The AI Readiness Health Check: 36 checks to run on Salesforce or HubSpot before any AI goes live
An open checklist of 36 concrete, verifiable checks across data quality, data model, ownership, integrations, process, permissions, reporting lineage and AI prerequisites — with what to measure, why it matters for AI, and a scoring rule.
14 min read
01
HOW TO RUN IT
02
THE 36 CHECKS
03
SCORING AND NEXT STEP
TL;DR
Thirty-six checks in eight groups, each one a number or a document a Salesforce or HubSpot admin can produce. Together they take about a week for a mid-market org; the first twelve take an afternoon.
Every check exists because an agent will act on what it finds: duplicates become wrong updates, unused fields become vocabulary the agent misreads, admin-cloned permission sets become data exposure, and an undocumented process becomes rules the agent invents.
The checks are drawn from Salesforce’s Well-Architected framework, Trailhead’s data-quality and Trust Layer modules, HubSpot’s Data Quality Command Center and AI settings documentation, and Gartner’s AI-ready data criteria. Sources are listed with each group.
Scoring is blunt: 30 or more passes means an agent can go to production; 20–29 means pilot-ready, not production-ready; under 20 means the foundation comes first and every dollar spent on the AI layer now will be spent again.
Why a health check, and why now
The entry price for an AI agent inside your CRM has fallen to zero. Salesforce Foundations gives Enterprise Edition customers Agent Builder and 100,000 Flex Credits at no cost; HubSpot’s Agent Hub is included in every tier with a 28-day trial. An admin can have an agent answering questions in a sandbox by the end of the day. Whether that agent should be allowed near a Case with a customer on the other end depends entirely on the org underneath it, and Salesforce Ben’s 2026 admin survey found only 2% of admins describe their org as clean and well-maintained.
The failure data is already in. Gartner predicted in June 2025 that more than 40% of agentic AI projects would be cancelled by the end of 2027 for cost, unclear value or inadequate risk controls; Gearset’s 2026 State of Salesforce DevOps report found production agents still a minority, with security, compliance and data quality as the top barriers. With Agentforce metering roughly $0.10 per action and HubSpot charging per resolved conversation, an unprepared org is now billed for its defects monthly. The health check is how you find them first.
How to run it
Scope it to the objects the first AI use case will touch. For a service agent: Case, Contact, Account, Entitlement and Knowledge. For a sales agent: Lead, Opportunity, Account, Contact. In HubSpot: Tickets, Contacts, Companies, Deals. Running every check on every object is how the exercise becomes a quarter-long project nobody finishes.
Assign each check to the person who can actually produce the number: the Salesforce admin or HubSpot super admin for most of the data and permission checks, the RevOps or business-systems lead for ownership and process, the workflow’s business owner for the outcome metric.
Record a number or a document for every check, not a feeling. “Mostly” is a fail. Where a number needs a report that does not exist, build the report; it becomes part of the operating rhythm afterwards.
Put a name beside every fail, even if the fix is not scheduled. A fail with no name beside it will still be a fail next quarter.
Repeat quarterly. The score should climb while the foundation is being built and must not slip afterwards; the six CRM data numbers in group one are the ones that decay fastest.
The eight groups and their weight in the score are drawn below. Groups one and six — data quality and permissions — carry the most risk, because they are where an agent does damage in front of a customer.
The 36 checks
Group 1 — Data quality (7 checks)
1. Duplicate and matching rules are active on Lead, Contact and Account (Salesforce), or Duplicate management is configured with custom rules (HubSpot). Why: an agent grounds on the record it finds and merges or updates the wrong one otherwise. Measure: duplicate rate from Duplicate Record Sets or the Data Quality Command Center; working thresholds 3% on Account, 5% on Contact.
2. Key-field completeness meets an agreed threshold on the in-scope objects. Why: a field the agent instructions reference but that is empty is treated as absent, and the agent does whatever its instructions say to do with nothing. Measure: fill rate per field, per team; 90% on any field the workflow reads or writes.
3. Record age is known: the share of in-scope records not modified in 12+ months. Why: stale data produces confident stale answers. Measure: LastActivityDate distribution; more than 30% inactive for a year means the list is an archive, not a prospecting base.
