AI Governance Program: 30/60/90-Day Implementation Plan

An AI governance program rolled out on a 30/60/90-day plan converts scattered policy artefacts into an enforceable operating loop. Days 1-30 stand up the charter, name the committee, and seed the initial risk register. Days 31-60 wire the audit cadence, model-update review process, and incident runbook so drift is caught while still cheap. Days 61-90 layer the ethics framework, the enforcement metrics that distinguish documented from operative governance, and the quarterly hand-off that makes the program sustainable past launch.

Most AI governance programs fail not at design but at enforcement. A charter that lives in Confluence with no escalation path, a risk register populated once and never revisited, an audit cadence that slips every time engineering hits a milestone — the artefacts exist, the enforcement does not, and the gap between the two is where incidents live. The 90-day plan exists to compress the investment that closes that gap into a window short enough to sustain executive attention and long enough to stand up the full operating loop.

This guide walks each thirty-day phase with its five named milestones, the enforcement design that separates documented from operative governance, the template kit teams need to ship the plan, and the four failure modes that consistently break programs in the field. The audience is the team running the program — governance lead, executive sponsor, engineering and security partners — not the team that has to sell the program to a board. By day 90 the artefacts exist, the cadence is operating, and the governance function has handed itself a quarterly rhythm it can run without bespoke executive air cover.

Ninety days is the smallest window that fits the full governance operating loop and the largest window that holds executive attention without slipping. Shorter and the work compresses into artefact production without the cadence design that makes the artefacts useful; longer and the program loses the momentum it needs to push through the enforcement decisions that produce disagreement. The 30/60/90 split mirrors the natural rhythm of the work: standing up the charter, wiring the operating cadence, and proving the program runs without bespoke air cover.

The reason most governance programs miss the window is the same reason most programs over-invest in the charter and under-invest in everything else. The charter is the visible artefact, the one an executive sponsor signs, and so it absorbs disproportionate attention. Meanwhile the cadence, the register methodology, the incident runbook rehearsals, and the ethics forum design — the actual operating loop — get squeezed into the final two weeks. The 90-day plan exists to redistribute attention from the visible artefacts to the invisible operating rhythm that makes governance bite.

The other failure mode worth naming is the 12-month rollout disguised as a strategic program. Twelve months of governance design produces zero enforcement until month twelve, at which point the design that was finalised in month two is already stale. Ninety days is short enough to ship something, observe how it behaves under real incidents, and revise from contact with reality rather than from a quarterly steering committee meeting that never gets the data it needs.

The 30/60/90 split is not arbitrary. Each window has a structural reason. Days 1-30 are charter and register because without those two artefacts the work in days 31-60 has no anchor — the audit cadence cannot run without something to audit, the incident runbook cannot escalate without somebody to escalate to, the model-update review cannot decide without a register to update. Days 31-60 are operating cadence because the cadence is what produces the data that feeds days 61-90 — the enforcement metrics, the ethics forum's first cases, the quarterly hand-off readiness check. Days 61-90 close the loop and make the program self-sustaining.

Worth flagging — the 90-day window assumes a small but real standing capacity. A program lead at roughly half time, a committee that can convene monthly at ninety minutes, and partial allocations from engineering, security, legal, and product. Programs that try to run a 90-day rollout with the program lead at five percent and no committee allocations consistently miss day 60 and quietly slide into a 12-month effort. Capacity is the precondition, not the deliverable.

The first thirty days produce two artefacts and the rituals that keep them alive — the governance charter with its committee, decision rights, and escalation path; and the initial risk register populated across the eight canonical categories. Everything in days 31-60 assumes both artefacts exist; producing them at adequate depth in the first window is the load-bearing move of the program.

The five milestones below structure the window. Each names an owner, a deliverable, and the dependency that the next phase inherits. Milestone slippage in days 1-30 cascades into days 31-60 because the audit cadence cannot run against an unfinished register and the incident runbook cannot escalate to an uncommitted committee. Defend these milestones; renegotiate scope elsewhere first.

The structural decision that matters most in days 1-30 is committee composition. Too narrow and the committee cannot see the surface area; too broad and it cannot decide. Five to seven members is the band; getting beyond seven means the committee cannot ratify a charter in a single meeting and the program slips its first milestone. The chair rotation is the second decision that matters more than teams expect — eighteen months is long enough to learn the role and short enough that no single person becomes the de facto definition of governance.

The most common day 1-30 failure mode is over-investing in charter prose. The charter is a contract artefact; it does not need to read like a thought-leadership essay. A four-page charter with explicit decision rights and a working escalation path beats a twelve-page charter with three pages of mission statement. If the program is spending more than seven days on charter prose, redirect to the register — the prose can mature over the next quarter, the register cannot start producing decisions without a baseline.

The second window wires the operating cadence onto the artefacts. Audit rhythms get stood up at three nested cadences; the model-update review process is wired into engineering CI so silent vendor swaps cannot occur; the incident runbook is drafted and rehearsed at least once before day 60. By the end of the window the committee is no longer just ratifying a charter — it is running the artefacts the charter authorised.

The cadence work is where governance programs most commonly drift. Annual audits collapse three different time horizons into one ceremony; the 90-day plan replaces that with weekly, monthly, and quarterly rhythms that each have a different audience, deliverable, and escalation path. Wiring all three rhythms in the same window prevents the failure mode where the monthly stands up but the weekly never does and the quarterly slips into the next year.

