Your 90-Day AI Governance Roadmap
AI governance is not a one-time project. But it has a beginning, and the beginning is concrete: a 90-day sprint that establishes the infrastructure on which ongoing governance is built.
Days 1-30: Foundation
Week 1: Governance ownership. Designate a governance owner — not a committee, one person with decision authority. This doesn't need to be a full-time role; at a small biotech, this is often the Chief Legal Officer, the VP of Regulatory Affairs, or the VP of Operations. The key is that there is one person who is accountable.
Weeks 2-3: Data classification. Work through your organization's data types and apply the four-tier classification framework. Document the classification for each major data type and which AI tools are appropriate for each tier. This is the foundation of everything else.
Week 4: Approved tool list. Audit which AI tools are currently in use (you will be surprised). For each tool, determine which data tiers it can be used with and whether it has appropriate DPAs. Publish the approved tool list. Address tools that don't meet requirements.
Days 31-60: Policy and process
Weeks 5-6: Policy draft. Using the structure from the previous lesson, draft the company AI policy. Review with legal, review with functional leads, publish. Target 10 pages or fewer.
Weeks 7-8: Use case library. Work with each function to identify their highest-frequency AI use cases. Assess each against data classification and risk criteria. Publish a library of approved use cases organized by function.
Week 9: Training. Two-hour training for all staff on the data classification framework, the policy, and the approved use case library. Focus on the practical: what can I do, what do I need to check on, what is not allowed.
Days 61-90: Measurement and iteration
Weeks 10-11: Baseline measurement. Assess current AI adoption rates by function. Identify gaps (functions where AI use is low despite available approved use cases) and risks (functions where AI use exceeds governance guardrails).
Week 12: Governance review cycle. Establish the quarterly review cadence. Define what triggers an off-cycle review (new tool deployment, regulatory guidance update, significant AI incident). Designate the review owner.
At day 90, you have a governance system in place. It will need to evolve — AI capabilities and organizational needs change faster than any governance framework anticipates. But you have the infrastructure to manage that evolution, which is the goal.