DRSK

PRE-DEPLOYMENT AI READINESS: The Comprehensive Checklist

June 2026

IT Discovery | CFO Investment Gate | Engineering | Compliance | FinOps | Deployment

For AI Solution Development Teams, IT Departments & CFOs

How to Use This Checklist

This checklist governs the dialogue that must occur between the AI Solution Development Team, the IT Department, and the CFO before a single line of deployment infrastructure is written. It is not a technical specification—it is a readiness gate. Every section must be completed, documented, and signed off before the next phase begins.

The Core Principle

The most expensive AI deployment mistakes are made before deployment begins—during discovery, scoping, and architecture. An AI solution built on top of undiscovered legacy constraints, without a FinOps model, without memory and harness engineering cost projections, and without a CFO-endorsed ROI framework, will fail on budget, security, or adoption grounds regardless of its technical quality. This checklist surfaces those constraints before they become crises.

Checklist Index & Sign-off Summary

Section	Name	Primary Participants	Gate Required?
1	Stakeholder Alignment & Problem Scoping	AI Team + Business Units + CFO	Yes — CFO sign-off
2	IT Systems, Software & Hardware Discovery	AI Team + IT Department	Yes — IT sign-off
3	Data Architecture & Database Assessment	AI Team + IT + DPO	Yes — DPO sign-off
4	Security, Compliance & Regulatory Review	IT Security + Legal + Compliance	Yes — Legal sign-off
5	AI Engineering Architecture Review	AI Team + IT Architects	Yes — Architecture sign-off
6	FinOps, Cost Modelling & CFO Investment Gate	AI Team + Finance + CFO	Yes — CFO budget approval
7	Deployment Stack Design	IT + AI Team	Yes — CIO sign-off
8	Ethical AI, Governance & Risk	AI Governance + Legal + HR	Yes — Board acknowledgement
9	Change Management & Training Readiness	HR + Business Units + IT	Yes — HR sign-off
10	Go/No-Go Gate & Launch Protocol	All stakeholders	Yes — CEO/CIO/CFO sign-off

 

SECTION 1: Stakeholder Alignment & Problem Scoping

Define what you are solving, for whom, and why it is worth deploying AI to solve it.

1.1 Problem Definition

1.2 Success Criteria — Pre-Defined and Measurable

These criteria must be defined before any technical work begins. They are the CFO's investment framework.

 

[CFO GATE 1.2]

The CFO must review and formally approve the success criteria before technical scoping begins. Any use case without measurable baselines and defined success thresholds does not proceed. This is not a formality—it is the investment thesis.

1.3 Use Case Classification

[⚠ NUANCE — EU AI Act Enforcement]

The EU AI Act reached full enforcement for high-risk AI systems on August 2, 2026. If your AI solution operates in critical infrastructure, employment, education, essential services, or law enforcement contexts—it is legally classified as high-risk and requires conformity assessments, technical documentation, human oversight mechanisms, and registration in the EU AI Act database BEFORE deployment. This is not optional, and penalties reach up to €35M or 7% of global turnover.

SECTION 2: IT Systems, Software & Hardware Discovery

Map the full technology estate the AI solution must integrate with, operate alongside, and respect.

2.1 Network & Infrastructure Inventory

Network Architecture

Compute Infrastructure

Cloud Subscriptions & Managed Services

2.2 Software & Application Landscape

Core Business Systems                                                                                                                       

Collaboration & Communication Platforms

Legacy Systems — The Hidden Risk

[⚠ NUANCE — The Hidden Cost of Dark Data]

Gartner confirms that poor data categorization and dark data trapped in legacy systems can increase AI implementation costs by up to 40%. The primary differentiator between organizations that scale AI and those stuck in the pilot phase is data accessibility. AI models cannot compensate for data they cannot reach. Discovering this after the deployment stack is designed is catastrophically expensive.

 

Middleware & Integration Layer

2.3 Monitoring & Observability Stack

2.4 Identity, Access & Authentication

SECTION 3: Data Architecture & Database Assessment

Confirm data is accessible, trustworthy, governed, and AI-ready across every source the solution requires.

