The AI 90 Playbook

Part 5 of the AI Governance Series

Here’s the problem with AI governance initiatives: they either try to do everything at once and collapse under their own weight, or they start with policies nobody reads and wonder why nothing changes.

The AI 90 Playbook is different. It’s a phased approach that builds governance systematically—starting with what you can see, progressing to what you can control, and ending with what you can prove.

Why 90 Days?

Governance can’t be rushed. But it can’t take forever either. 90 days is the sweet spot:

• Long enough to build real capability, not just documentation
• Short enough to maintain executive attention and urgency
• Structured enough to show measurable progress
• Flexible enough to adapt to what you discover along the way

At the end of 90 days, you should have operational AI governance—not perfect, but functional and improvable.

Why Big-Bang Rollouts Fail

The temptation is to launch everything at once. New policies, new tools, new training, new monitoring—all on Day 1.

Here’s why that fails:

• Change fatigue. Organizations can only absorb so much change. Overwhelming people guarantees resistance.
• Discovery gets skipped. You implement policies for problems you assume exist, not problems you’ve actually identified.
• No feedback loops. Without phased rollout, you can’t learn and adjust.
• Evidence comes last. By the time you think about proof, you’ve missed months of evidence collection.

Phased governance builds capability incrementally. Each phase creates the foundation for the next.

The Trust-Building Element

AI governance can feel like surveillance if handled wrong. The 90-day approach builds trust:

• Phase 1 amnesty: Employees can disclose AI usage without fear of punishment
• Phase 2 enablement: You’re providing approved tools, not just blocking unapproved ones
• Phase 3 transparency: People see that governance is about evidence and improvement, not punishment

Make governance feel like surveillance and your employees will route around you. I’ve watched it happen. Someone announces “no AI tools” and three weeks later the entire sales team is using Claude through personal phones. You didn’t stop the risk – you just stopped seeing it.

Weekly Checkpoints

Each week should have a brief checkpoint:

These don’t need to be long meetings—15-30 minutes keeps momentum without creating meeting fatigue.

Success Metrics by Phase

How do you know each phase is working?

Phase 1 Success:

• AI tool inventory is 80%+ complete
• Leadership understands current state and risks
• High-risk use cases identified and prioritized

Phase 2 Success:

• Core policies approved and communicated
• Training completion rate above 90%
• Approved AI tools deployed with proper configuration
• Monitoring producing actionable data

Phase 3 Success:

• Evidence collection is automated
• Initial risk assessment complete
• Compliance metrics are being tracked
• Improvement roadmap exists and is resourced

Common Pitfalls to Avoid

1. Skipping discovery. Policies without visibility are guesswork.
2. Perfect is the enemy of good. Ship 80% policies and iterate. Don’t wait for perfect.
3. No executive sponsor. Without C-level backing, governance dies in committees.
4. Blocking without enabling. If you ban unapproved tools, provide approved alternatives.
5. Forgetting evidence. Start collecting from Day 1, not Day 90.

What Comes After 90 Days

Day 90 isn’t the end—it’s the end of the beginning. You’ve built foundational governance. Now you:

• Expand coverage to additional use cases
• Deepen controls in high-risk areas
• Mature your evidence collection
• Prepare for audits and assessments
• Continuously improve based on metrics

Governance is a program, not a project. The 90-day playbook gets you operational. What happens next determines whether governance becomes embedded or evaporates.