AI governance roadmap: your first 90 days

Why the order matters more than the speed

Almost everyone handed this job starts by writing a policy, and it is the wrong first move for a reason that becomes obvious the moment you look at an inventory.

A policy is a set of decisions: what is permitted, what is prohibited, who approves an exception, what data must never go near a model. Every one of those decisions depends on knowing what is actually in use and what it touches. Written first, the policy prohibits tools that teams already depend on, says nothing about the ones nobody thought to name, and arrives as an edict from someone who evidently does not know how the work gets done.

The cost of that is not non-compliance. It is quiet non-compliance, which is worse, because the activity continues out of sight and you have converted a visible problem into an invisible one. You also spend the credibility you needed for the second conversation.

Where the AI actually is

The middle band is the one that surprises people. It is not shadow IT and nobody circumvented anything: it is transcription in the meeting tool, drafting in the email client, summarising in the ticketing system, all switched on by a supplier in an update to a product that was licensed years ago for something else. No procurement decision was made because there was nothing to procure.

The bottom band grows in direct proportion to how unwelcoming the organisation has been about the subject. That is the mechanism by which a blanket ban makes things worse: it does not reduce use, it reduces disclosure, and the work moves to personal accounts and personal devices where there is no logging, no data agreement and no way to find out.

The sequence that works

First ninety days, in order

1. Weeks 1 to 4Inventorythen
2. Weeks 3 to 6Rank by exposurethen
3. Weeks 5 to 9Policy and approvalsthen
4. Weeks 8 to 12Literacy and evidence

The phases overlap deliberately. Waiting for a complete inventory before starting anything else is its own failure mode, because the inventory is never complete and treating it as a gate means nothing ships in ninety days.

Weeks 1 to 4: find out what you actually have

Weeks 3 to 6: rank by exposure, not by excitement

Notice what that test does not consider: how advanced the system is, how much it cost, or how much attention it is getting internally. The most governance-relevant system in a mid-sized organisation is frequently an unremarkable scoring model in a hiring or credit workflow that nobody describes as AI at all.

Weeks 5 to 9: write the policy, now that you can

You now know what is in use and what it touches, so the policy can make real decisions instead of gestures.

Two of those deserve emphasis. The approval route is the whole policy in practice: if getting a tool approved takes six weeks and a committee, people will not use the route, and everything you wrote above it becomes decorative. Aim for a decision in days, with a named person able to make it.

And accountability for relied-upon output is the clause that matters when something goes wrong. "The model produced it" is not an answer anybody accepts, and the time to establish that is before it is needed.

What is actually required of you, and when

Most published timelines are now out of date, because the Digital Omnibus on AI changed several of these dates and entered into force in mid-July 2026.

EU AI Act, where the obligations stand

Obligation	Status	Date
Prohibited practices	In force	2 February 2025
AI literacy, Article 4	In force, and enforceable from August 2026	Applied 2 February 2025
General-purpose AI model obligations	In force	2 August 2025
Transparency duties, Article 50	In force, not deferred	2 August 2026
High risk, Annex III standalone	Deferred by the Digital Omnibus	2 December 2027
High risk, Annex I embedded in products	Deferred by the Digital Omnibus	2 August 2028

The practical reading of that table is that the obligations already live are the ones about honesty and competence, and the ones deferred are the ones about engineering rigour in high-risk systems. An organisation that concluded from the headlines that AI Act work can wait until 2027 has drawn the wrong inference from a real change.

Weeks 8 to 12: literacy and evidence

Start the evidence habit now rather than reconstructing it later: the inventory with a date on it, the decisions with who made them and why, the training with who attended. Every framework you might later adopt asks for the same things, and reconstructing a year of decisions from memory is both unpleasant and unconvincing.

Who should own this

The most common structural failure is giving AI governance to a group that can advise but cannot decide.

Every genuine question in this area is a trade-off between speed and exposure: can this team use this tool on this data by Friday. Advisory bodies do not resolve trade-offs, they escalate them, and a function that escalates every question quickly stops being consulted. People route around it, which returns you to the bottom band of the diagram above.

So the owner needs two things. Authority to say no and have it stick, and a route to the board that does not depend on somebody else's agenda. The specific title matters much less than those two properties. It works under a CISO, under a general counsel, under a chief data officer, and it fails under all three when the post-holder can only recommend.

There is a second, quieter requirement: the owner has to be somebody teams are willing to tell the truth to. An inventory is only as good as the disclosure behind it, and disclosure depends on what people expect to happen when they admit to using something. If the predictable response to "we have been using this for a year" is disciplinary rather than curious, the next person will not mention it. That is a policy decision as much as a personality one, and it is worth making explicitly and saying out loud at the start.

Finally, the owner should not also be the approver of every individual request. That combination looks tidy and creates the bottleneck described above. Delegate the routine decisions against clear criteria and reserve the owner for the genuinely contested ones.

What not to do

Do not start with a framework. ISO 42001 and the NIST AI Risk Management Framework are both good, and neither answers "what do we have". Adopting a framework before the inventory produces a well-structured document about an imagined organisation.

Do not build a committee first. Governance bodies convened without an inventory spend their early meetings speculating, and a body that has spent three meetings speculating is difficult to take seriously later.

Do not promise the board a maturity score. At this stage such scores measure how much you have written rather than how much risk you have removed, and they create pressure to write more.

Do not ban what you cannot detect. A prohibition you have no means of observing is a statement of preference, and everybody involved knows it.

What day ninety should look like

Not a finished programme. A defensible starting position, which is a different and achievable thing.

You should have an inventory with a date on it, covering all three bands as far as anybody can, with an owner and a data class against each entry. A short ranked list of the systems that matter, ordered by what happens to a person when they are wrong. A policy that makes real decisions, with an approval route that has been used at least once. Evidence that literacy support was offered and recorded. And a named owner with the authority to say no and a route to the board.

That is enough to survive a customer questionnaire, enough to start an ISO 42001 programme from if you decide to, and considerably more than most organisations will have.

What you should not have at day ninety is a finished framework, a maturity score, or a complete inventory. The first two would mean you spent the quarter writing, and the third is not a thing that exists: the estate keeps changing, suppliers keep enabling features, and an inventory is a process rather than a document. Treat the first pass as the point at which maintaining it begins.

Where to go next

The free policy generator on this site asks what your organisation has decided and writes the policy from those answers, marking every decision you have not yet made rather than filling it with a plausible placeholder.

And when you want to know which obligations are actually yours and when, the AI Act tool filters the Act by what you are and what you build.