3.1 Database Inventory

Relational Databases

NoSQL & Document Stores

Data Warehouses & Lakes

Vector Databases — New Requirement for AI

[⚠ NUANCE — Vector Database Provisioning]

Most IT discovery processes inventory relational and NoSQL databases comprehensively but entirely miss vector database requirements. A RAG-based AI system cannot function without a vector store. If this is not provisioned as part of the deployment stack, it will be bolted on as an afterthought—usually at higher cost, with weaker security controls, and without proper backup.

3.2 Data Quality Assessment

[CFO GATE 3.2]

Data quality failures are the single most common cause of AI project abandonment. Gartner predicts 60% of AI projects lacking proper data management will be abandoned in 2026. Before the CFO approves infrastructure investment, the team must present a data quality scorecard with a remediation plan and timeline for any gaps below threshold.

3.3 Data Classification & Governance

SECTION 4: Security, Compliance & Regulatory Review

Ensure the AI solution meets every applicable security standard and regulatory obligation before an API call is made.

4.1 Security Architecture

API Security

Input & Output Security

Agentic System Security — Critical

[⚠ NUANCE — Chatbots vs. Agentic Security]

Agentic AI systems are categorically different from chatbots from a security perspective. An agent with tool access to email, file systems, or APIs can cause real-world, irreversible harm if compromised through prompt injection or misconfiguration. The security review for agentic systems must be conducted by a security architect with specific AI threat modelling experience, not just a standard application security review.

4.2 Compliance Mapping

Regulation	Applicability Check	Key AI-Specific Requirement	Who Signs Off?
GDPR (EU/EEA)	Any personal data of EU residents?	DPIA for high-risk processing; right to explanation for automated decisions; data minimization	DPO + Legal
PDPA (SE Asia)	Personal data of residents in scope?	Consent management; cross-border transfer restrictions; breach notification	DPO + Legal
EU AI Act	High-risk AI system in scope? (employment, credit, essential services)	Conformity assessment; human oversight; technical documentation; registry database registration	Legal + Compliance
HIPAA (US)	Protected health information involved?	BAA required with AI vendors; PHI cannot be sent to unapproved models; encryption mandatory	Legal + Compliance
PCI-DSS	Payment card data in scope?	Cardholder data cannot be sent to AI models; tokenization required; audit trail mandatory	Security + Legal
ISO 27001	Existing certification?	AI system must be included in ISMS scope; risk assessment required	CISO
SOC 2 Type II	Organization holds SOC 2?	AI processing must be within audit scope; vendor AI controls must be assessed	CISO + Legal
Local Financial Regs	Financial services context?	AI model explainability may be required for credit or underwriting decisions	Legal + Compliance

4.3 Vendor Security Assessment

[CFO GATE 4.3]

The CFO must be informed that AI vendor contracts without price lock-in provisions and explicit data governance guarantees create both financial and legal liability. Any AI vendor contract that lacks a DPA, data deletion guarantees, and pricing transparency should not be approved without legal review.

SECTION 5: AI Engineering Architecture Review

Assess the full four-discipline engineering stack before committing to deployment architecture.

The Four Engineering Disciplines — Why They All Matter

1. PROMPT ENGINEERING governs how the model behaves—its instructions, reasoning process, output format, and safety constraints. Poor prompting produces inconsistent, verbose, or unsafe outputs that cost more to fix in production than to prevent pre-deployment.
2. CONTEXT ENGINEERING governs what the model knows at inference time—retrieved documents, live data, conversation history. Poor context design produces hallucinations and wastes token budgets on irrelevant content.
3. MEMORY ENGINEERING governs continuity across sessions—user preferences, past decisions, institutional knowledge. Without memory architecture, every session starts fresh, producing a frustrating and inefficient user experience that drives low adoption.
4. HARNESS ENGINEERING governs the full execution infrastructure—tools, agents, evaluations, safety layers, monitoring, and human-in-the-loop controls. Without a harness, the AI solution cannot be governed, tested, or safely scaled.

5.1 Prompt Engineering Assessment

[⚠ NUANCE — Output Verbosity is a Silent Budget Killer]

A system prompt that does not constrain output length will generate unnecessarily verbose responses. Output tokens cost 3–10× more per unit than input tokens. Unconstrained output on a system handling 10,000 requests per day can generate 30–50% more cost than a prompt-constrained equivalent. This must be engineered before deployment, not optimized after a budget shock.

