Guides / GUIDE-003

Data readiness check: is your data ready for AI?

A structured check of data inventory, quality, access rights and preparation effort before you commit to an AI use case.

Most AI projects in the Mittelstand do not fail because of the model. They fail because the data is missing, scattered, wrong, or legally off-limits. This guide gives you a two-to-four-week check that ends with a clear answer per use case (ready, ready after clean-up, or not ready) and a realistic estimate of the preparation effort.

Why it matters

  • Data quality is the main obstacle, and has been for years. In a survey of 111 companies by the Mittelstand 4.0 competence centre Dortmund, 76% named insufficient data quality as an obstacle to getting value from data, and 78% named uncoordinated strategies [1]. The Mittelstand-Digital guide on AI readiness for construction lists the availability and quality of industry-specific data as a readiness factor, and data quality as a technological hurdle [2].
  • Preparing the data is usually the biggest single work package. Cleaning master data, converting PDFs into usable text, labelling examples and fixing permissions often takes more time than configuring the AI tool. That is why the use-case catalogue has a data_prep_effort field. If you skip this step, the budget overruns show up later, in the pilot.
  • Bad permissions turn into data leaks. Assistants such as Microsoft 365 Copilot ground their answers in "the data users already have permission to access" [3]. A file share that is open to "Everyone" was a theoretical risk before. Once an AI can search it in seconds, staff will actually find the salary list. Microsoft's own deployment blueprint therefore starts with "remediate oversharing" [3].
  • Regulators expect documented data quality. For high-risk AI the AI Act requires relevant, representative and largely error-free training data (Annex III duties apply from 2 Dec 2027 after the Digital Omnibus). The BSI's QUAIDAL series turns these abstract requirements into concrete quality criteria, measures and metrics [4][5]. Even if you are not in the high-risk category, it is a useful checklist.

When you need it

  • Right after you prioritise use cases (GUIDE-001): run a quick check (half a day per use case) before you rank anything as a "quick win".
  • Before you choose the implementation path (GUIDE-002): data sensitivity and data location decide between a SaaS tool, an EU cloud service or self-hosting.
  • Before you roll out a general assistant (Copilot, ChatGPT Enterprise, an internal RAG chatbot): permission clean-up is mandatory, not optional.
  • Before a pilot (GUIDE-009): the detailed check produces the test data set and the baseline.
  • Again before go-live and then yearly, because data drifts and permissions creep.

Who is involved

Role Part in the check
Department lead (process owner) Defines what "good enough" means; names the data that is really used in the process
Data owners (ERP, CRM, DMS, file shares, machine data) Say where the data is, who maintains it, known gaps and workarounds
End users / clerks Know the shadow Excel lists, the free-text abuse and the "we always fix that by hand" problems. Ask them, because they know things no data dictionary records
IT Exports, interfaces, access rights, storage, effort estimate
IT security Classification, oversharing, logging (see GUIDE-013)
DPO Personal data, legal basis, purpose change, DPIA trigger (see GUIDE-005)
Works council If employee data or user activity logs are involved, inform it early (§90(1) no. 3 BetrVG; see GUIDE-004)
Management Decides on budget for clean-up versus dropping or postponing the use case

Step by step

1. Fix the question per use case (1 hour each). Write down the target in one sentence and the data it needs. Example: "Order entry from e-mail PDFs into the ERP needs: incoming orders of the last 12 months, the customer and article master, and price lists."

2. Build a data inventory (2–5 days). One spreadsheet row per data source: system / location, owner, content, format (database table, Excel, PDF scan, e-mail, sensor log), volume, time span, update frequency, export path (API, CSV, DATEV export, manual), contains personal data (yes/no/special categories), confidentiality class, and known problems. Include the unofficial sources too: personal Excel files, Outlook folders, paper binders. In SMBs these are often the actual system of record.

3. Check quality with samples, not opinions (2–5 days). Take 50–200 random records per source and measure: - Completeness: share of empty mandatory fields (e.g. missing material numbers, empty "reason" fields in tickets). - Correctness: share of records a specialist marks as wrong. - Consistency and duplicates: the same customer under three spellings, units mixed (kg/t), different article keys in ERP and webshop. - Timeliness: how old is the data actually used? Are outdated document versions still lying around? - Representativeness: does the sample cover all products, sites, seasons and edge cases, or only the easy 80%? - For documents: machine-readable text or scanned image? Tables intact? Several versions of the same manual? Rate each criterion green/amber/red. The BSI QUAIDAL criteria [5] and the Mittelstand-Digital self-checks [2] give you vocabulary and indicators if you want more depth.

4. Check access rights and legal usability (1–3 days, with DPO). - Technical access: who can currently read what? Look for shares and SharePoint/Teams sites open to the whole company, guest links, and orphaned sites. Microsoft provides data access governance reports and restriction policies for this [3][6]. - Legal basis and purpose: was the personal data collected for this purpose? If not, is the new use compatible (Art. 6(4) GDPR), or do you need a new legal basis or anonymisation? The DSK guidance on AI and data protection lists the points to check when selecting and using AI tools [7]. - Contractual rights: customer drawings, supplier price lists or licensed standards may not be usable for AI under your contracts. For machine and product data, the EU Data Act has applied since 12 September 2025 and gives users of connected products the right to access the data those products generate [8]. That can make machine data from your own equipment usable in the first place. - Sensitivity: decide what may go to a cloud model and what must stay internal (input for GUIDE-002 and GUIDE-007).

5. Estimate the preparation effort (1 day). For each use case, list the clean-up tasks and estimate them in person-days. Typical tasks: deduplicating customer/article master data, OCR and parsing of PDF archives, removing outdated document versions, defining field rules, labelling 200–1,000 examples for classification or extraction, building an export or interface, anonymising or redacting, and fixing permissions. Many of these are small automations in their own right, for example a scheduled script that flags duplicates or an AI extraction step that turns scans into tables (see DATA-003, DOC-014, DOC-018). Classify the result as low/medium/high to match the catalogue's data_prep_effort.

