The First 30 Days of an AI Audit

Why you haven’t started yet

You’ve been thinking about AI for months. Maybe a year. You haven’t started because you don’t know where to begin.

That’s not a failure of leadership. It’s a reasonable response to a high-stakes decision with incomplete information.

An audit replaces incomplete information with a complete picture. Two weeks. You go from “I think we should do something” to “here’s exactly what to do, what it costs, and what to fix first.”

This article is a transparent walkthrough of what happens. Use it as a checklist to evaluate any AI consultant - including me.

Week 1: Discovery - What you have

Days 1-2: Business objective

Not “we want AI” - what specific outcome? Who benefits? What does it cost you today?

I sit down with you and your team and ask: What’s the problem? Not the AI problem - the business problem. What are you spending time on that you shouldn’t be? What decisions are you making without enough information? What process is breaking?

By the end of day 2, we have a one-sentence problem statement with a number attached. “We spend 200 person-hours/month reviewing invoices at €40/hour = €96K/year.” That’s your baseline.

Days 3-4: Data inventory

Where does your data live? What systems? What formats? How clean? Who owns it? How often does it change?

I don’t ask for summaries. I ask for access. I look at actual records, actual schemas, actual data. Summaries hide problems. Real data reveals them.

By the end of day 4, I have a map of your data landscape: where it lives, what shape it’s in, and whether it’s usable for AI.

Day 5: Team assessment

What can your team build? What can they maintain? Where’s the gap?

I talk to your engineers, data people, and product owners. Not to evaluate them - to understand what they can own after the consultant leaves.

By the end of week 1, I present a map of your current state. We validate it together. If I’ve misunderstood something, we fix it now. You see what I see. No black box. No “trust me.” You’re in the room.

Week 2: Deep dive - What’s possible

Days 8-9: Data quality

I look at actual records. Not summaries - real data. How complete? How consistent? How stale? Are there duplicates? Missing fields? Encoding errors?

I run automated checks: completeness percentages, uniqueness, format consistency, cross-system alignment. I also manually sample records to catch things automated checks miss.

This is where most audits discover the gap between “our data is fine” and reality. It’s always wider than expected. That’s not a problem - it’s valuable information. Knowing your data needs work before you build on it saves you from building on sand.

Days 10-11: Infrastructure review

Can your architecture support AI? What’s missing?

I review your servers, databases, APIs, CI/CD pipelines, monitoring tools, security setup. I look for gaps: no data pipeline, no monitoring, no staging environment, no access controls.

By the end of day 11, I know what infrastructure you need to build versus what you already have. This directly affects your cost estimate.

Day 12: Process mapping

Where are the bottlenecks? Where could AI fit? Where would it break things?

I walk through the actual workflow with the people who do it. Not the documented process - the real one. The one with workarounds, shortcuts, and “we don’t actually do it that way” moments.

This tells me not just where AI could help, but where it would fail. Some processes look automatable but have human judgment embedded in ways that aren’t obvious. Better to find out now than after deployment.

Days 13-14: Risk and compliance scan

EU AI Act classification. GDPR implications. Security posture.

What risk category does your proposed AI use case fall into? What documentation do you need? What security requirements apply? Are there GDPR issues with the data you plan to use?

By the end of week 2, I have a complete picture. You have a complete picture. We’re looking at the same information.

The deliverable: What you walk away with

• Data health score: Ready, needs work, or not ready. With specific issues listed.
• AI reality check: What’s practical for your situation, not what’s theoretically possible. I tell you what you can build, what you can’t, and what you shouldn’t.
• Priority-ordered roadmap: What to fix first, what to build first, what to defer. Ordered by value × feasibility.
• Cost estimate: A range, not a quote. Enough to know your tier (API, RAG, or custom) and budget accordingly.
• Build-vs-buy recommendation: Should you build custom, use an API, or buy a platform? With reasoning.
• Compliance assessment: Your EU AI Act risk category and what documentation you need.
• 90-day action plan: Concrete next steps. Not a strategy document - a task list.

You own this document. You can take it to another vendor. You can show it to your board. You can decide not to build. It’s yours.

What an audit is NOT

Not a sales pitch. I’ve turned down projects. Sometimes the answer is “your data isn’t ready” or “this problem doesn’t justify AI.” If I tell you not to build, that’s the audit working.

Not a 20-question quiz. Those online “AI readiness quizzes” are marketing tools designed to generate leads. They don’t look at your data. They don’t assess your team. They score you on answers to generic questions.

Not a strategy deck. You get findings, not slides. A document you can act on, not a presentation you nod along to and forget.

Not free. Real work takes two weeks. Free audits are sales calls - they’re designed to sell you a project, not to diagnose your situation.

What happens after

You make a decision. Three options:

1. Build with us. The audit becomes the first sprint. Nothing wasted. We already know your data, your infrastructure, and your team.
2. Build with someone else. The audit is yours. Take it to any vendor. They’ll have a two-week head start.
3. Don’t build. You’ve spent a fraction of what a failed project costs - and you know exactly why you’re not building. That’s not failure. That’s informed decision-making.

No lock-in. No dependency. You have the information. You make the call.

How to evaluate an AI auditor

Use these criteria for anyone - including me:

• Do they look at your actual data, or just ask you to describe it?
• Do they assess your team’s capability, or assume they’ll do all the work?
• Do they tell you what NOT to build, or only what to build?
• Do they give you a cost range, or say “it depends”?
• Do they leave you with a document you own, or hold findings hostage?

If the answers are vague, the audit will be vague too.

FAQ

Cost? Less than a failed pilot. Contact for a quote - the cost depends on your data landscape and number of systems.

What do you need from us? System access (read-only for most systems), 3-5 hours of interviews with key people, and honesty. The audit is only as good as the information you share.

Can we build with someone else after the audit? Yes. The audit is yours. No exclusivity, no lock-in. I’ve had clients take the audit to other vendors. I’ve also had clients come back after realizing the other vendor couldn’t answer the questions the audit raised.