Free checklist

From no policy to working AI governance in thirteen weeks

A fortnight-by-fortnight plan for a business starting from nothing, or from a ban: a sanctioned tool, a policy people follow, an inventory, the high-risk uses assessed, and a first report to the board.

Download the checklistSee the plan
Before you start

An owner, a day a week, and some help

The plan assumes one owner with about a day a week at first, and support from IT, data protection and HR. A business of twenty will move faster and do less at each step. A business of two thousand will need a working group and more time for the inventory.

None of it needs a certification body or a new department. All of it can be shown to a customer, an auditor, a regulator or an insurer who asks how you govern AI.

The plan

Thirteen weeks, seven stages

Weeks 1–2: decide and look

  • Name the owner, and agree with the board who may accept AI risk.
  • Ask people, privately and without consequence, what AI they use, on which accounts.
  • List the routes to AI today: personal apps, AI inside existing software, API keys.
  • Choose the sanctioned tool, on a business or enterprise plan.
  • Move the directors first.

Weeks 3–4: provide and tell

  • Set up the workspace: single sign-on, retention, and audit logging from day one.
  • Issue the one-page policy and traffic-light card.
  • Brief everyone for twenty minutes, directors first, and record attendance.
  • Draft the literacy plan by role, starting with the people who will oversee tier 3 uses.
  • Update the privacy notices for customers and staff.
  • Close the personal-account route on company devices.

Weeks 5–6: find and sort

  • Build the inventory and tier every entry.
  • File each provider's terms, data processing addendum and sub-processor list.
  • Add the AI workspace to the systems searched for subject access requests.

Weeks 7–8: the uses that matter

  • Complete an impact assessment and decision-rights row for each tier 3 use.
  • For anything that can act, write down what it may do, and test its off switch.
  • Check the EU and other market rules that apply to tier 3 uses.
  • Brief finance on call-backs and two-person approval for payments and bank-detail changes.

Weeks 9–10: evidence

  • Check the main AI suppliers, and test each tier 3 system on real cases before accepting it.
  • Add AI incidents to the existing incident procedure.
  • Start a decision log with every decision made so far.

Weeks 11–12: outward

  • Note the rules in each country your AI use reaches.
  • Decide on standards: align with ISO 42001, certify, or revisit later.
  • Ask your insurance broker how AI is covered.
  • Review client contracts for confidentiality, copyright and AI terms.

Week 13: report and review

  • Send the first one-page report to the board, with the decisions it needs to make.
  • Review the policy: what it did not answer, and which amber uses should become green.
  • Put the governance calendar in the diary for the year.
The starter pack

What you hold at day ninety

Nine artefacts that together are a working, proportionate AI governance system.

  • Policy and card

    The AI policy and traffic-light card, issued and briefed.

  • Literacy plan

    The literacy plan by role, and the training record that shows it happened.

  • Inventory

    Every AI route and use, owned and tiered.

  • Assessments

    An impact assessment and decision-rights row for each high-risk use.

  • Limits

    For each system that can act, what it may do and how to stop it.

  • Supplier checks

    Due diligence and acceptance testing for the systems that need them.

  • Incidents and decisions

    The incident procedure and the decision log.

  • Markets and standards

    The rules in each market your AI use reaches, and your decision on ISO 42001.

  • Board report and calendar

    The first one-page board report, and the governance calendar for the year.

Starting from a ban

End the ban and open the tool on the same day

If AI tools are blocked today, the plan still works, with one change. In week 3, announce the end of the ban and the arrival of the sanctioned tool in the same message. Say why the ban was introduced, why it is being replaced, and what people can now do.

Offer an amnesty: nobody is penalised for past use of personal accounts if they move to the business workspace. It is the fastest way to an honest inventory. See why blocking AI tools makes the data risk worse.

Want help with the ninety days?

GOVERN sets out every step in detail, chapter by chapter. Or we can run the ninety days with you, from the first snapshot to the board report.

Start a conversationGOVERN, the book