30-Day AI Governance Quick Start

"We need AI governance."

"Great! Let's form a committee, hire consultants, and have a plan by Q4."

No.

While comprehensive AI governance takes time, you can establish essential protections in 30 days. This guide shows you how.

The 30-Day Sprint Approach

Instead of boiling the ocean, we're implementing:

• Week 1: Inventory and immediate risks
• Week 2: Core policies and controls
• Week 3: Documentation and training
• Week 4: Review and iteration

This gives you a minimum viable governance framework that can evolve over time.

Week 1: Inventory and Immediate Risks

Day 1-2: AI System Inventory

Goal: Know what AI you're actually using.

Actions:

1. Survey departments — Send questionnaire to all department heads:

   • What AI tools are you using?
   • Who approved them?
   • What data do they process?
   • Who has access?

2. Check IT records — Review:

   • Software licenses and subscriptions
   • Cloud service usage
   • Approved application lists
   • Shadow IT reports

3. Common places AI hides:

   • Microsoft 365 Copilot
   • Google Workspace AI features
   • Salesforce Einstein
   • HR systems with AI screening
   • Customer service chatbots
   • Marketing automation tools
   • Financial forecasting systems

Deliverable: Spreadsheet with all AI systems, owners, and risk levels.

Day 3-4: Risk Assessment

Goal: Identify your highest-risk AI uses.

Rate each system on:

1. Data sensitivity (1-5)

   • 1: Public information only
   • 5: Sensitive personal data, financial data, health records

2. Decision impact (1-5)

   • 1: Recommendations only
   • 5: Automated decisions affecting people's rights

3. External exposure (1-5)

   • 1: Internal use only
   • 5: Customer-facing, public impact

Risk Score = Data × Impact × Exposure

Immediate action required if:

• Score > 75 (High Risk)
• Processing sensitive employee/customer data
• Making or influencing hiring decisions
• Used for credit/financial decisions
• Customer-facing with potential for harm

Day 5-7: Quick Wins

Goal: Address immediate risks while planning governance.

Actions:

1. Disable high-risk shadow AI — If departments are using unapproved AI for:

   • HR screening
   • Customer data processing
   • Financial decisions

2. Require approval for new AI — Immediate memo:

   "Effective immediately, all new AI tools require IT and Legal approval before use. Contact [person] for assessment."

3. Document existing high-risk systems — Even if you can't fix them yet, document:

   • What they do
   • What data they process
   • Known risks
   • Mitigation plans

Week 2: Core Policies and Controls

Day 8-10: Draft Core Policies

Goal: Create three essential policies.

Policy 1: Acceptable AI Use

• What AI is permitted for general use
• What requires approval
• What's prohibited
• Data handling requirements

[Template: See AI Safety Pack — 01-acceptable-use-policy.md]

Policy 2: AI Procurement

• Vendor assessment requirements
• Data processing agreements required
• Security and privacy requirements
• Approval workflow

[Template: See AI Safety Pack — 05-ai-procurement-checklist.md]

Policy 3: Incident Reporting

• What constitutes an AI incident
• Who to report to
• Timeline for reporting
• Investigation process

[Template: See AI Safety Pack — 08-incident-response-playbook.md]

Day 11-12: Risk Management Framework

Goal: Establish how you'll track and manage AI risks.

Create:

1. Risk Register Template

   • Risk ID
   • AI System
   • Risk Description
   • Likelihood (1-5)
   • Impact (1-5)
   • Risk Score
   • Mitigation Plan
   • Owner
   • Status

2. Risk Review Process

   • Monthly review of high risks
   • Quarterly review of all risks
   • Annual comprehensive assessment

Day 13-14: Human Oversight Controls

Goal: Ensure humans remain in control of AI decisions.

Implement for high-risk systems:

1. Human-in-the-loop

   • AI provides recommendations
   • Human makes final decision
   • Document rationale for overrides

2. Human-on-the-loop

   • AI operates autonomously
   • Human reviews samples regularly
   • Can intervene if issues detected

3. Human-in-command

   • Human sets parameters and constraints
   • AI operates within boundaries
   • Human can shut down immediately

Documentation:

• Which systems use which oversight model
• Who has oversight responsibility
• Escalation procedures

Week 3: Documentation and Training

Day 15-17: Technical Documentation

Goal: Document your high-risk AI systems.