4. Format consistency: picklists over free text; HubSpot formatting-issues card cleared. Why: three spellings of the same value are three values to an agent. Measure: picklist values with case or spelling variants on the in-scope objects.
5. Properties with no data are archived (HubSpot) and empty custom fields retired (Salesforce). Why: noise dilutes the context the agent reads. Measure: count of properties or fields with zero populated values.
6. Validation rules exist and do not conflict. Why: they enforce quality at entry without blocking legitimate saves; conflicting rules teach users workarounds. Measure: active validation rules per object, error rate per rule.
7. Data is representative of the target use case, including outliers and edge cases — Gartner’s core AI-ready data criterion. Why: an agent trained or grounded on the happy path fails on the refund request and the Spanish-language ticket. Measure: coverage of the negative and edge cases in the records the agent will see.
Group 2 — Data model (5 checks)
8. Unused custom fields removed from in-scope objects. Why: every field label is vocabulary the agent uses to interpret instructions; Elements.cloud’s research finds 40% of custom fields are never populated. Measure: fields with no reads and no values in 90 days. Note: Salesforce Optimizer retired in Winter ’26; use Org Check or a field-usage report.
9. Page layouts and record types rationalised. Why: layout sprawl signals undocumented process variants the agent will not know about. Measure: record types per object that map to no process anyone runs.
10. Unique or composite keys and normalized match methods exist for identity resolution. Why: Data 360 and cross-object grounding fail without them. Measure: keys defined on Account, Contact and Lead; match rules documented.
11. Duplicate properties consolidated (HubSpot). Why: two properties that mean the same thing give the agent two truths. Measure: property pairs with overlapping meaning and both populated.
12. Field-level data classification populated (sensitivity, compliance category). Why: it drives Trust Layer masking and tells the agent what it may surface. Measure: share of in-scope fields with a classification value.
Group 3 — Ownership and governance (5 checks)
13. A named data owner exists per core object. Why: someone must be accountable for readiness, and “the admin” means no one. Measure: an owner map with one name per object, no blanks.
14. AI ownership is assigned: who is responsible for the agent and which data it may process. Why: a Breeze and Agentforce prerequisite in practice; unowned agents are the ones that run loops nobody reads. Measure: a named owner per agent and a written data scope.
15. AI feature access is reviewed quarterly. Why: permissions drift. Measure: date of the last review of Manage AI Agents holders and HubSpot AI settings.
16. Success metrics are defined before activation, in outcome terms. Why: without a number the pilot cannot fail, which means it cannot succeed. Measure: a written baseline recorded from a report that exists.
17. A security matrix documents what each persona may access. Why: Well-Architected names its absence an anti-pattern; the agent inherits the persona it runs as. Measure: a persona-by-object access table, dated.
Group 4 — Integrations (4 checks)
18. Data-sync integrations are error-free (HubSpot Data Sync card; Salesforce integration user error logs). Why: sync errors propagate bad data silently. Measure: open sync errors, days since last error review.
19. Client apps are on a current API version and every integration is documented. Why: Well-Architected lists undocumented, outdated integrations as anti-patterns; an agent action that crosses a dead integration says “done” and nothing happens. Measure: integration inventory with owner, API version, direction and mechanism.
20. No ad hoc point-to-point messaging; clear synchronous and asynchronous standards. Why: agents need reliable action endpoints. Measure: integrations with no named pattern.
21. Sensitive third-party fields are not synced into non-sensitive properties. Why: leakage into the agent’s context. Measure: field mappings reviewed against the sensitivity classification.
Group 5 — Process documentation (4 checks)
22. The end-to-end process is mapped before any prompt or agent instruction is written. Why: agents automate the process as documented; if it is undocumented, the pilot is where it gets written, expensively. Measure: a process document per subagent or agent, dated.
23. Legacy automation retired and remaining automations documented (Workflow Rules and Process Builder in Salesforce; unused or erroring workflows in HubSpot). Why: unsupported automation blocks maintainability and fires in ways the agent does not expect. Measure: count of legacy automations still active.
24. Human handoff rules and verification owners are defined per agent. Why: escalation is a launch requirement for both Breeze and Agentforce. Measure: written escalation triggers and a named reviewer.
