What are the 15 readiness questions?

1. Have you defined exactly which calls and actions belong in the first workflow?

A — 0 points: We want the agent to answer everything or replace reception generally.
B — 1 point: We have named a task, but exclusions and action limits remain unclear.
C — 2 points: We have approved eligible calls, allowed actions, operating hours and explicit exclusions, including safety-critical requests.
D — 3 points: Operations and frontline staff have walked through realistic scenarios and confirmed where the agent must stop, decline or escalate.

Evidence to retain: A one-page scope statement with examples of included and excluded calls.

If you score 0–1: Narrow the proposal before comparing suppliers. “Book routine maintenance at one location” is a more assessable brief than “automate customer service”.

2. Can you demonstrate a measurable problem worth solving?

A — 0 points: We believe we miss calls or spend too much, but have no usable baseline.
B — 1 point: We have total call counts or anecdotal complaints, without reliable dispositions.
C — 2 points: We can identify eligible demand, current outcomes and handling costs by relevant hours or locations.
D — 3 points: We have reconciled a sample against operational records, separated duplicates and existing callback recovery, and checked capacity to fulfil additional work.

Evidence to retain: A representative baseline export, its coverage dates and known limitations.

If you score 0–1: Start with call disposition and outcome tracking. For missed-call recovery, assess unique eligible enquiries—not every unanswered ring as a lost job.

3. Can you prove that the requested task actually finished correctly?

A — 0 points: Success means the call was answered or did not reach a person.
B — 1 point: We rely on the agent’s summary or a supplier-generated “successful” label.
C — 2 points: We have defined the required system record, policy checks and deduplication rule for a successful outcome.
D — 3 points: An independent reviewer has reconciled sample calls with those records, distinguishing autonomous completion, human rescue and failure.

Evidence to retain: A call-to-outcome audit showing the correct customer, task and final system state.

Practical example: ServiceTitan documents transcript-based call classification separately from tagged job records. This distinction supports checking the job itself rather than accepting the call label as sufficient evidence. (help.servicetitan.com)

4. Are the operating rules written, consistent and owned?

A — 0 points: The agent will infer rules from conversations or general website content.
B — 1 point: Rules exist, but staff disagree or locations use conflicting versions.
C — 2 points: An owner has approved rules for availability, eligibility, pricing statements, cancellations and exceptions relevant to this workflow.
D — 3 points: Frontline staff have challenged the rules with difficult cases, resolved contradictions and assigned version control and change approval.

Evidence to retain: The approved policy source, location-specific variations and change owner.

If you score 0–1: Fix the process first. For dental scheduling, specify appointment type, duration, clinician and location restrictions; for home services, specify service area and job eligibility.

5. Have you tested system access, successful actions and recovery from failed actions?

A — 0 points: We do not know whether the necessary system access is available.
B — 1 point: A supplier lists the integration, but our account, permissions and exact workflow are unverified.
C — 2 points: Approved, limited access works in a test environment for normal requests, and results can be checked in the destination system.
D — 3 points: Tests also cover timeouts, retries, duplicate submissions, stale availability and partial failures; they demonstrate safe recovery without false confirmation or unintended writes.

Evidence to retain: Test inputs, tool responses, final records and recovery results. For read-only workflows, demonstrate blocked writes and appropriate handling of unavailable data.

Live-pilot gate: this question must score 3.

6. Can callers reach an appropriate human or a genuinely supported alternative?

A — 0 points: No fallback owner or service exists.
B — 1 point: A transfer number exists, but staffing and failure handling are uncertain.
C — 2 points: We have named owners, coverage hours, escalation triggers and an approved no-answer or callback process, but have not tested every route.
D — 3 points: We have tested answered, busy, unanswered and closed-hours routes, verified context delivery and checked that promised callbacks reach an owned queue with a fulfilment deadline.

Evidence to retain: A handoff runbook and dated end-to-end test results.

