Appendix B — Readiness Checklists

Appendix B from The AI Contact Center Handbook by Sho Shimoda. Available on Amazon.

Six diagnostic instruments

These are the diagnostic tools referenced throughout the book. They exist because CX leaders in the middle of a transformation asked for them: something they can print out, walk into a room with, and use to structure a hard conversation. Nothing here is a substitute for judgment. But structure helps.

B.1 The Voice AI Readiness Diagnostic

Twenty questions, scored 0–5 each (0 = "not at all," 5 = "fully in place"). Total possible: 100.

Data and infrastructure (25 points)

1. Do you have a unified customer profile accessible in real time to the AI, spanning at least CRM, order/billing, and interaction history?
2. Is your call recording infrastructure capable of delivering transcripts to the AI within seconds of the call ending (or streaming during the call)?
3. Do you have documented APIs to your core backend systems (CRM, order management, billing, knowledge base)?
4. Is your identity system (SSO, agent authentication) capable of extending to service accounts that the AI can use to act on behalf of customers?
5. Do you have a data warehouse or analytics platform that can ingest AI interaction logs at production scale?

Operational readiness (25 points)

6. Does the operations team have a defined process for handling escalations from AI to human agents, including warm-transfer of full conversation context?
7. Do you have real-time monitoring in place that will show you when the AI's containment rate, CSAT, or latency deviates from baseline?
8. Do you have an on-call rotation defined for AI-specific incidents (misroutes, hallucinations, safety flags)?
9. Have you documented the specific business processes the AI is authorized to execute, and the ones it is not?
10. Do you have a rollback plan for individual AI capabilities that can be executed in under an hour?

Governance and compliance (25 points)

11. Have you completed a Data Protection Impact Assessment (DPIA) for the AI deployment?
12. Do you have a documented model registry recording which AI model version is in production, what data it was trained on, and who approved its deployment?
13. Do you have an incident response plan for AI-specific failure modes (data leak, harmful output, hallucination causing customer harm)?
14. Are your call recording, transcription, and AI processing environments in scope for the relevant regulatory frameworks (PCI DSS, HIPAA, GDPR, etc.) that apply to your business?
15. Have you obtained appropriate customer notice and consent for AI-mediated interactions in the jurisdictions where you operate?

People and culture (25 points)

16. Have you communicated to the frontline workforce what the AI will and will not do, and how it affects their jobs?
17. Is there a designated internal owner of the AI product — someone with authority to make trade-offs between accuracy, cost, and containment?
18. Have you identified the internal candidates who could transition into new AI-adjacent roles (AI Agent Builder, Conversational Designer, Guardian Agent Operator)?
19. Does your executive leadership have realistic expectations for the value delivery timeline (typically 12–24 months for meaningful business impact)?
20. Do you have a cross-functional governance forum (operations, IT, security, legal, HR) that meets at least monthly on the AI program?

B.2 The Voice AI Vendor Security Questionnaire

Send this to every voice AI vendor you evaluate. If the vendor cannot answer any of these questions clearly, that is itself the answer.

Data handling

1. Where is customer data (audio, transcripts, derived metadata) physically stored, in what jurisdictions, and can we require it be kept in specific regions?
2. Is customer data used to train the vendor's base models, either the customer's own data or aggregated across customers? If yes, what opt-out is available?
3. What is the data retention policy for customer audio, transcripts, and interaction logs? Can it be customized?
4. On contract termination, what is the process, timeline, and cost for returning or destroying all customer data?
5. Do you support customer-managed encryption keys (BYOK)?

Model and inference security

6. What language models does the AI use, and can we specify or restrict which models are used in our instance?
7. What defenses do you have against prompt injection attacks? Can you demonstrate them?
8. How do you detect and mitigate hallucinations in production, before they reach the customer?
9. Can you provide model version control — a record of which model version handled each interaction, and the ability to rollback to a prior version?
10. What is your process and timeline for patching models when a new safety issue is discovered?

Access control

11. Do you support single sign-on integration with major identity providers (Okta, Azure AD, Ping)?
12. What role-based access controls are available for administrative functions?
13. How is service-to-service authentication handled between the AI and our backend systems?
14. Do you provide audit logs of all administrative actions, and how long are they retained?
15. What is your process for revoking access when an employee (yours or ours) leaves?

Compliance certifications and audits

16. Which certifications do you hold: SOC 2 Type II, ISO 27001, HIPAA (BAA available), PCI DSS (as a service provider), FedRAMP, others?
17. When was your most recent third-party penetration test, and can we see a summary?
18. Do you support DPIA documentation and cooperation with our own DPIA process?
19. What is your process for notifying us of a security incident, and what is your maximum notification window?
20. Do you have documented policies for AI-specific compliance requirements (EU AI Act obligations, U.S. state AI laws, etc.)?