6. Decide per use case (workshop, 2 hours). Use three outcomes: - Ready: start the pilot. - Ready after clean-up: pilot only with a funded clean-up package, an owner and a date. - Not ready: park it, or start the data collection now (e.g. start capturing the "reason" field properly) so that the use case becomes possible in 6–12 months. Also record the baseline figures (error rate, processing time) you will compare the pilot against.

7. Make it stick. Assign a data owner per source, fix the field rules at the point of entry, put a simple quality indicator on a monthly dashboard (see DATA-008), and include a permission review in your yearly IT routine. Data preparation is an ongoing task, not a one-off project.

Realistic total effort for an SMB with 50–250 staff: 5–15 person-days for the check of 3–5 use cases. The clean-up itself is planned separately and is often several times that.

Checklist

  • [ ] Target and required data written down per use case
  • [ ] Data inventory incl. shadow Excel files and paper sources
  • [ ] Data owner named per source
  • [ ] Sample-based quality rating (completeness, correctness, duplicates, timeliness, representativeness)
  • [ ] Documents checked: text vs. scan, versions, duplicates
  • [ ] Oversharing check of file shares, SharePoint/Teams, guest links done
  • [ ] Personal data identified; legal basis and purpose compatibility checked with the DPO
  • [ ] DPIA need assessed (GUIDE-005)
  • [ ] Contract and licence restrictions on data checked
  • [ ] Cloud/no-cloud classification per data source
  • [ ] Preparation effort estimated in person-days; low/medium/high assigned
  • [ ] Decision ready / after clean-up / not ready, with owner and date
  • [ ] Baseline metrics recorded for the pilot
  • [ ] Works council informed if employee data or activity logs are involved

Templates & tools

  • Mittelstand-Digital self-checks: the "Fachcheck KI-Readiness" (Mittelstand-Digital Zentrum Chemnitz), the KI-Readiness-Check of the WERNER network / Mittelstand-Digital Zentrum Kaiserslautern and the KI-Readiness-Check of the KARL competence centre are listed free of charge in the construction guide [2]. They are useful beyond construction.
  • BSI QUAIDAL (parts A–D): criteria, building blocks and a catalogue of measures and metrics for training data quality [4][5].
  • DSK guidance "Künstliche Intelligenz und Datenschutz" (May 2024): checklist for selecting and using AI applications [7].
  • Microsoft "Secure & governed data foundation for Copilot" blueprint and SharePoint Advanced Management: oversharing reports and access restriction policies [3][6]. Comparable functions exist in Google Workspace and most DMS products.
  • EU Data Act FAQ and model contract terms for access to machine data [8].
  • Simple tooling: a shared spreadsheet for the inventory; Excel/Power Query or OpenRefine for duplicate and completeness checks. Use an AI spreadsheet assistant only on data that is approved for it.

Common pitfalls

  • "We have lots of data." Volume is not readiness. Check whether the field you need is actually filled in, and filled in consistently.
  • Only IT fills in the inventory. That misses the Excel lists and the workarounds. Interview the clerks.
  • Clean-up is promised but not budgeted. If it is not in the pilot budget, it will not happen. Put it into the go/no-go criteria (GUIDE-009).
  • Rolling out an assistant on top of chaotic permissions. Clean up first, or restrict the assistant to curated sources.
  • Cleaning everything. Clean only what the prioritised use cases need. A full master-data project can come later.
  • Ignoring the purpose question. Personal data collected for invoicing cannot automatically be used for behaviour analysis. Involve the DPO before extraction, not after.
  • One-off clean-up. Without rules at the point of data entry, quality is back to where it was within months.
  • Overlooking the people who create the data. If staff are to fill in fields more carefully, explain why and what changes for them (GUIDE-008).

Sources

  1. Mittelstand 4.0-Kompetenzzentrum Dortmund / Digital in NRW: "Mehrwerte aus Daten" (Feb 2019, survey n=111). https://www.mittelstand-digital.de/MD/Redaktion/DE/Publikationen/mehrwerte-aus-daten.pdf?__blob=publicationFile&v=2
  2. Mittelstand-Digital Zentrum: "KI-Readiness im Bauwesen: Daten nutzen, Prozesse optimieren, Zukunft gestalten". https://www.mittelstand-digital.de/MD/Redaktion/DE/Publikationen/ki-readiness-bau.pdf?__blob=publicationFile&v=2
  3. Microsoft Learn: "Secure & Governed Data Foundation for Microsoft Copilot – Foundational Deployment Guidance". https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-blueprint-oversharing
  4. BSI press release, 1 Jul 2025: "BSI stellt methodischen Leitfaden zur Datenqualität in KI-Systemen vor" (QUAIDAL). https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2025/250701_QUAIDAL.html
  5. BSI: QUAIDAL-02 "Qualitätskriterien & Bausteine". https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/KI/QUAIDAL_B_Qualitaetskriterien.pdf
  6. Microsoft Learn: "Get ready for Copilot with SharePoint Advanced Management". https://learn.microsoft.com/sharepoint/get-ready-copilot-sharepoint-advanced-management
  7. Datenschutzkonferenz (DSK): Orientierungshilfe "Künstliche Intelligenz und Datenschutz" (6 May 2024). https://www.datenschutz-bayern.de/dsbk-ent/DSK_OH_KI_und_Datenschutz.pdf
  8. European Commission: "Data Act" policy page and "Data Act explained". https://digital-strategy.ec.europa.eu/en/policies/data-act

Accessed 2026-10.