The model-update review is the highest-leverage milestone in this window. Vendors ship new model versions every few weeks; a governance program without an eval gate on production swaps absorbs vendor regressions silently until a customer or an internal eval surfaces them. Wiring the four gates into CI in days 31-60 prevents the standard anti-pattern — "the vendor said it benchmarks better, so we shipped it" — because the vendor's benchmark is not your eval suite, and your eval suite is the only measurement that gates a production swap.

The incident runbook rehearsal is the second highest-leverage milestone, and the one teams most often defer past day 60. The argument usually sounds like "we will rehearse once the runbook is finalised," which inverts the relationship — the runbook is finalised by rehearsing it. A real incident at day 75 against an unrehearsed runbook is the failure mode the window is designed to prevent. Defend the day 60 rehearsal; it is what proves the runbook works before it has to.

The final window converts the artefacts and cadences from days 1-60 into a self-sustaining program. The ethics framework stands up the forum that handles gray-area use cases; enforcement metrics make the difference between documented and operative governance visible to the executive layer; the quarterly hand-off transfers the program from launch mode to standing rhythm. By day 90 the program runs without daily program-lead attention — that is the test, not whether all the artefacts exist.

The ethics framework milestone is the one most likely to be under-scoped. Teams treat it as a document — a value statement, a checklist, an attestation — and miss that the value is in the structured forum that convenes before implementation on disputed use cases. The 90-day plan treats the framework as the forum's charter rather than a free-standing artefact; the framework defines who attends, what they decide, how the decision is recorded, and what the appeals path looks like.

The enforcement metrics dashboard is the most important deliverable in days 61-90 because it is the artefact that makes "governance is enforced or it is theatre" visible to the executive layer in a single screen. Five levers, one page — the page is the difference between a governance program the executive sponsor can defend at a board meeting and a program that exists on a wiki nobody opens. The dashboard becomes the standing artefact for the quarterly executive review.

The hand-off milestone is the test of whether the previous eighty-nine days produced a real program. A 90-day rollout that still depends on the program lead pushing at day 91 has not handed off; it has just relocated the dependency. The hand-off is real when the monthly committee meeting fires without a reminder from the program lead, the weekly engineering health check holds without escalation, the quarterly executive cadence lands on calendar six months out without renegotiation. Day 91 looks like day 121 — that is the win condition.

The single most common failure pattern in AI governance is the document that exists but does not bite. A charter signed off by an executive sponsor that nobody references in a real decision. A risk register populated once and never revisited. An audit cadence on the calendar that gets moved every time engineering hits a milestone. The artefacts exist; the enforcement does not; the gap between the two is where incidents live.

Five enforcement levers separate documented governance from operative governance. Each lever takes a written rule and pairs it with a mechanism that makes the rule operative. The 90-day plan wires all five into the program — the charter has its escalation path, the register has its quadrant walk, the audit cadence has its rhythm, the model-update process has its CI gates, the ethics forum has its concept-stage routing. A program with any of the five levers missing is still partly theatre.

Worth flagging — the levers are not independent. A charter with an escalation path but no quadrant-walked register leaves the committee adjudicating without baseline. A model-update CI gate without an audit cadence catches the swap but never reviews the swap-rate or the regression frequency. The five levers reinforce each other; partial implementation produces less than partial value. The 90-day plan wires all five because a governance program with three of them is still theatre on the other two.

For teams that want to map this against an audit framework, our 50-point vibe-coding policy audit cross-walks every enforcement lever to the audit points that would surface its absence. Running the audit at day 30 produces a baseline; running it again at day 90 produces a delta that quantifies the program's actual enforcement uplift.

The template kit below is the minimum viable artefact set for the 90-day plan. Three templates anchor the work — the charter contract, the risk register schema, and the audit cadence playbook. Two adjacent templates round out the kit — the model-update review process and the incident runbook — but they are documented at depth in the companion Stage 8 governance templates kit.

The YAML expressions below are contract artefacts, not production formats. Teams almost never use YAML in operating governance — the working artefacts are usually Confluence pages, Notion workspaces, or shared spreadsheets. Writing the contract first forces the structural decisions to be explicit before the prose softens them.

Worth pulling out — the audit cadence playbook is the template teams most often improvise rather than codify, and improvising it is what produces the "the weekly slipped, the monthly absorbed it, the quarterly never ran" failure pattern. Writing the standing agenda for each rhythm before the rhythm starts running protects the rhythm against ad-hoc reshuffling in week six.

Four failure modes consistently break 90-day governance programs in the field. Each fails in a different window for a different reason. Calling them out before the program starts is the cheapest insurance the program can buy; recognising them mid-program is the second cheapest.

For teams running the 90-day plan in parallel with broader transformation work, our AI transformation engagements include the program lead capacity, the committee facilitation, and the first quarter of cadence operation — so the team inherits a working program rather than a template kit it has to assemble while also shipping product.

The 90-day plan is also a natural follow-on from a Stage 8 governance templates engagement. If the team has already stood up the templates via the Stage 8 pipeline kit, the 90-day plan converts the templates into an operating program rather than a documented capability. The two artefacts are complementary — templates without a plan stay on a wiki, plans without templates run on improvisation.