25. A rollback plan exists and has been rehearsed in a sandbox: who can deactivate each AI feature, from where, without a change window. Why: governance is phase one. Measure: the name, the switch and the last rehearsal date.
Group 6 — Permissions and security (5 checks)
26. Salesforce Security Health Check score reviewed against the Baseline Standard. Why: the agent inherits the org’s security posture. Measure: the score (0–100) and the high-risk settings list.
27. Org-wide defaults are not Public Read/Write without justification; sharing is consistent. Why: agents respect user sharing, so over-sharing exposes data through the agent. Measure: OWD per in-scope object.
28. Dedicated AI permission sets rather than profile-level grants; the agent user’s access matches a human in the same role and no more. Why: least privilege for the agent user; Modify All Data is an automatic fail. Measure: a side-by-side of agent-user and human-role object and field permissions.
29. HubSpot AI settings reviewed by a super admin: generative access, CRM data, conversation data, Files data (default off), model-training opt-out. Why: these decide what Breeze may read. Measure: the settings page, reviewed and dated.
30. Sensitive Data properties (HubSpot Enterprise) restricted by user or team; audit log in use. Why: the agent must not surface what the role could not. Measure: restricted-property list and last audit-log review.
Group 7 — Reporting lineage (3 checks)
31. Unused reports and dashboards purged. Why: leftover reports mislead analysts and AI summarisation alike. Measure: reports not run in 12 months.
32. Core data is actually used in reports and dashboards. Why: unused data is unverified data; if nobody looks at a field, nobody has caught its errors. Measure: in-scope fields that appear in at least one active report.
33. A board-level number traces to a saved report and its filters. Why: lineage is what lets anyone defend what the AI did. Measure: take the largest number on the last board deck and follow it; if the trail ends at a spreadsheet, fail.
Group 8 — AI-specific prerequisites (3 checks)
34. Einstein Generative AI is enabled with the Trust Layer active, data masking and audit trail configured (Salesforce); Data 360 provisioned only if the agent needs unstructured content or cross-system identity. Why: zero-data-retention with external models and an audit trail are launch requirements. Measure: the settings, and a written Data 360 decision.
35. Knowledge sources are published, current and owned: Salesforce Knowledge in the Agentforce Data Library; HubSpot knowledge base and knowledge vaults (up to 50). Why: grounding quality caps agent accuracy, and the 2023 pricing PDF is now an authoritative source unless removed. Measure: articles untouched for two years, articles with a departed owner, duplicate titles.
36. The agent is tested before launch with a feedback loop and monitoring on: Agentforce Testing Center test cases (utterance, expected subagent, expected actions, expected response), or the HubSpot Customer Agent preview. Why: an untested agent infers its own rules. Measure: about thirty test rows per subagent including negative cases, and a transcript-review cadence.
Scoring
Count passes out of 36. Thirty or more: an agent can go to production on the in-scope objects; the remaining fails are the first items on the backlog. Twenty to twenty-nine: pilot-ready, not production-ready; the pilot will demo well and stall on the checks you failed, usually around month four. Under twenty: stop evaluating AI vendors; every dollar spent on the AI layer now will be spent again after the foundation is rebuilt, and a consumption-priced agent will bill you for every action it takes on bad data in the meantime. Two overrides: a fail on check 28 (agent permissions) or check 25 (rollback) blocks production regardless of the total.
The scoring bands are drawn below. Most mid-market orgs we see score between eighteen and twenty-six on the first pass, with the fails clustered in groups one, three and five, and that is a normal starting point. The first ten points are usually decisions rather than software.
What we actually see
A composite from first-week reviews, offered as observation rather than a study. Duplicate rules exist in alert mode and reps learned to click through them years ago. Opportunity Amount and CloseDate are complete because validation enforces them; NextStep and the primary Contact role are not, because nothing does. The agent user was cloned from an admin profile to make the demo work. The owner map has two or three integrations nobody in the room can name an owner for, one of them still writing to Lead records. Test cases do not exist in any form; the closest artifact is a slide of sample questions. None of this is unusual, and all of it is fixable in weeks once it is written down with a name beside it.
