Here's a pattern from the readiness work that surprises leadership teams every time: the companies most excited about AI are often least ready for it — and the blocker is almost never ambition, budget, or even data science. It's the IT foundation underneath. AI initiatives inherit every weakness in the stack they stand on, and they inherit it on day one.
Three foundations AI quietly depends on
Identity. Every AI tool you sanction authenticates against your identity system and inherits its permissions. If your environment has shared logins, ghost accounts from departed employees, and inconsistent MFA, then an AI assistant with access to "what the user can see" can see far too much — and so can anyone who compromises that account. Clean identity isn't an AI feature; it's the precondition for giving software agency safely.
Data hygiene. The most valuable AI use cases in the mid-market — searching twenty years of job files, drafting from past proposals, answering from your own documents — are only as good as the corpus they read. If your file storage is a sediment of duplicates, misfiled folders, and departed-employee archives with no ownership, AI doesn't fix that; it surfaces it, confidently and at scale. Retrieval over garbage is garbage with citations.
Platform governance. Microsoft 365 is where most mid-market AI actually lives — Copilot, sharing permissions, the audit trail. A tenant that grew organically for a decade, with sprawling permissions and default settings nobody revisited, turns every AI feature into a permission-amplifier. Copilot famously "already has access to everything the user does" — which is exactly the problem when what the user has access to was never deliberate.
Why this shows up in readiness scores
When we score AI readiness across six dimensions, technology and data are where well-intentioned companies most often stall — and both are IT-foundation dimensions, not AI dimensions. (You can pressure-test yourselves with the six-dimension self-check in one leadership meeting.) The encouraging inverse: companies coming from a well-run managed IT environment start with those dimensions already scored — the identity is clean because offboarding is a process, the tenant is governed because someone owns it, and the documentation exists because the system produces it. Their AI conversation starts at "which use case first" instead of "why is this harder than the demo."
The sequencing this implies
If AI is on your roadmap for the next eighteen months, the cheapest acceleration available is unglamorous: fix identity, rationalize the file corpus that matters, and govern the M365 tenant deliberately — before the pilot, not during the incident review. That's ordinary managed IT work with an extraordinary payoff, which is why our Managed IT practice and our AI readiness assessments are one firm rather than two vendors pointing at each other: the floor and the thing standing on it should have the same accountable owner.