal data also gives your data protection officer a better starting position (questions 5 and 6).

What changes on Monday morning

Schedule the meeting. Block an hour this week with management, the business unit and the person who looks after your IT.

Define the use case beforehand. Send a sentence along with the invitation, following the pattern from question 1, for example: "Inside sales receives a draft reply to requests for quotes for spare parts, with price and delivery time from the price list and the ERP." If you go into the meeting with "AI for sales", you will spend an hour discussing principles.

Name owners during the meeting. Every amber or red light gets a person and a date: someone who, by the next meeting, clarifies which source leads or who checks the rights.

By the end of the week you will have one page with eight traffic lights and a decision: start the pilot or clean up first. Either takes you further than the next tool demo. How a successful pilot then moves into operation is covered in the handover from pilot to routine operation.

If you would like support with the first pass or a second opinion on your own traffic lights, our offering for this is the AI Operations Diagnostic. The checklist also works without us.

Frequently asked questions

Do we need our own BI or data team? No. The focus questions are organisational questions that can be settled with the people who already work with the data today.

How long does it take to clear up the red points? Missing ownership is often settled in one meeting; unmaintained rights or archives of scans can become a project of their own.

Can we choose a model and clean up the data on the side? That's risky. The AI works with the state of things at launch, including overly generous rights (question 5) and contradictory sources (question 4).

Who is responsible for the quality of the answers? The business side. For each use case, one person from the business unit maintains the test catalogue and approves new versions.

Sources

This article describes our practical perspective. It does not contain a legal assessment; for that, we refer you to the linked primary sources, your data protection officer and your legal counsel.

• Bitkom: press release on AI use in companies (in German), 15 September 2025
• Microsoft Learn: Microsoft Copilot data protection architecture
• Google Cloud Blog: article on optimising and evaluating RAG systems, 19 December 2024
• Regulation (EU) 2016/679 (GDPR), Article 5