AI governance in practice: a 90-day plan

In most organisations, AI arrived before the rules did. Staff began using public assistants to draft emails and summarise documents, vendors switched on AI features inside existing software, and teams built small tools of their own. Few of these choices were reviewed, and many leadership teams could not say with confidence how much AI is in use today.

That gap now has a cost. IBM and Ponemon’s 2025 Cost of a Data Breach research found that 13% of organisations reported breaches of AI models or applications, and 97% of those lacked proper AI access controls. Among breached organisations, 63% had no AI governance policy or were still developing one, and incidents involving widespread shadow AI added about $670,000 to the cost of a breach.

Governance does not need to be a two-year programme. The essentials, an inventory, a policy, risk tiers, proportionate controls and a reporting line to the board, can be in place within 90 days. This guide sets out how.

Before you start: who owns this

Appoint one accountable executive for the programme and a small working group. The group should include technology, information security, legal or compliance, data protection and at least two business leaders whose teams use AI heavily. Keep it small enough to make decisions in a single meeting.

Agree the scope at the outset. A practical definition covers any tool, model or software feature that generates content, makes predictions or recommendations, or takes actions based on learned patterns, whether built in-house, bought or used through a public service.

Weeks 1 to 4: see and set rules

The first month is about visibility. You cannot govern what you cannot see.

Build the inventory

Inventory the AI tools and models in use, including those staff adopted on their own. Combine three sources: a short survey of department heads, a review of software licences and vendor release notes for AI features, and network or expense data showing which AI services are being accessed or paid for. Expect surprises. The shadow AI figure in the IBM research reflects how common unmanaged use has become.

For each item, record what it does, who uses it, what data it touches and who owns it. Name an owner for every entry. An AI tool without an owner is the first thing to fix.

Write an acceptable-use policy

Write a short policy, two or three pages, that staff can actually read. It should answer a few plain questions.

Publish the policy with a short explanation from the accountable executive, and offer an approved alternative wherever you restrict a popular tool. Bans without alternatives push use further into the shadows.

Weeks 5 to 8: tier the risk

Not every AI use deserves the same scrutiny. Drafting an internal newsletter and screening job applicants are different activities with very different consequences. A simple tiering scheme lets you focus effort where it matters.

• Low risk: internal drafting, summarising non-confidential material, coding assistance with review. Controls: approved tools, the acceptable-use policy and periodic spot checks.
• Medium risk: customer-facing content, internal analysis that informs management decisions, processing of confidential business data. Controls: approved tools only, access controls, human review before release and logging.
• High risk: uses that affect people, money or safety, such as hiring, credit, pricing, medical or safety-related decisions. Controls: formal assessment before launch, testing for accuracy and bias, human approval of outcomes, full logging and regular review.

Classify every item in the inventory. Where a high-risk use is already running without adequate controls, decide quickly whether to pause it, add controls or accept the risk formally, with the accountable executive’s signature.

Tiering should be quick, not academic. Give the working group a one-page set of questions for each use: does it affect an individual’s rights, finances, health or employment; does it touch personal or confidential data; is its output used without review; would an error be hard to reverse? Two or more yes answers usually indicate a higher tier. Record the reasoning in a sentence or two, so the decision can be revisited when the use changes.

Weeks 9 to 13: test, monitor and report

The final phase turns rules into routine.

1. Test accuracy, bias and security before launch for medium- and high-risk uses, using realistic data and documented test cases.
2. Set monitoring for drift, incidents and cost, with named people who review the results monthly.
3. Define an incident process: how AI-related problems are reported, assessed, contained and learned from.
4. Agree a simple quarterly report to the board covering use, risk tiers, incidents and open actions.

Keep the board report short. One page showing the number of AI uses by tier, any new high-risk uses, incidents and their resolution, and progress on open actions is enough for most boards to exercise oversight.

Testing need not be elaborate for every system. For a vendor feature, it may mean reviewing the vendor’s documentation, running a set of realistic cases and checking where data is stored. For an in-house model that informs credit or hiring decisions, it means structured testing across different groups, documented results and sign-off by the owner before launch. Proportion is the principle throughout.

Map to recognised standards

You do not need to adopt a standard wholesale to benefit from it. ISO/IEC 42001 describes an AI management system, the NIST AI Risk Management Framework offers a structure for identifying and managing risk, and the EU AI Act sets legal requirements for AI that affects people in the EU.

Mapping your controls to these makes audits and customer questions easier. When a large customer sends a due-diligence questionnaire about your AI use, a control set already referenced to a recognised framework turns a week of work into an afternoon. If you operate in or sell into the EU, check early which of your uses may fall into the Act’s higher-risk categories.

Keep the mapping simple: a table listing each of your controls, the tier it applies to and the clauses or functions it supports in each framework. It becomes the backbone of internal audit work and a useful check for gaps.

Governance is not a brake on AI. It is what lets you use it at scale with confidence.

Keep it alive

Governance decays if it is treated as a one-off project. Review policies when tools, data or regulations change, and at least once a year. Run an incident drill, for example a simulated leak of confidential data through an AI tool, to test whether people know what to do. Keep the inventory current by making AI approval part of normal procurement and project processes.

Above all, keep one person accountable for the programme. At day 90, the test is simple: can you say which AI is in use, who owns it, how risky it is and what controls apply? If you can, you have a foundation to build on. If not, you know exactly which gaps to close next.

Source: IBM and Ponemon, Cost of a Data Breach Report 2025; ISO/IEC 42001; NIST AI RMF; EU AI Act.

Frequently asked questions

What is shadow AI?

AI tools and services used by staff without the organisation's knowledge or approval, often public assistants used for everyday work with company data.

Do we need ISO/IEC 42001 certification?

Not necessarily. Mapping your controls to it and to the NIST AI RMF is useful on its own. Certification becomes worthwhile if customers or regulators ask for it.

Should we ban public AI tools?

Outright bans tend to push use underground. A clear policy on what data may be used, plus approved alternatives, works better.

Explore AI governance, risk and compliance