🛡️ Audit: readiness, data, and risk

A structured assessment of an organization’s capacity to adopt and operate AI effectively. It’s not an enthusiasm test—it’s a diagnosis of infrastructure, data, people, processes, and governance.

Without it, you prescribe AI for soil that isn’t ready. The project fails, and the technology gets the blame—when the problem was readiness.

Readiness ≠ enthusiasm; 5 measurable dimensions; radar chart as a conversation tool.

The most critical dimension. It assesses whether the data exists, whether it is high quality (complete, consistent, up to date, unbiased), whether it is accessible, and whether it complies with privacy requirements and LGPD.

AI models are only as good as the input data. Bad data, bad AI — no matter which model you choose.

GIGO (garbage in, garbage out); completeness, consistency, currency; LGPD as a requirement.

Assesses whether the infrastructure supports AI: available APIs, processing capacity, integration between systems, and whether the current stack can connect data to models.

A good AI idea can be blocked by legacy systems without an API or by siloed databases that no one can connect.

Current stack; APIs and integrations; legacy systems as a risk; cloud vs. on-premise.

Assesses the team’s AI literacy, cultural openness to change, and whether there are internal leaders able to sustain adoption after the consultant leaves.

The best technical solution fails if the team doesn’t adopt it. A culture resistant to AI is as real a constraint as a lack of data.

AI literacy; internal champions; resistance to change; change management.

Processes: are workflows documented and ready to integrate AI? Governance: are there AI use policies, designated owners, and the ability to monitor risks?

Without a documented process, AI enters chaos and amplifies it. Without governance, the organization operates in the hope that nothing goes wrong.

Process as a prerequisite; responsible AI use policy; person responsible for AI (CAIO).

Each dimension gets a score from 0 to 5. The visual radar makes the gaps obvious to the client—and shows where to focus before any implementation.

The radar shifts the conversation from “let’s implement AI” to “see where you are today — and what we need to address first.”

Score by dimension; radar chart as an alignment artifact; priority gap = highest return.

Frameworks that describe progressive stages of organizational AI capability—from no structure (ad hoc) to AI integrated as a competitive advantage (transformational).

They let you position the organization without judgment and communicate the next step concretely, instead of using abstractions about "digital maturity".

Current stage ≠ failure; next level = achievable goal; model as shared vocabulary.

Ad hoc: isolated experiments, no vision, no structured data. Aware: leadership recognizes the importance of AI, but there’s still no dedicated strategy or budget.

Most Brazilian SMBs are here. Recognizing this stage helps avoid prescribing level 4 roadmaps to level 1 organizations—a sure recipe for failure.

Isolated pilots; no historical data; curious leadership without commitment.

The organization has AI projects running, structured data, a dedicated or contracted technical team, and measurable results from its first use cases.

It’s where the consultant can make the biggest immediate impact—expanding what already works to other processes and building governance before it scales.

First wins documented; expansion by priority; foundation for scaling with control.

Operational: AI integrated into multiple processes, with MLOps, continuous monitoring, and KPIs. Transformational: AI as a central competitive advantage, enabling new business models.

These are the stages that require a specialized internal team and formal governance—the external consultant contributes but can’t be the sole support.

MLOps; AI KPIs; new business model; self-sustainability after the consultant.

The temptation to jump from level 1 to level 4 out of enthusiasm — or under pressure from leadership that wants “transformational AI” without building the foundation. Projects that skip stages almost always get stuck.

A consultant who enables the leap shares responsibility for the failure. The honest recommendation is to sequence, not rush.

Stages aren’t optional; a weak foundation collapses; sustainable speed > maximum speed.

The maturity model feeds directly into the roadmap: the next step is to advance one level, not three. Each recommendation is anchored in the organization’s current stage.

Connects the diagnosis to the prescription — gives the client a clear and realistic path instead of a vision of "where we'd like to be".

Next level as a goal; sequenced roadmap; measurable advancement criteria.

Map all of the organization's data repositories: databases, spreadsheets, ERP systems, CRM, unstructured files, emails, and documents. Without an inventory, you don't know what you're working with.

Companies often underestimate their data—and discover during the inventory that they have more (or less) than they thought. The inventory defines the project’s actual scope.