5.2 Context Engineering Assessment

RAG Architecture Review

Context Cost Controls

5.3 Memory Engineering Assessment

[⚠ NUANCE — The Memory Cost Compounder]

Memory systems add overhead to every inference call: retrieval latency (100–500ms), embedding costs (each memory retrieval requires an embedding call), and storage costs. These are not one-time costs—they compound with every user and every session. They must appear in the FinOps model in Section 6, not be discovered post-deployment.

5.4 Harness Engineering Assessment

Tool Integration Architecture

Evaluation & Safety Scaffolding

Human-in-the-Loop (HITL) Architecture

Action Category	Autonomy Level	Required Gate	Logging Level
Read-only data retrieval	Full autonomy	None	Standard
Drafting / summarization	Full autonomy	User review before action	Standard
Low stakes write (draft creation)	Supervised autonomy	Confidence threshold gate	Enhanced
Medium-stakes action (send communication)	Human approval required	Named approver + reason log	Enhanced
High-stakes action (financial, legal)	Mandatory dual approval	Two named approvers + full audit trail	Full audit
Irreversible action (delete, transfer)	Blocked by default	Explicit dual approval + secondary confirmation	Full audit + alert

SECTION 6: FinOps, Cost Modelling & CFO Investment Gate

Build the complete financial model of the AI solution- including every hidden cost—before the CFO approves deployment.

Why AI Cost Models Are Routinely Incomplete

Teams typically model only basic input token costs. They routinely miss: output token surcharges, agentic multi-step multiplication, memory search infrastructure, tool API fees, error/retry token waste, and compounding multi-turn context accumulation. Deloitte confirmed that only 10% of organisations see immediate agentic AI ROI. A CFO without a fully loaded cost model is reviewing an incomplete investment thesis.

6.1 Token Cost Modelling (Step-by-Step)

1. Apply batch discount: Apply a 50% discount to any asynchronous, non-real-time batch-eligible workloads.
2. Total monthly token cost: Sum all above. Present best case, expected case, and a 3× peak case scenario.

Non-Token Operational Costs to Include:

6.2 CFO Financial Dashboard — Required Metrics

Metric	Definition	Minimum Acceptable Visibility	Review Cadence
Cost per task	Total token + infrastructure cost to complete one end-to-end user workflow	Per use case, real-time	Weekly
Cost per successful output	Cost per task that produced a correct, accepted, and used result	Per use case	Weekly
Revenue-to-AI-cost ratio	Gross revenue or value generated ÷ total AI spend for this solution	Portfolio level	Monthly
Token waste rate	% of tokens consumed that produced no business value (errors, loops)	Per use case	Weekly
Budget burn rate	Actual spend vs. projected spend vs. annual budget with days-remaining	Organization-wide	Daily
Cost-to-serve delta	Fully loaded cost per workflow after AI deployment vs. before AI	Per use case	Monthly
ROI payback timeline	Months until cumulative value generated equals cumulative investment	Per use case	Quarterly

 

[CFO GATE 6 — THE INVESTMENT DECISION]

The CFO must receive and formally approve ALL of the following before deployment budget is released:

1. A fully loaded cost model (token cost + all non-token costs + engineering maintenance) for 12 months.
2. A documented pre-AI baseline for every success metric defined in Section 1.2.
3. A minimum ROI projection showing the break-even month under expected-case cost assumptions.
4. A 3× peak-case cost scenario with confirmation that the organization can absorb this without budget exhaustion.
5. A named FinOps owner is responsible for weekly spend monitoring and escalation.
6. A hard budget limit configured in the AI gateway, above which calls are automatically paused.

WITHOUT ALL SIX, THE CFO SHOULD NOT APPROVE DEPLOYMENT BUDGET.

6.3 FinOps Infrastructure Requirements

SECTION 7: Deployment Stack Design

Define the complete, feasible deployment architecture based on the IT discovery and engineering assessment.