For each high-risk system, create:

1. System Overview

   • Purpose and functionality
   • Vendor and version
   • Deployment date

2. Data Documentation

   • What data is used
   • Data sources
   • Data retention
   • Access controls

3. Performance Monitoring

   • Accuracy metrics
   • Known limitations
   • Bias testing results
   • Error rates

4. User Instructions

   • How to use appropriately
   • Known issues
   • When to escalate

Day 18-19: Staff Communication

Goal: Tell people about the new governance framework.

All-Staff Email:

Subject: New AI Governance Framework

We're implementing an AI governance framework to ensure we use AI responsibly and safely.

Key Points:

• All AI use must comply with our Acceptable Use Policy [link]
• New AI tools require approval [process]
• Report AI incidents immediately [how]
• Training sessions scheduled [dates]

Questions? Contact [person]

Day 20-21: Initial Training

Goal: Ensure key staff understand new policies.

Priority training for:

1. Leadership — Overview, liability, oversight responsibilities (1 hour)
2. IT Team — Technical implementation, monitoring (2 hours)
3. Department Heads — Policy compliance, risk identification (1 hour)
4. High-Risk System Users — Specific system training (varies)

Training format:

• Live sessions with Q&A
• Recorded for those who miss it
• Short quiz to confirm understanding
• Sign-off required

Week 4: Review and Iteration

Day 22-24: Self-Assessment

Goal: Check what you've built.

Review against baseline:

• [ ] AI inventory complete and current
• [ ] High-risk systems identified
• [ ] Core policies documented
• [ ] Risk register established
• [ ] Oversight controls implemented
• [ ] Key staff trained
• [ ] Documentation accessible

Gap Analysis:

• What's missing?
• What needs improvement?
• What can be simplified?

Day 25-26: Stakeholder Feedback

Goal: Get input from people affected by governance.

Interview:

• Department heads using AI
• IT team implementing controls
• End users following new policies
• Legal/compliance team

Ask:

• What's working?
• What's confusing?
• What's missing?
• What would make this easier?

Day 27-28: Refinement

Goal: Improve based on feedback.

Actions:

1. Clarify confusing policy language
2. Add missing documentation
3. Simplify over-complex processes
4. Create quick-reference guides

Day 29-30: 30-Day Report

Goal: Document what you've accomplished.

Report to Leadership:

AI Governance — 30-Day Implementation Report

EXECUTIVE SUMMARY
- X AI systems inventoried
- X high-risk systems identified
- 3 core policies implemented
- X staff trained
- Immediate risks addressed

CURRENT STATE
[Summary of what's in place]

NEXT 90 DAYS
- [Planned improvements]
- [Additional policies needed]
- [System upgrades planned]

RESOURCE NEEDS
- [Staffing requests]
- [Budget requirements]
- [Tool purchases needed]

What You Have After 30 Days

✅ Established:

• Complete AI inventory
• Risk assessment methodology
• Three core policies
• Risk register
• Oversight controls
• Initial training program
• Documentation framework
• Incident reporting process

🔄 Ready for Iteration:

• Policy refinements based on experience
• Additional controls for emerging risks
• Expanded training program
• Automated monitoring tools
• Regular review cycles

📈 Maturity Level: "Managed"

You've moved from ad-hoc AI use to managed AI governance. You're not done—but you have a foundation that protects your organization while enabling responsible AI use.

Common Pitfalls to Avoid

❌ Don't:

• Try to document every system perfectly before doing anything
• Create policies so restrictive people can't do their jobs
• Forget to get leadership buy-in
• Skip training and just send policy links
• Set up governance and then never revisit it

✅ Do:

• Start with highest risks, improve coverage over time
• Involve users in policy development
• Communicate the "why" not just the "what"
• Make training practical and relevant
• Schedule regular reviews from day one

Resources

Templates:

• AI Safety Pack — Complete policy templates
• Risk Assessment Tool — Coming soon

Professional Support:

• AI governance consultants
• Legal counsel familiar with AI regulations
• Compliance professionals

Training:

• Enterprise AI Governance Guide — Coming soon
• SDAIA AI Ethics training resources

Remember

Perfect governance is the enemy of good governance. You can implement meaningful protections in 30 days, then refine and expand over time.

The goal isn't a binder of perfect policies—it's practical protection that lets your organization use AI confidently and responsibly.

Start today. Iterate tomorrow.