Code We Trust's Source Code AI Readiness Standard
Not through strategy, not through training, not through process. If the software systems aren't structurally ready for AI coding automation and the integration of AI OSS/commercial libraries, the value never arrives.
39%
of organisations report any measurable EBIT impact from AI
— McKinsey State of AI 2025
20%
of organisations say their talent is highly prepared to use AI tools effectively
— Deloitte AI Institute 2026
5
dimensions measured by every major corporate AI readiness framework — none include the codebase
— McKinsey · Gartner · Deloitte · Microsoft
0
repositories in our benchmark achieve a grade A for AI integration & automation — including the AI frameworks themselves
— C2M Source Code AI Readiness Benchmark
Every major AI readiness framework evaluates organisations across the same five dimensions. These frameworks are useful. But for software-driven organisations — which is most organisations — they share a structural blind spot when it comes to AI coding automation and library integration.
"A compelling AI strategy, clean data, talented developers, and modern infrastructure cannot overcome a codebase that is architecturally incompatible with AI coding automation or the integration of AI libraries. And yet no established framework measures this."
What frameworks measure
What they all miss
These are related measurements — but they ask fundamentally different questions. Conflating them produces the wrong diagnosis and the wrong remediation plan.
Technical Debt
A backward-looking question. Measures accumulated remediation cost. Useful for budgeting and prioritisation. Does not tell you whether AI tools will produce value or risk on this codebase today.
AI Readiness
A forward-looking question. Measures structural conditions for the effectiveness of AI coding tools and library integrations. A codebase can carry low technical debt and still be AI-unready for these specific use cases. Conversely, some forms of debt have no bearing on AI tool effectiveness at all.
Each dimension is independently measurable at scale across any codebase, in any language, without requiring access to proprietary systems. Each maps to a specific structural condition that determines whether AI coding automation and AI library integration can proceed safely.
What it measures
Critical and blocker security hotspots per 10,000 lines of code — security-sensitive code patterns that require human review and are known to be exploitable.
Why it matters for AI
AI-accelerated delivery compounds existing security exposure rather than mitigating it. When AI tools increase the rate of code production on top of a codebase with known hotspots, they increase the attack surface at the same rate.
Benchmark evidence
The benchmark range on this dimension alone spans 319×: from 0.0 hotspots per 10K lines (Kubernetes) to 31.9 (Jenkins). These are not marginal differences in code hygiene — they represent entirely different risk categories.
Each codebase receives a score from 0 to 100 and a letter grade. The grade reflects structural readiness for AI coding automation and library integration — not code quality in general, and not technical debt. The same codebase can carry low technical debt and score D on Source Code AI Readiness, if it lacks governance or has structural complexity that blocks AI navigation.
Strong structural conditions across all dimensions. AI coding tools and libraries can be deployed with confidence. Governance, security, and structural complexity are all within ranges where AI-generated output can be produced, reviewed, and validated safely.
Specific blockers identifiable and remediable. Deploying AI coding tools or integrating AI libraries is viable but carries identifiable risk in one or two dimensions. A targeted remediation plan can move this codebase to A within a defined timeframe.
Deploying AI coding tools or libraries carries measurable risk. Multiple structural conditions need to be addressed before automated AI coding can be used safely at scale. AI acceleration in this state is likely to produce more debt and more risk, not more value.
Remediation required before AI coding tools or libraries are deployed. Investing in AI tooling on this codebase without first addressing structural conditions will produce AI-accelerated entropy — more code, more debt, more risk, less value.
AI acceleration compounds existing structural failures. This is not a barrier to AI adoption — it is a signal that the codebase itself requires urgent attention independently of any AI initiative.
AI Readiness assessment applies at every stage where AI coding tools or libraries meet existing software — from pre-deployment evaluation to M&A due diligence to ongoing governance.
The State of AI in 2025: Agents, Innovation, and Transformation. November 2025.
State of AI in the Enterprise 2026: The Untapped Edge. January 2026.
AI Readiness Assessment Framework — five-pillar reference model (strategy, data, talent, process, infrastructure).
AI Readiness framework — organisational assessment dimensions for enterprise AI adoption.
Software quality characteristics and sub-characteristics — structural quality foundation.
Automated source code quality measures — measurement standards.
Industry-validated benchmark across Healthcare, Finance, Energy, E-commerce, Logistics, and AI/ML platforms.
LinkedIn: "Does Your Software Welcome AI? The Readiness Gap Nobody Is Measuring." June 2026.
Upload your C2M scan result and find out — scored, graded, and ranked against your industry peers.