A structured 90-day implementation tool for building your first AI governance structure. Includes AI system inventory, risk register, accountability matrix, the Family Test, and sprint planner.
By Ajay Pundhiraskajay.ai/toolsVersion 1.3 · Updated 2026-10-04
One model, three stages: Assess, days 0 to 90 → Align, months 3 to 6 → Assure, ongoing. This worksheet covers Assess; the Governance Playbook worksheet covers Align and Assure.
How to Use This Worksheet
Assemble a small governance team: a governance owner (by name), one business stakeholder and one technical lead. Three people is enough to start. More than five slows you down.
Work through the four phases sequentially (GOVERN → MAP → MEASURE → MANAGE) over 90 days. Each phase builds on the previous one.
Apply the Family Test at two checkpoints: before adding any system to your inventory (GOVERN), and before opening any deployment gate (MANAGE).
Use the sprint planner on the final page to assign owners, dates, and accountability for each phase.
Review at 90 days, then begin Align (months 3 to 6) with the Governance Playbook worksheet, which builds each MVG artifact out into one of five layers.
MVG is a starting point.
Every artifact you create in this worksheet is a NIST AI RMF-compatible artifact at an early maturity stage. Nothing gets thrown away. The 90-day sprint builds a foundation that grows into full enterprise governance through the AAA path (Assess → Align → Assure).
The Family Test
Would I be comfortable if this AI system made this decision about my family?
Apply at two checkpoints: (1) Before adding any AI system to the governance inventory
(2) Before opening any deployment gate. If the answer is no, stop and investigate.
Brand commitments behind this worksheet
Governance is what gets enforced. A council on the org chart that has not met, or a policy nobody references, scores no better than no governance at all. Score this worksheet against what is enforced today. Next quarter's roadmap does not count.
MVG is the starting line. Every artifact you build here is a NIST AI RMF-compatible artifact at an early maturity stage. Nothing gets thrown away when you graduate to full enterprise governance.
MVG Quick-Start Diagnostic
Before working through the full 90-day plan, answer these four questions to assess your governance starting position. If you answered “no” to two or more, your organisation is a candidate for MVG. Start with question one.
1. Can you list every AI system currently in production or pilot? If no, your first MVG action is an AI inventory. You cannot govern what you cannot see. Start here; it takes days.
2. For each AI system, can you name the person accountable for its outputs? If no, you have a governance ownership gap that MVG's GOVERN phase addresses in two weeks. The owner is a person, by name, and never a committee.
3. Do your AI systems have a human escalation path for high-stakes outputs? If no, your AI is operating without a safety net. A company answers for what its AI tells people: in Moffatt v. Air Canada (2024) the airline was held liable for its chatbot's wrong advice on bereavement fares. Build escalation paths before expanding capability.
4. When was governance last reviewed against actual system performance? If “never” or “more than six months ago,” governance has become a document that nobody uses. The 90-day sprint restores it to an operating discipline.
Build an AI system inventory. A list is enough; full data lineage comes later.
AI System / Tool
Owner / Team
Decisions Influenced
Risk Tier
Family Test Pass?
Question 2: What could go wrong?
For each system, name the three most consequential failure modes and rate each one: how likely it is (L, M or H) and how severe it would be (L, M or H). Three is enough; this is a short list, kept short on purpose.
High: Affects a person's rights, safety, money or job. A VP or a named executive approves; reviewed monthly, with an external audit for the most critical.
Medium: Shapes business decisions or customer experience. The AI lead approves; reviewed quarterly.
Low: An internal tool with no consequential output. The team self-certifies; reviewed yearly.
AI System
Risk Tier
Failure Mode 1 (likelihood / severity)
Failure Mode 2 (likelihood / severity)
Failure Mode 3 (likelihood / severity)
Question 3: Who decides?
Assign a governance owner for each system: one person, by name, with authority to pause a deployment. A committee can advise.
AI System
Governance Owner (Name)
Authority Level
Escalation Path
GOVERN Phase Checkpoint
You should now have three artifacts: (1) an AI system inventory, (2) a prioritized risk register with 3-tier scoring, and (3) an accountability matrix with named owners. These translate directly to NIST GV-1.6, MAP-5.1, MG-1.2 and GV-2.1.
Weeks 3–6
MAP: Understand Context
NIST RMF: MAP-1.1 (Context) · MAP-5.1 (Impacts)
For each AI system in your inventory, map its context and impact.
Who is affected by this system's outputs? Identify all stakeholders: customers, employees, partners, regulators. Distinguish between direct and indirect impact.
What data does this system use, and where does it come from? Map data sources, consent basis, and any personal or sensitive data categories.
Is this system internal-only, customer-facing, or decision-support? The deployment context determines the governance intensity required.
What regulatory requirements apply? EU AI Act risk classification, GDPR, industry-specific regulations (HIPAA, financial services, etc.).
