A 90-day AI governance plan for the board

Days 1–30: find out what is actually running

Most organisations cannot list the AI already making or shaping decisions in their operations. The first month is an honest inventory: what models and AI features are in use, who owns them, what decisions they influence, and which of those decisions carry real risk. This builds on the questions in our governance checklist.

The deliverable is a list the board believes — not a policy document.

Days 31–60: decide what must be provable

Not every AI decision needs the same rigour. Classify the inventory by stakes, and draw the line explicitly:

• Low-stakes: speed matters, light-touch oversight is fine.
• High-stakes: must be sealed, auditable and attributable to a responsible owner.
• Off-limits for now: decisions no one can yet make accountable.

Days 61–90: set the one rule and a cadence

The simplest durable control is a single rule: no high-stakes AI decision goes to production unless it is provable and owned. Pair it with a quarterly review of the inventory and any incidents. That is enough to change behaviour without freezing the business.

Boards that want the sharper version of the oversight question can start from why sovereign AI is now a board-level question.

Outcome over activity

Ninety days should end with three things you did not have before: an inventory you trust, a stakes-based classification, and a go-live rule with teeth. That is more governance than most organisations achieve in a year of frameworks. If you want a second set of eyes on the plan, talk to us.