Retell’s documentation distinguishes cold, warm and agentic warm transfers. Therefore, specify the required handoff behaviour rather than treating “supports transfers” as an acceptance test. (docs.retellai.com)

Live-pilot gate: this question must score 3. An unstaffed queue is not human fallback. A callback is acceptable only where the approved workflow can safely wait.

7. Has a qualified reviewer assessed the actual calling and recording design?

A — 0 points: Nobody has reviewed the proposed calls or data capture.
B — 1 point: We rely on a general supplier statement that the service is compliant.
C — 2 points: A qualified reviewer has documented applicable requirements for call direction, purpose, jurisdictions, recording/transcription, disclosures, consent and opt-outs, and approved the proposed pilot controls.
D — 3 points: We have tested the applicable controls—including refusal, withdrawal or suppression scenarios—and can retrieve the supporting evidence.

Evidence to retain: A dated applicability assessment, approved scripts, control configuration and relevant permission records.

The FCC’s February 2024 ruling places AI-generated human voices within the TCPA’s artificial-or-prerecorded-voice restrictions. It is not a blanket ban on every AI call. Separately, the FTC describes written-agreement and automated opt-out requirements for covered prerecorded telemarketing calls, subject to applicable exceptions. (docs.fcc.gov)

Assessment rule: Treat an automated callback as an outbound component requiring review. Do not assume that describing the project as an “inbound receptionist” settles every communication it initiates.

8. Are data flows, retention and contractual responsibilities approved?

A — 0 points: We do not know which organisations receive audio, transcripts or customer data.
B — 1 point: We have a security badge or questionnaire, but material data-handling questions remain unresolved.
C — 2 points: Security/privacy reviewers have approved the data map, subprocessors, access, retention, deletion, training use and incident responsibilities, with required agreements executed for the actual services involved.
D — 3 points: We have checked the configuration against those commitments and verified relevant access, export and deletion procedures using suitable test data.

Evidence to retain: Data-flow diagram, configuration evidence, contractual terms and reviewer approval.

For HIPAA-regulated arrangements, HHS explains that a cloud provider creating, receiving, maintaining or transmitting electronic protected health information on a covered entity’s or business associate’s behalf is a business associate—even when it cannot decrypt the data. Applicable BAAs and other HIPAA requirements must be addressed. (hhs.gov)

For payment workflows, PCI SSC states that sensitive authentication data, including card verification codes, must not be stored after authorisation, even encrypted. Keep payment capture outside the initial scope unless a separately approved design addresses it. (pcisecuritystandards.org)

9. Are identity checks and action permissions enforced outside the conversation prompt?

A — 0 points: Caller assertions or caller ID alone unlock sensitive information or consequential actions.
B — 1 point: The prompt tells the agent to check identity, but tools do not enforce the relevant restrictions.
C — 2 points: The security owner has approved proportionate caller verification, limited system permissions and action-level authorisation checks.
D — 3 points: Tests show that cross-customer requests, impersonation attempts and requests to exceed authority are denied or safely escalated.

Evidence to retain: An action-permission matrix and negative test results. For public-information-only calls, document why verification is unnecessary and prove private records remain inaccessible.

NIST’s August 2026 identity guidance warns that model-only guardrails do not resolve agent security challenges and discusses overly broad access. The desk’s recommendation is to make the permitted action boundary enforceable by the connected systems. (nist.gov)

10. Has the configured agent passed representative and adversarial tests?

A — 0 points: We have watched a demonstration.
B — 1 point: Staff have tried a few straightforward calls.
C — 2 points: We have a documented test set covering the real call mix, difficult audio, exceptions and prohibited actions, but execution or remediation is incomplete.
D — 3 points: We have executed and repeated the tests, checked resulting records, met buyer-approved thresholds and closed all defects classified as launch-blocking.

Evidence to retain: Scenario, expected behaviour, observed behaviour, system state, severity, remediation and retest result.

Include interruptions, background noise, supported accents and languages, corrections, unavailable slots, silence, requests for a person and attempts to override instructions. These are the desk’s proposed test categories, not a universal certification suite.

