Governance is a chain of steps that hand off to each other. A document is the output of a step. A principle stays a value until something measures it on a live system. A policy has no existence outside somebody’s working day.
The sequence is deliberate: inventory, scope, assessment, ownership, controls, evidence, audit. Each stage produces what the next one needs, and whether an auditor gets an answer depends on that chain holding.
This is the shape of an ISO/IEC 42001 implementation and the shape of an AI Act readiness programme, because both run on the same chain.
The sequence
Ninety days is the usual span for these first stages. How long each one takes is set by the organisation, and stages overlap.
What is actually running.
An AI inventory covering systems, tools and use cases, including the ones nobody registered. Shadow AI tells you the approved route is harder than going around it. Classification of what is found, and role determination in each case. Scope of the AIMS decided against the inventory.
A risk method people can run.
An AI risk assessment method your teams can run without me, and AI system impact assessment where the applicable framework requires one. A risk model that only the governance function can operate will only ever be run by the governance function.
Ownership.
Roles, decision rights, approval routes. For each control, the step where it happens and the person who holds it. This is the part that gets skipped, and it decides everything after it.
Controls where the work is.
Criteria in release gates. Agent lifecycle from intake through deployment and monitoring to retirement. Integration with the risk, security, procurement and vendor processes you already run.
Evidence and a first audit.
Records that accumulate as a by product of the work. A first internal audit, run against the evidence a certification body looks for.
What you end up holding
An AI system register. An AI risk assessment method and its records. AI system impact assessments. A statement of applicability. Vendor assessment criteria. A governance operating model with named roles. AI incident management, classification and handling. An approval workflow. A control matrix. Internal audit findings and management review records.
Adoption is the other half
A governance function that only ever says no produces shadow AI and very little else. The number worth watching is how many use cases reached production on an approved route, with a record of who decided and on what basis.
I have worked from the enablement side too: putting AI assistants into a business function and writing a group AI use policy alongside a CTO.
Why process, and not only law
ISO management systems run on a plan, do, check, act model. That is process improvement, and it is the difference between a system that runs and a folder that exists.
I came to it through Lean Six Sigma and through eight years of putting corporate governance in order across 180 entities and 35 jurisdictions, where the same discipline produced over 150 thousand euros in savings. The mechanics I use here are the ones I used there.
What I do not do
I do not start by writing forty procedures. Documents are outputs of steps, so if the step does not exist the document has nowhere to be produced and nowhere to be found later.
I do not deliver a plan and leave. The controls have to sit in somebody’s workflow before I am finished, or the whole thing reverts within a quarter.