Skip to content
NTPU AI Learn

IL 202 · Module 4

Readiness Review

Assemble evidence, gaps, owners, and deadlines across the seven domains into a complete Enterprise AI Readiness Review.

Start Section 1
  • Duration180 min
  • LevelAdvanced
  • PrerequisiteModules 1-3 (data inventory, access matrix, incident drills) completed
0 / 4 completed

Learning objectives

  • Mark a status for each of the seven readiness domains, backed by evidence.
  • Turn every gap into a concrete remediation condition with an owner and a deadline.
  • Read a complete Readiness Review example and find the error deliberately left in it.

Seven domains, four statuses

60 min

Seven domains, four statuses, four final recommendations

The Readiness Review pulls together Modules 1-3's output (the data inventory and flow map, access matrix and integration test log, incident drills and runbook) into a status judgment across seven domains, so a sponsor or governance reviewer can see at a glance whether this project is ready for a pilot.

The seven readiness domains and where their evidence comes from
DomainPrimary evidence source
Data readinessModule 1 data inventory, data-flow map
Security readinessModule 2 least-privilege matrix, revocation drill
Privacy readinessModule 1 data classification, Module 2 access scope
Integration readinessModule 2 integration test log
Governance readinessThe approved charter, decision-rights record
Operations readinessModule 3 incident drills, runbook
People readinessUser training and buy-in, Module 3 drill participation
The four statuses
StatusMeaning
readySufficient evidence exists for this domain, with no known gap
conditionalCan proceed to the next stage under conditions, each with an owner and a deadline, and none of which may block the currently approved pilot scope
not_readyA blocking gap exists; the project cannot enter a pilot until it is closed
not_applicableThis domain does not apply to the project; requires a stated reason and reviewer approval, and cannot be used to sidestep unfinished work

Warning

Common mistake: marking "we have not had time yet" as not_applicable. not_applicable only fits a domain that genuinely does not apply (for example, privacy readiness might be not_applicable only when the project truly never touches personal data), and even then it requires a reviewer's explicit approval of that judgment.

Key takeaway: Each of the seven domains is judged independently; if even one is not_ready with a blocking gap, the whole project cannot enter a pilot.

Gaps, owners, and deadlines

60 min

Turn gaps into trackable remediation conditions

A gap without a clear owner, deadline, and closure evidence is just a complaint, not a trackable condition. A conditional status must carry all three, or it does not qualify as 'ready with conditions.'

Required Readiness Item fields
FieldWhat it covers
DomainOne of the seven domains
Statusready / conditional / not_ready / not_applicable
EvidenceA specific document or record from Modules 1-3
GapThe specific item not yet satisfied
Blocking?Whether it blocks the currently approved pilot scope
OwnerA named person or a specific role
Due dateA concrete date, not "soon"
ApproverThe reviewer who confirms this condition is acceptable

Not adequate gap description

Security readiness: conditional. Gap: permissions need to be double-checked at some point.

Adequate gap description

Domain and status
Security readiness: conditional (not blocking; a limited-scope trial may proceed under this condition).
Gap
The AI tool's API-key revocation delay did not pass the drill (see Module 2's revocation drill); it needs to move to real-time revocation.
Owner and due date
The technical administrator (a synthetic named role), completed and re-drilled by 2026-03-15.
Approver
The security owner has approved proceeding to a limited-scope trial under this condition.

Info

A blocking gap that is not closed means the project cannot enter a pilot. Conditional may only be used for residual conditions that do not block the currently approved trial scope, and must carry a due date and a remediation owner. An earlier screening in IL 101 or IL 201 does not substitute for this full Readiness Review.

Key takeaway: A gap with no owner and no deadline cannot be marked conditional; it can only be not_ready.

Full example: find the error

60 min

Full example (SYN-CS-001): find the error left in on purpose

Below is a draft Readiness Review for Demo Service Company A's customer-service knowledge assistant (SYN-CS-001), with one common error deliberately left in. Try to spot the problem yourself before reading the correction below.

