30-60-90 Day AI Implementation Roadmap

How to use this document

• What it is for. It is the start-up plan for AI governance and adoption during the first 90 days, and the map that shows which document comes first, which it depends on and which it feeds. It avoids adopting documents in an order that forces you to redo them.
• Who should own it. The AI lead, sponsored by Management. Each task has its own owner in Section 4.
• Decisions to take first. Identify your usage profiles (P1 to P5) and your level (basic, standard or reinforced) with Section 2; decide the date of day 1 and who sponsors the plan.
• Fields to complete. Replace [ORGANIZATION NAME], [OWNER], [DATE] and each [COMPLETE]. Timings are indicative: a small organization can go faster; a regulated one, slower.
• What to keep. In Section 3, keep only the row for your level and the blocks for the profiles you have; in Section 4, tasks marked with a profile that does not apply can be deleted.
• Country variants. None. Documents that depend on a specific country's rules are flagged in Section 6; see "Related regulatory references."
• Review. The AI lead reviews progress with Management every two weeks; Legal and Information security review the tasks that affect them.
• Approval. Management approves the plan on day 1 and its close-out on day 90, together with the decision on the plan for the following 12-18 months.

30-60-90 Day AI Implementation Roadmap

Field	Value
Organization	[LEGAL ENTITY NAME]
Plan owner	[OWNER] (AI lead)
Sponsor	[COMPLETE: member of Management]
Day 1	[DATE]
Planned close-out (day 90)	[DATE]
Usage profiles	[COMPLETE: P1 / P2 / P3 / P4 / P5]
Level	[COMPLETE: basic / standard / reinforced]

1. Purpose and principles

1.1 This plan sets how [ORGANIZATION NAME] puts in place, within 90 days, AI governance proportionate to its size and to its actual use of AI, without slowing adoption.

1.2 It follows four principles:

a) Contain first. On day 1 an acceptable-use rule is published, because staff already use AI tools, authorized or not.
b) Know what exists. Nothing is assessed or prioritized without an inventory of what is already in use.
c) Prioritize before piloting. Only a use case that has gone through the proposal, the risk classification and the prioritization enters a pilot.
d) One record, one place. Each record has a single source document (Section 6.3); the others point to it.

2. Profiles and levels

2.1 Usage profiles (cumulative: an organization can be P1 + P2 + P5):

Profile	Means
P1	Uses AI inside software it buys: assistants (ChatGPT, Copilot, Gemini…) and AI features in SaaS applications
P2	Integrates models through APIs or RAG into its own processes or products
P3	Hosts models on its own or rented infrastructure, including open-weight models from any origin
P4	Trains or fine-tunes models
P5	Uses agents that act in systems (send, buy, change records, run code)

2.2 Levels:

Level	Use when
Basic	Under ~50 people, only P1, no special-category data and no decisions about people. Roles can be held by one or two people
Standard	Default for everyone else
Reinforced	Any High-risk system, regulated sector, or P3-P5 in production