Run it with us, or without
The checklist is open. Any operations team can run it alone, and we would rather it did than not run it at all. If you would prefer to have it run for you, it is a short fixed-scope engagement: we pull the numbers from your Salesforce or HubSpot org, score all 36 checks with evidence attached, and hand back a prioritized roadmap with a name beside every fail. The output is the same scorecard either way. The difference is who spends the week.
Related reading
The AI readiness checklist: 12 questions to answer before you buy another AI tool — the twelve-question short form of this instrument.
AI transformation: the complete guide for mid-market technology companies — where the health check sits in the full transformation.
Is your Salesforce ready for Agentforce? A pre-flight health check — the Salesforce-specific pre-flight.
Why your CRM data quality decides whether AI works — the six CRM data numbers behind group one.
Sources: Salesforce Architects, Well-Architected framework (Trusted, Easy, Adaptable) and Agentforce lens; Trailhead, Assess Your Data Quality, Security Health Check and Einstein Trust Layer modules; Salesforce Help, Agentforce Data Library, Einstein Generative AI setup and Optimizer retirement; Salesforce Ben, 2026 Salesforce Admin Survey and Einstein data-governance guidance; Elements.cloud, technical-debt research; HubSpot Knowledge Base, Data Quality Command Center, duplicate management, AI settings, sensitive data and knowledge vaults; Gartner, AI-ready data criteria and agentic AI prediction (June 2025); Gearset, State of Salesforce DevOps 2026.
Frequently asked questions
What is an AI readiness health check?
A structured audit of a CRM org — Salesforce or HubSpot — that produces a number or a document for each of 36 checks across data quality, data model, ownership, integrations, process, permissions, reporting lineage and AI prerequisites, then scores the result against production-readiness thresholds. It answers whether an AI agent can safely act on the org, before the agent is switched on.
How long does the health check take?
About a week for a mid-market org when scoped to the objects the first AI use case touches. The twelve data and permission checks that carry the most risk take an afternoon for an admin who knows the org. Repairing the fails typically fits in a quarter, and the first ten points are usually decisions rather than software.
Do I need Data 360 or Data Cloud to be Agentforce-ready?
Usually not. Agents ground on CRM records, metadata, Flows, Apex, prompt templates and Knowledge articles without it. Data 360 becomes necessary when the agent must reason over a large body of unstructured content or needs one identity-resolved profile across systems with no shared key. Check 34 asks for that decision in writing.
What is an acceptable duplicate rate before running an AI agent?
Our working thresholds are 3% on Account and 5% on Contact on the objects the agent will read or write. Above those lines the agent updates the wrong record often enough that reps stop trusting anything it touched, and merging becomes the first workstream. Measure it with Duplicate Record Sets in Salesforce or the Data Quality Command Center in HubSpot.
Can the health check be run on HubSpot as well as Salesforce?
Yes. Every check has a HubSpot equivalent: the Data Quality Command Center for duplicates, formatting and property insights, Data Sync for integration errors, AI settings and Sensitive Data properties for permissions, knowledge vaults for grounding, and the Customer Agent preview for pre-launch testing. Objects map to Contacts, Companies, Deals and Tickets.
What happens after the health check?
You get a score out of 36, a fail list with a name beside each item, and a prioritized order of repair: decisions first (owners, definitions, system of record), then permissions and rollback, then data quality and integrations for one workflow, then the AI layer. The check is repeated quarterly so the score climbs while the foundation is built and does not slip afterwards.
NEXT STEP
See where your organization stands before the next AI purchase.
A short conversation is enough to tell whether the AI Readiness Health Check, 36 checks on your Salesforce or HubSpot org, is the right first step. No decks, no obligations.
WRITTEN BY
Tal Oryon
MORE NOTES
Guide
AI transformation: the complete guide for mid-market technology companies
What AI transformation is, what it is not, the four stages, the readiness test, a twelve-month roadmap, and the questions executives ask most. Written for 300–2,000-person companies running Salesforce or HubSpot.
Guide
The AI Readiness Health Check: 36 checks to run on Salesforce or HubSpot before any AI goes live
An open checklist of 36 concrete, verifiable checks across data quality, data model, ownership, integrations, process, permissions, reporting lineage and AI prerequisites — with what to measure, why it matters for AI, and a scoring rule.