Structured vs. unstructured data; data catalog; data silos; shadow IT.

Completeness (filled-in fields), consistency (same format and standard), currency (data is not outdated), and bias (underrepresentation of groups that skews results). The 4 dimensions that determine whether data is "trainable".

A model trained on biased data reproduces and amplifies that bias. Out-of-date data produces useless predictions. A quality audit protects against these risks.

Data quality score; completeness %; freshness; bias detection; representative sampling.

Assess whether the data can be accessed by the systems that will feed the AI: APIs, connectors, access permissions, and whether legacy systems allow reliable export.

Even the highest-quality data in a system without an API is inaccessible to AI. Integration is what turns data into fuel.

API-first; ETL/ELT; data pipeline; permissions and roles; integration vs. manual export.

Verify that the personal data collected has a legal basis, that consent is obtained where necessary, and that its use in AI models doesn't violate data subject rights — especially in RAG with internal documents.

Using customer data in AI models without a legal basis exposes the company to the ANPD. A consultant who ignores the LGPD is delivering a risk, not a solution.

Legal basis; data minimization; RAG and personal data; DPO; compliance before the project.

RAG requires organized, chunked, indexable documents. Fine-tuning requires many consistent, high-quality examples (input/output). The audit determines which approach is feasible.

Proposing fine-tuning for a company with no labeled data wastes budget. The available data determines the technique, not the other way around.

RAG vs. fine-tuning vs. few-shot; chunking; embeddings; labeled data as an asset.

The audit’s final deliverable: a report with a score for each data quality dimension, a list of critical issues, remediation recommendations, and a readiness statement for each use case.

It’s the artifact that objectively justifies “fix the data first”—and protects the consultant from being held accountable for AI results based on poor data.

Data health score; critical vs. manageable issues; readiness by use case; remediation plan.

NIST’s AI Risk Management Framework organizes risk management into 4 functions: GOVERN (policies and culture), MAP (identify risks by context), MEASURE (assess impacts), MANAGE (address and monitor).

The RMF is the framework most widely adopted by organizations that need vocabulary and structure for AI governance — and it serves as the basis for any internal policy.

GOVERN → MAP → MEASURE → MANAGE; contextual risks; continuous management cycle.

ISO/IEC 42001 is the first international AI management system (AIMS) standard. Based on the PDCA cycle (Plan-Do-Check-Act), it sets requirements for organizations to develop, deploy, and use AI responsibly.

Clients with certification requirements or vendor audits will ask for compliance with 42001. A consultant familiar with the standard can guide them through the compliance journey.

AIMS; PDCA applied to AI; certification; compliance audit; documented AI policy.

The EU AI Act classifies AI uses into 4 categories: unacceptable (prohibited — e.g., social scoring), high risk (healthcare, credit, employment — requires strict compliance), limited (chatbots — requires transparency), and minimal (spam filters — no special requirements).

Even Brazilian companies that operate with data from European citizens are subject to the AI Act. And the classification framework is useful even for internal governance without a legal obligation.

4 risk classes; prohibited vs. obligations vs. transparency; extraterritorial scope; classify before deployment.

The 5 fundamental risks: bias (discrimination from biased data), hallucination (incorrect outputs presented with confidence), security (data leakage via prompt injection), privacy (personal data in prompts), and reputation (public harm caused by an AI failure).

Without mapping these risks before the project, the consultant delivers a ticking time bomb. Identifying and mitigating risks is part of the minimum professional scope.

Risk map by use case; proportional mitigation; residual risk accepted by leadership.

An internal FAQ chatbot requires less governance than credit AI. The recommended structure should be proportional to the level of risk and the size of the organization—neither excessive bureaucracy nor naivety.

An SMB with a customer service chatbot doesn’t need an ethics committee like a bank’s. Proportionality is what makes governance practical and widely adopted.

Risk × control; light governance for low risk; controls scale with impact.

Well-designed governance accelerates adoption: clear policies reduce decision time, risk mapping builds confidence to expand, and continuous monitoring catches problems early—before they become crises.

A consultant who presents governance as "protection that enables" sells much better than one who presents it as "mandatory compliance."

Operational trust; early detection; policy as an accelerator; governance as an advantage.