7.1 Deployment Environment Architecture

7.2 Recommended Deployment Stack Components

Layer	Component Function	Open-Source Option	Managed Option	Selection Criteria
AI Gateway	Routing & cost control	LiteLLM Proxy / Router	Portkey / Kong AI	Must support budget enforcement + usage tagging
LLM Inference	Model serving engine	Ollama / vLLM	Anthropic / Azure OpenAI / Bedrock	Based on data residency + capability requirements
Vector Store	RAG & memory storage	pgvector / Qdrant / Chroma	Pinecone / Weaviate Cloud	Based on scale, query latency SLA, and existing DB estate
Embedding Model	Text-to-vector conversion	sentence-transformers / BGE-M3	OpenAI / Cohere / Voyage AI	Domain specificity and multilingual requirements
Orchestration	Agent & pipeline framework	LangChain / LlamaIndex / CrewAI	AWS Bedrock Agents	Based on agent complexity and team familiarity
Observability	Tracing & evaluation	Langfuse / Phoenix	Arize AI / Braintrust	Must support token-level cost attribution
Safety Layer	Input/output guardrails	Guardrails AI / NeMo	Bedrock Guardrails	Based on compliance requirements from Section 4
Memory Store	Cross-session state	Redis / Mem0 / Custom Postgres	Zep / Recall.ai	Based on data residency + privacy requirements
Semantic Cache	Duplicate query elimination	GPTCache / Redis vector	Momento Cache	High-repetition workloads only—calculate ROI first

7.3 Final Pre-Deployment Infrastructure Gates

SECTION 8: Ethical AI, Governance & Risk

Ensure the solution is safe, fair, explainable, and governed before it reaches any end user.

8.1 Bias, Fairness & Explainability

8.2 AI Governance Policy

8.3 Auditability & Traceability

SECTION 9: Change Management & Training Readiness

Prepare the organization, not just the infrastructure -the human layer determines adoption success.

The 10-20-70 Rule of AI Readiness

BCG's research confirms that 10% of AI success comes from technology, 20% from data and analytics, and 70% from people and process change. An organization with perfect infrastructure but no change management program will see user adoption stall below 20% at 90 days.

9.1 Stakeholder Communication Plan

9.2 Training Program Matrix

Audience	Training Content	Format	Completion Gate
All End Users	Capabilities & limitations, effective querying, identifying errors, escalation process	30-min interactive module + practice session	Required before system access is granted
Department Managers	Tracking team usage, quality review workflows, operational escalation protocols	60-min workshop	Required before departmental go-live
AI Champions	Deep product knowledge, prompt refinement, feedback collection, peer coaching	Half-day training + certification	Completed 2 weeks before go-live
IT Support Staff	System architecture, common failure modes, telemetry tools, escalation paths	90-min technical briefing	Required before production release
Finance / FinOps	Token cost model, dashboard telemetry, budget alert triage and management	45-min financial briefing	Required before deployment budget release
Legal / Compliance	Regulatory obligations, incident reporting procedures, AI policy enforcement	60-min briefing	Required before production release

9.3 Feedback & Continuous Improvement Loop

 

 

SECTION 10: Go / No-Go Gate & Launch Protocol

The final authority decision point before any AI solution reaches production users.

10.1 Section Sign-Off Registry

Section	Sign-Off Authority	Status	Date Signed	Notes / Conditions
1 — Scoping	CFO	☐ Complete / ☐ Pending
2 — IT Discovery	CIO / IT Director	☐ Complete / ☐ Pending
3 — Data Architecture	CIO + DPO	☐ Complete / ☐ Pending
4 — Security & Compliance	CISO + Legal	☐ Complete / ☐ Pending
5 — Engineering Architecture	Head of AI / CTO	☐ Complete / ☐ Pending
6 — FinOps & CFO Gate	CFO	☐ Complete / ☐ Pending
7 — Deployment Stack	CIO + AI Lead	☐ Complete / ☐ Pending
8 — Ethics & Governance	AI Governance Board	☐ Complete / ☐ Pending
9 — Change Management	HR / CHRO	☐ Complete / ☐ Pending

10.2 Go/No-Go Decision Criteria

Hard No-Go Conditions (Any One Fails = Project Halted)