Operational resilience

21. What is your service level agreement for uptime, and what credits apply when you miss?
22. How is disaster recovery structured? What is your published Recovery Time Objective (RTO) and Recovery Point Objective (RPO)?
23. How do you handle carrier or telecommunications outages that affect your platform?
24. What is your process for capacity planning, and how do you handle traffic spikes that exceed forecast?
25. Do you provide a public status page with historical uptime data?

B.3 Voice AI DPIA Template

A Data Protection Impact Assessment is required under GDPR and increasingly under other frameworks whenever a new processing activity is likely to result in high risk to individuals. Voice AI in a contact center almost always triggers this obligation. The template below is a structural starting point; adapt to your legal counsel's guidance.

Common risks to assess (Section 3)

• Model hallucination causing incorrect information delivery
• Prompt injection causing unauthorized action
• Voice deepfake defeating biometric authentication
• Discriminatory routing or treatment based on protected characteristics
• Cross-customer data leakage through the model
• Excessive data retention beyond regulatory requirements
• Inadequate transparency to the data subject

B.4 CX Survey Templates

Five ready-to-use survey designs. Deploy them at the interaction points where they actually measure what you think they measure — which is almost never right after the call ended.

Template 1 — Post-interaction CSAT

1. "Thinking about your recent contact with [Company], how satisfied were you with the experience?" (1–5)
2. "Was your issue resolved?" (Yes / Partially / No / N/A)
3. "How easy was it to get your issue resolved?" (1–7) — this is your CES
4. Optional open text: "Is there anything you'd like to tell us about this experience?"

Keep it to four questions. Every additional question drops response rate by roughly 10–15%.

Template 2 — AI agent experience

1. "You were helped by [Company]'s automated assistant. How well did it understand what you needed?" (1–5)
2. "Did the automated assistant resolve your issue?" (Yes / Partially / No — please describe / Was transferred to a person)
3. "Would you prefer to use the automated assistant again for similar issues?" (Yes / No / Depends on the issue)
4. Optional open text: "What could the automated assistant have done better?"

The critical question is number three. If most customers say "yes" or "depends," your AI has customer permission to grow. If most say "no," you have a design problem, not a technology problem.

Template 3 — Relationship NPS

1. "On a scale of 0 to 10, how likely are you to recommend [Company] to a friend or colleague?"
2. Detractors (0–6): "What is the most important reason for your score?"
3. Passives (7–8): "What one thing could we do to earn a higher score from you?"
4. Promoters (9–10): "What do we do particularly well that you'd want us to keep doing?"

The follow-up questions matter more than the score itself. NPS without the "why" is a vanity metric.

Template 4 — Post-resolution follow-up

1. "Two days ago you contacted us about [topic]. Is your issue still resolved?" (Yes / No — please tell us what happened)
2. "Have you had to contact us again about the same issue?" (No / Yes — please describe)
3. Optional: "Is there anything else we can help with related to this?"

This survey measures true first-contact resolution — the version that catches the "resolved-at-the-time-but-came-back-the-next-day" pattern that in-call surveys miss.

Template 5 — Agent experience

1. "How manageable was your workload in the past quarter?" (1–5)
2. "How well do the tools you use support you in helping customers?" (1–5)
3. "How confident do you feel about your job security over the next 12 months?" (1–5)
4. "Do you feel the AI tools deployed on your team have made your job better, worse, or unchanged?" (Better / Unchanged / Worse — please describe)
5. Open text: "What one change would most improve your daily work?"

The third question is the one most companies avoid asking. Ask it. If you do not ask it, your agents will still have the anxiety — they will simply not tell you about it until they resign.

B.5 The Executive Readiness Conversation

Not a checklist. A structured agenda for a two-hour conversation between the CX leader, the CIO, the CFO, and the CEO before any large AI-in-CX investment is committed. Use it once, or use it quarterly.

The 90-day commitments matter more than the two-hour discussion. Programs that leave the room with a plan but without individually named executive owners for the first three months' work almost invariably drift.

B.6 The Weekly Operating Rhythm

Once the AI is running in production, four operational cadences matter. Not one of them is optional.

How to use this appendix

Pick the diagnostic that matches the phase you are in. Pre-decision: B.5. Pre-launch: B.1 and B.2. Regulatory: B.3. Post-launch: B.4 and B.6. None of these are one-shot — the readiness diagnostic in particular is worth re-running every six months as the operation matures and the gaps shift.