A small team can set up working AI governance in 30 days: week one inventory and an owner, week two a short policy, week three tiering and vendor checks, week four testing for the top systems and a first review. Keep the documents short and revisit them quarterly.
Week 1: see what you have
- Name an accountable executive and a coordinator.
- Build the inventory from procurement records, single sign-on, repositories and a short team survey.
- Record owner, purpose, vendor or in-house, data touched.
NIST's framework puts an inventory mechanism under GOVERN 1.6, which is why it comes first.
Week 2: write the rules
- Draft a two to four page acceptable use policy: approved tools, data rules, human review, reporting, exceptions.
- Write a half-page risk tolerance statement.
- Agree how new AI tools get approved, with a target turnaround.
Week 3: tier and check vendors
- Score each system using simple criteria (see how to tier AI systems by risk).
- For medium and high systems, review the vendor's data handling, retention, training use and breach notice terms.
- Decide what you will do if a key vendor fails.
Week 4: test and review
- For the top two systems, document how you test quality and security before and after changes. NIST's framework says systems should be tested before deployment and regularly during operation.
- Add AI to your incident plan: what counts, who can switch a system off.
- Hold a first governance review. Record decisions.
What to skip for now
Do not try to cover every Playbook subcategory. NIST says the Playbook is not a checklist. Skip formal certification work until a customer asks for it.
Set a rhythm
Monthly 30-minute review for the first quarter: new systems, exceptions, incidents. Quarterly after that. Re-run discovery quarterly, since new tools appear constantly.
Signs you are on track
- Every system in the inventory has a named owner.
- Staff can find the policy and know how to request a tool.
- At least one test record exists for each high-tier system.
- You can answer a customer's AI questionnaire with documents rather than guesses.
Common stumbling blocks
The usual blockers are unclear ownership, a policy that is too long to read, and no approved tool people actually like. If staff keep using unapproved tools, find out why before adding rules. Another trap is perfect discovery: a rough inventory this week beats a perfect one next quarter. Keep a visible list of open items and close a few each week.
Quick check
Do we need a dedicated person?
Not at first. A coordinator spending a few hours a week is enough for a small team. Accountability matters more than headcount.
What is the first thing to do tomorrow?
Start the inventory. Everything else depends on knowing what is in use.
Sources
- NIST, AI Risk Management Framework 1.0 (NIST AI 100-1)
- NIST, AI Risk Management Framework overview page
Last reviewed: 19 October 2026.