Staged Rollout Protocol

Stage	Scope	Duration	Promotion Criteria	Who Approves?
Alpha	Internal Dev/Project Team (5–15 users)	1–2 weeks	Zero critical bugs; quality score meets threshold; cost model validated against actuals	CIO + AI Lead
Beta	Invited Core Business Users (50–100 users)	2–4 weeks	Quality holds; safety violation rate <0.1%; spend within 20% of projection	CIO + CFO
Limited Release	10% of Target Enterprise User Base	2–4 weeks	All technical metrics stable at scale; no eval regression; budget burn rate verified	CEO + CIO + CFO
General Availability	100% of Intended Target Users	Ongoing	Continuous observability; monthly eval reviews; quarterly CFO financial reviews	Board Acknowledgement

[FINAL CFO STATEMENT & MANDATE]

Every AI solution that reaches production represents an operational financial commitment that extends far beyond its launch date. The CFO must confirm before General Availability:

1. The 12-month fully loaded cost projection is absorbed into the departmental budget, including the 3× peak scenario.
2. The ROI measurement framework is fully operational - baselines are locked, metrics are tracked, and audit dates are scheduled.
3. The designated FinOps owner has daily cost dashboard visibility and autonomous authority to pause deployment if spend limits are breached.
4. The AI solution will face formal financial reviews at Month 1, Month 3, Month 6, and Month 12 post-launch with explicit recommendations to scale, redesign, or retire based on hard ROI evidence.

APPENDIX A: Critical Nuance Review

Review these hidden architectural traps before final sign-off.

• Nuance 1 (Sequence Risk): IT Discovery must always happen before the deployment stack is finalized. Designing the architecture first risks complete re-engineering if IT discovery later reveals legacy CRM limitations, missing APIs, or data residency boundaries.
• Nuance 2 (Memory Privacy Debt): Storing user preferences, interactions, and behavioral history across sessions creates immediate compliance liabilities under GDPR and PDPA. Consent, data minimization, and automated deletion must be engineered into the memory layer on day one.
• Nuance 3 (Harness Maintenance Costs): Evaluation suites, continuous red-teaming, safety classifiers, and human review infrastructure are not one-time build costs; they represent a permanent monthly operational expense.
• Nuance 4 (Agentic Threat Modeling): Autonomous agents with tool access can execute real-world, irreversible actions (e.g., database writes, email transmissions). Standard application security reviews are insufficient; this requires specialized AI threat modeling.
• Nuance 5 (Model Update Volatility): When model vendors push updates, it can instantly change prompt behaviors, output formatting, or reasoning pathways. Every vendor update must be treated as a potential regression event requiring a full evaluation run before production release.
• Nuance 6 (Time-Horizon Misalignment): Deloitte notes that most organizations do not see immediate agentic AI returns in Year 1, expecting them in Years 2–3. The CFO must be aligned on this timeline early to prevent premature budget termination.

APPENDIX B: Hidden Costs Reference Card

Present this table to the CFO at every cost model review session.

Hidden Cost Category	Why It Is Commonly Missed	Typical Magnitude	Action Requirement
Output Token Surcharge	Proposals routinely focus on input costs; output tokens are 3–10× more expensive per unit.	30% to 200% of basic token estimates	Factor in explicitly using output length limits
Agentic Call Multiplication	A single user-facing request to an agent can spark 30–100 internal recursive LLM calls.	Up to 100× standard single-turn cost	Apply hard limits to maximum agent execution steps
Memory Infrastructure Tax	Every cross-session memory lookup adds an embedding call, a vector DB query, and extra tokens.	5% to 15% surcharge per user session	Apply Time-to-Live (TTL) and memory reduction filters
Context Accumulation Tax	Chatbots pass the entire history of a conversation back to the LLM on every new turn.	Grows linearly with conversation length	Implement active context compression or summary loops
Failed / Retry Cost	Erroneous agent branches or failed API tool calls still consume full token budgets.	10% to 30% overhead on agent workloads	Account for a baseline error-rate in financial models
Human Review Staffing	Running high-stakes applications require continuous human oversight (HITL).	Hours spent × fully loaded employee rate	Count as a core operational expense of the solution
Safety Classifier Compute	Evaluating inputs and outputs via independent guardrail models adds per-call inference fees.	2% to 8% overhead on base token spend	Include as a non-negotiable security cost item
Vendor Pricing Volatility	Commercially hosted models lack multi-year price locks and can adjust tier pricing unilaterally.	Scenario-model a 2× price increase	Maintain a model-agnostic abstraction layer for swapping