The Cichocki Advisory 90-Day AI Governance Roadmap: Plan to Production for Boards

Most AI governance programs arrive at the same crisis point: the executive team has approved the plan, the slide deck looks credible, and six months later there are no shipped controls. The board asks "what changed?" and the answer is some combination of policy documents, vendor evaluations, and organizational anxiety. Cichocki Advisory's 90-day roadmap is designed to break that pattern.

This is the gap my 90-day implementation roadmap is designed to close. The cadence is deliberately tight: a governance program takes a long time to mature, but its first 90 days determine whether it ships anything at all.

Why 90 days, not 18 months

The case for a short first cycle isn't speed for its own sake. It's that AI governance is operationally complex enough that without a shippable artifact every 30 days, the program stalls. Boards lose confidence. Executive sponsors get reassigned. Risk teams default to "no" on AI proposals because there's no governance machinery to evaluate them.

The 90-day roadmap is designed to produce three concrete artifacts — one per 30-day phase — each independently usable even if the program changes direction.

Phase 1 (Days 1-30): Inventory and decision rights

Week 1-2: Risk-tiered AI inventory

Every AI system in scope, classified by autonomy, consequence, and data sensitivity. A comprehensive inventory often surfaces AI usage that was missing from the executive view, including shadow AI (employee-driven SaaS subscriptions), embedded AI in third-party platforms, and AI components inside vendor products that nobody catalogued.

The deliverable is a single document — the AI inventory — that becomes the foundation for everything downstream. NIST AI RMF terminology gets layered onto this inventory in week 3.

Week 3-4: Decision-rights matrix

For the two higher risk tiers (Tier 3 and Tier 2), who approves what, and what evidence do they need? Decision rights are documented by role (CISO, General Counsel, Head of Risk, business unit GM, etc.) — not by individual. This is what makes the matrix survive leadership transitions.

The deliverable is the decision-rights matrix and a one-page board summary that the executive sponsor can present at the next governance committee meeting.

Phase 2 (Days 31-60): Embedded controls

Week 5-6: Lifecycle gates

The lifecycle workflow that gets applied to every Tier 3 and Tier 2 AI system: ideation → data readiness → build → pre-production → deployment → ongoing monitoring. Each gate has named approvers and explicit exit criteria.

Critically, the gates don't try to cover everything. They cover the highest-risk paths first. Tier 1 (low-impact) systems get a lighter-weight version of the same workflow in Phase 3 or later.

Week 7-8: Telemetry and evidence packages

For each gate, what evidence is required, where does it live, who reviews it, and how is it stored for audit? This is the work that turns AI governance from policy into practice. Without evidence packages, the gates are theatrical — they look like controls but produce nothing the board or an auditor can examine.

The deliverable is the evidence specification plus a sample evidence package for one Tier 3 (high-impact) system, end-to-end.

Phase 3 (Days 61-90): Board-ready and continuous

Week 9-10: Board reporting cadence

The quarterly board package that summarizes AI governance posture, risk distribution, exception trends, and forward-looking investment. Format matters: most boards want a four-quadrant maturity view, an exception roster, and a forward-look. Anything more is unread; anything less is unsupportable.

Week 11-12: Continuous-improvement loop

The mechanism by which operational AI governance feedback flows back into policy. This is the loop that prevents governance drift — the failure mode where policies stay static while AI deployment evolves around them.

The deliverable is the continuous-improvement charter (cadence, attendees, escalation paths) and the first quarterly review's agenda.

What ships at day 90

By day 90, the roadmap targets this end state:

1. A complete tiered AI inventory.
2. A documented decision-rights matrix for top-tier systems.
3. A lifecycle workflow with named gates and approvers.
4. An evidence specification with one fully-worked example.
5. A board reporting package.
6. A continuous-improvement charter.

The target end state at day 90 is: the board has reviewed all six artifacts; the executive team has signed them; at least one Tier 3 (high-impact) AI system has completed the full lifecycle and produced its evidence package; Risk and Legal have signed off on the controls. A strong implementation reaches this state; outcomes will vary with organizational readiness, scope, and resourcing.

This is what the 90-day roadmap is designed to deliver — not the end of the broader AI governance program, but a working system on day 91 that boards and regulators can examine. Cichocki Advisory's methodology is structured around this 90-day shape.

What 90 days does NOT cover

To be honest: the 90-day roadmap doesn't deliver everything. What it intentionally defers:

• Tier 1 (low-impact) system coverage — these get lighter-weight controls in months 4-9.
• Vendor third-party risk integration — addressed in months 3-6 once the internal inventory is stable.
• Cross-jurisdiction regulatory mapping (EU AI Act, sector-specific rules) — addressed when the organization's regulatory footprint requires it.

What you can do this week

If your organization hasn't started this work and you're trying to figure out the lowest-friction first step:

1. Convene a working group with: CISO, General Counsel, Head of Risk, one business unit GM, one engineering leader. Five people total.
2. List every AI system the group can name. Don't classify yet. Just list.
3. Identify the most autonomous, highest-consequence one. That's where governance investment goes first.
4. Decide who approves changes to it. Document the decision in writing. That's your day-one decision-rights artifact.

The rest is sequence, and the roadmap is a method you can run yourself. If you want help applying it, start with the Evidence Diagnostic on one workflow; the follow-on, if it fits, is a Sprint (2–4 weeks). To talk it through first, book a discovery call.