NIST’s generative-AI profile explicitly addresses pre-deployment testing. Voice-agent research also examines authentication bypass, privacy leakage and privilege escalation, supporting the inclusion of adversarial—not merely cooperative—callers. (nvlpubs.nist.gov)

Live-pilot gate: this question must score 3. Passing a finite test set does not establish a zero failure rate.

11. Have you compared fully loaded economics with credible alternatives?

A — 0 points: We compare the advertised AI minute rate with an employee’s wage.
B — 1 point: We include usage and implementation, but omit significant support, monitoring or human follow-up.
C — 2 points: We model the full workflow cost, verified-outcome definition and at least one relevant alternative, such as better routing, staff coverage or an answering service.
D — 3 points: Finance has reviewed downside assumptions, fulfilment capacity and benefit attribution, and approved either the operating case or a capped learning budget.

Evidence to retain: A like-for-like cost model with quote dates, billing units, assumptions and sensitivities.

For example, Retell’s published pricing says telephony charges continue after transfer and that silence/hold time is billable. This is supplier-specific evidence for checking billing boundaries, not a market-wide price benchmark. (retellai.com)

12. Are accountable people and operating resources assigned?

A — 0 points: The project belongs to an enthusiast or supplier, without an accountable business owner.
B — 1 point: A sponsor exists, but quality review, incidents and frontline changes have no clear owners.
C — 2 points: Operations, technical, risk and frontline responsibilities are assigned, with funded time for review, exceptions and correction.
D — 3 points: Those people have rehearsed incident decisions, accepted their responsibilities and confirmed availability during pilot hours.

Evidence to retain: Named responsibility matrix, coverage schedule and allocated budget.

NIST’s framework explicitly calls for documented responsibilities and human oversight arrangements. A small business may combine roles, but the duties should still be explicit. (airc.nist.gov)

13. Can the pilot distinguish real improvement from attractive reporting?

A — 0 points: We will decide whether it seems useful after launch.
B — 1 point: We will track answered calls, containment or supplier-reported bookings only.
C — 2 points: We have agreed outcome definitions, denominators, observation windows, a comparison approach and numerical acceptance thresholds before launch.
D — 3 points: We have tested the measurement pipeline and independent review process, including human rescue, repeat contact, record errors, complaints and cost attribution.

Evidence to retain: A signed pilot measurement plan and a sample reconciled report.

Desk recommendation: Keep safety tests separate from commercial averages. Do not allow a high booking rate to cancel out an unauthorised disclosure. Report results by important call type, location and operating condition, not only as one overall average.

14. Can you detect trouble, stop the agent and restore service?

A — 0 points: We depend on customers or staff noticing problems.
B — 1 point: A dashboard exists, but alert ownership and stop authority are unclear.
C — 2 points: Monitoring, incident thresholds, stop authority, fallback routing and configuration-change procedures are documented.
D — 3 points: We have tested alerts, disabling the agent, rerouting calls, preserving evidence and reviewing affected records; changes trigger defined retesting.

Evidence to retain: A timed rollback rehearsal and incident runbook, including a telephony/provider outage scenario.

NIST includes incident response, recovery, override and change management within post-deployment monitoring. (airc.nist.gov)

Live-pilot gate: this question must score 3. Stopping new calls and repairing already-created records are separate responsibilities; test both where relevant.

15. Do the supplier terms preserve control over scope, spend and exit?

A — 0 points: We have verbal assurances or a headline price only.
B — 1 point: A proposal exists, but responsibilities, charges or exit arrangements remain unclear.
C — 2 points: Signed pilot terms define scope, acceptance, fees and caps, support, incident notification, data access, change responsibilities and termination/export arrangements.
D — 3 points: We have reconciled the quote with the intended configuration, exercised a sample export and support escalation, and confirmed a practical exit runbook.

Evidence to retain: Pilot agreement, responsibility schedule, itemised quote and exit checklist.

Desk recommendation: Ask specifically about simultaneous-call capacity, transfer charges, minimum commitments, implementation, monitoring, configuration ownership and number portability where relevant. Do not sign a broad rollout commitment to obtain a narrow learning exercise.