Draft Readiness Review (with a deliberate error)
DomainStatusEvidence/Gap
Data readinessreadyData inventory and flow map complete; outdated/conflicting documents flagged and excluded from auto-reply scope.
Security readinessconditionalAPI-key revocation delay gap; technical administrator to close by 3/15, approved by the security owner.
Privacy readinessnot_applicableThis project does not handle customer personal data. Reason: customer-service cases only concern product questions, not personal data.
Integration readinessreadyRead-only integration testing passed; no write access needed.
Governance readinessreadyCharter and decision rights approved.
Operations readinessreadyThree incident scenarios drilled and runbook completed.
People readinessreadyCustomer-service staff have completed training.
Final recommendationProceed with ConditionsFull trial once the security-readiness condition is closed.

Warning

Found it? "Privacy readiness: not_applicable, reason: cases only concern product questions, not personal data": but a case record itself usually contains identifying information like the customer's name, contact details, or account number, even when the question is about a product. Mistaking "the case topic is not personal data" for "the case does not contain personal data" is a common privacy-readiness misjudgment.

Erroneous version

Privacy readiness: not_applicable. Reason: customer-service cases only concern product questions, not personal data.

Corrected version

Reclassification
Privacy readiness: conditional (not not_applicable). Cases likely do contain personal data such as the customer's name or contact details, even when the topic is a product question.
Gap
Not yet confirmed whether the AI tool writes personal data into drafts or sends it to an external service; the data-flow map needs personal-data tagging.
Owner and due date
The privacy owner, tagging and re-assessment completed by 2026-03-20.
Approver
The governance owner confirms whether Proceed with Conditions still holds after the privacy owner's reassessment.

Info

This correction is itself the course's required 'one fully worked example with at least one deliberate error and a correction note' (see the IL 202 material contract). When practicing on your own project, check whether your Readiness Review draft makes the same mistake of treating 'the topic is not personal data' as 'the case contains no personal data.'
Check yourself

In the example, what is the main error in the judgment "Privacy readiness: not_applicable, reason: cases only concern product questions"?

In the example, what is the main error in the judgment "Privacy readiness: not_applicable, reason: cases only concern product questions"?

Key takeaway: The easiest privacy gap to miss usually hides inside the assumption that "the case topic sounds unsensitive." Privacy readiness is about the data itself, not the surface topic of the case.

Assessment & Evidence

15 min

Assessment & Evidence

After completing all four modules, you submit a complete Enterprise AI Readiness Review on the platform: a status and supporting evidence for each of the seven domains (data, security, privacy, integration, governance, operations, people), plus one final recommendation. The status itself is your own self-assessment, which a teacher will confirm or override for each domain.

Info

This is not a weighted-score test. IL 202 has no percentage weight table the way IL 101 / IL 201 do; the teacher's review judges whether each domain's status is backed by real evidence and whether the final recommendation is sound, a judgment call, not an addition of points. Honestly disclosing a not_ready domain matters more than inflating the picture to look good: surfacing an honest gap is the entire point of this review.
  • What you need to do: submit a Readiness Review covering status and evidence for all seven domains, plus a final recommendation
  • How you are assessed: a teacher confirms or overrides each of your seven domain statuses, and judges whether the final recommendation is adequately justified
  • Pass condition: no domain is confirmed NOT_READY, AND the final recommendation is confirmed as justified (both must hold)
  • Evidence of practice: a passed review records evidence for the il202.readiness-review competency, backing the Enterprise AI Readiness Review skill certificate

Warning

A passed review does not mean your project is "approved to go live" or "no longer needs governance review": it means this Readiness Review's own quality and honesty were confirmed by a teacher. Whether the project actually proceeds to a pilot is still decided by your organization's own governance process.

Key takeaway: The teacher confirms the quality of your seven domain-status judgments and whether the final recommendation is sound, not a point total. Honestly surfacing gaps matters more than making every domain look ready.

Save as PDF

What next?