30‑Day Implementation Checklist (AI Safety Pack)
Version: v1.0
How to use
- Treat this as a project plan + evidence checklist.
- Add Owner and Evidence for each item (policy link, config screenshot, log extract, training report).
Week 1 — Foundations (Days 1–7)
| Item | Owner | Evidence (example) |
|---|---|---|
| Confirm AI tool inventory (approved vs shadow) | IT/Sec | tool inventory doc + list of unapproved tools |
| Publish AI Use Policy (01-ai-use-policy.md) | Risk/Legal | signed policy link |
| Publish Approved/Prohibited 1‑pager (02-approved-prohibited-usecases.md) | Risk | published doc |
| Stand up use‑case intake + register (02a-ai-use-case-matrix.md, 07-use-case-register-template.md) | Risk/PMO | register created + first 5 rows |
| Assign named owners (IT, HR, Legal, Risk, Comms) | Leadership | RACI / owner list |
| Create AI incident reporting channel + triage owner (C‑I1) — include near‑miss reporting | Security | channel + playbook |
Week 2 — Tooling controls (Days 8–14)
| Item | Owner | Evidence (example) |
|---|---|---|
| Implement access controls (RBAC/SSO/MFA) for approved tools (C‑A1/C‑A2) | IT | IdP/IAM config screenshot |
| Configure logging/monitoring baseline (C‑L1) | IT/Sec | SIEM dashboard link |
| Implement DLP guidance/blocks for restricted data (C‑D2) | IT/Sec | DLP policy + alert test |
| Add vendor due diligence checklist to procurement (C‑V1) | Procurement | checklist + workflow |
| Create Use‑Case Cards for top 3 Conditional use‑cases (07-use-case-card-template.md) | Business owners | 3 cards linked from register |
Week 3 — Workflow safety (Days 15–21)
| Item | Owner | Evidence (example) | |---|---|---| | Deliver baseline training (60–90 min) + quiz (C‑T1) | HR/Risk | attendance + quiz results | | Configure human review workflow for customer‑facing drafts (C‑H1) | Support/Comms | workflow config + sample approvals | | Start QA sampling for customer‑facing outputs (C‑Q1/C‑Q3) | Support/Risk | weekly QA report | | Create grounding rules / escalation playbook for support | Support | KB/prompt guidelines |
Week 4 — Governance + steady state (Days 22–30)
| Item | Owner | Evidence (example) | |---|---|---| | Run first governance review (approved use‑cases + exceptions) (C‑G1) | Risk Committee | minutes + decisions | | If any exceptions exist: create/renew EDRs with expiry (C‑G3) | Risk/Legal/Privacy | completed EDRs + review calendar | | Run first access review for AI tools (C‑A1) | IT/Sec | access review report | | Update risk register based on incidents/near‑misses | Risk | updated register rows | | Validate “no restricted data in unapproved tools” via audit sampling | IT/Sec | audit results | | Set quarterly cadence (governance + QA + access review) | PMO/Risk | calendar invites |
Deliverables by Day 30 (minimum)
- Approved tools register + access controls
- Published policy + 1‑pager + intake matrix
- Use‑case register + cards for top use‑cases
- Risk register for top use‑cases
- Logging/monitoring baseline
- Incident reporting + triage
- Completed training + evidence