Playbooks · Executive playbook
The first 90 days of enterprise AI governance
A phased plan from first inventory to tested controls and a board reporting rhythm.
Executive takeaways
- Start with an owner-attributed inventory and explicit decision rights, not a policy library.
- Assess and control the consequential uses first; close the highest-risk exceptions.
- End the quarter with tested controls and a recurring board reporting rhythm.
The first quarter of a governance program should produce visible decisions, not a policy library. The sequence below assumes a standing forum — a governance committee or an existing risk forum with an AI mandate — and an executive sponsor. Adapt the pacing to your organization's scale and regulatory exposure; the phases, not the calendar, are the point.
Days 1–30 — establish visibility and accountability. Assemble the first inventory of AI in use, including features inside purchased software. Assign a business owner to every material entry and record intended purpose, users, data dependencies and autonomy level. Name the forum, its decision rights and its escalation route. Publish interim guidance on what requires review before deployment — most organizations can write this on two pages.
Days 31–60 — assess and control the consequential uses. Select the uses where an error or an unauthorized action would matter most. For each, commission a proportionate risk assessment, confirm access and approval controls are enforced by the surrounding systems, and define what evidence launch or expansion requires. Close the highest-risk exceptions: revoke unused access, remove unowned integrations, restrict actions that exceed the approved scope.
Days 61–90 — test, report and set the rhythm. Commission control testing on the most consequential workflows and review the results with owners. Agree the board reporting pack: portfolio changes, consequential deployments, incidents, exceptions and remediation progress, paired with realized business value. Set the recurring review calendar and the triggers for out-of-cycle escalation — material incidents, vendor changes and proposed expansions of autonomy.
Throughout, resist the temptation to certify. The output of the first 90 days is a defensible operating record: who owns what, which controls operate, what was tested, what remains open. Run a governance diagnostic with the forum to structure the baseline, then treat the findings as a work queue, not a score to publish. This playbook is general executive guidance, not legal, regulatory or audit advice.
General executive guidance, not legal, regulatory or audit advice. Diagnostics are self-assessments, not certifications or independent assurance.
← All insights