Context & Impact Matrix
AI System
Stakeholders Affected
Data Sources
Deployment Type
Regulatory Scope
Impact Level
MAP Phase Checkpoint
You should now have a context analysis and impact assessment for each system. These translate directly to NIST MAP-1.1 (Context Documented) and MAP-5.1 (Impacts Documented).
Weeks 7–10
MEASURE: Set Baselines
NIST RMF: MS-1.1 (Metrics Selected) · MS-2.4 (Monitored in Production)
What does "good" look like? Define performance metrics: accuracy, fairness metrics, response time, error rate. Set specific thresholds.
How will you detect drift? Identify monitoring approach for model performance, data quality, and fairness metrics over time.
What triggers escalation? Define the specific thresholds that move from "monitoring" to "investigate" to "pause deployment."
Performance Baseline & Drift Monitoring
AI System
Key Metric
Baseline Value
Alert Threshold
Pause Threshold
Review Cadence
MEASURE Phase Checkpoint
You should now have performance baselines and drift metrics for each system. These translate directly to NIST MS-1.1 (Metrics Selected) and MS-2.4 (Monitored in Production).
Weeks 11–13
MANAGE: Make Operational
NIST RMF: MG-1.1 (Proceed or Not) · MG-2.4 (Authority to Pause) · MG-4.1 (Post-Deployment Monitoring) · MG-4.3 (Incidents)
Human escalation paths: For each system, who gets called when something goes wrong? Define the chain from alert → investigation → decision → communication.
Incident response procedures: What happens when a model produces a harmful output? Document the specific steps, not just "investigate and remediate."
Review cadence & deployment gates: How often is governance reviewed against actual system performance? What must pass before new AI capability goes live?
Deployment Gate Checklist
Before any AI system goes live, verify:
Family Test applied: the governance owner confirms they would accept this system's decisions about their own family
AI system is in the governance inventory with named owner
Risk tier assigned, and the top 3 failure modes identified with likelihood and severity
Context and impact analysis completed (stakeholders, data sources, regulatory scope)
Performance baselines set with alert and pause thresholds
Human escalation path documented and tested
Incident response procedure documented
Review cadence scheduled for the system's tier (monthly, quarterly or yearly)
MANAGE Phase Checkpoint
You should now have response protocols, deployment gates, and a review schedule. These translate directly to NIST MG-1.1, MG-2.4, MG-4.1 and MG-4.3. You now have a governed AI deployment.
MVG → NIST Artifact Translation
Every MVG artifact translates directly into a NIST AI RMF subcategory. Nothing is discarded in Align: each artifact becomes the first entry in one layer of the Governance Playbook, shown in the last column.
MVG Artifact (90 Days)
→
NIST RMF Subcategory
Phase
Layer (Align)
Governance Charter
→
GV-1.4: Policies and Controls
GOVERN
Policy
Accountability Matrix
→
GV-2.1: Roles and Responsibilities
GOVERN
People
AI System Inventory
→
GV-1.6: AI System Inventory
GOVERN
Policy
Context & Impact Analysis
→
MAP-1.1: Context Documented
MAP
Process
Risk Register (3 Tiers)
→
MAP-5.1 and MG-1.2: Impacts Documented, Treatment Prioritised
MAP / MANAGE
Process
Performance Baselines
→
MS-1.1: Metrics Selected
MEASURE
Tooling
Drift Monitoring
→
MS-2.4: Monitored in Production
MEASURE
Tooling
Escalation Paths
→
MG-4.1 and MG-4.3: Appeal, Override, Incidents
MANAGE
Process
Deployment Gates
→
MG-1.1: Proceed or Not
MANAGE
Process
Authority to Pause
→
MG-2.4: Disengage or Deactivate
MANAGE
People
MVG Readiness Scorecard
Rate your completion of each phase. Circle: Not Started / In Progress / Complete.
GOVERN (Weeks 1–2)
Not Started
In Progress
Complete
MAP (Weeks 3–6)
Not Started
In Progress
Complete
MEASURE (Weeks 7–10)
Not Started
In Progress
Complete
MANAGE (Weeks 11–13)
Not Started
In Progress
Complete
Days to First Governed Deployment
Target: 90 days | Track your actual timeline against the 13-week plan
90-Day MVG Sprint Planner
Assign ownership, dates, and accountability for each phase.
Weeks 1–2
GOVERN: Establish Ownership
Build the AI inventory, risk register, and accountability matrix. Apply the Family Test to every system.
Owner:
Target completion date:
Weeks 3–6
MAP: Understand Context
Complete context and impact analysis for each system. Identify stakeholders, data sources, and regulatory scope.
Owner:
Target completion date:
Weeks 7–10
MEASURE: Set Baselines
Define performance metrics, baseline values, alert and pause thresholds, and monitoring cadence.
Owner:
Target completion date:
Weeks 11–13
MANAGE: Make Operational
Document escalation paths, incident response procedures, deployment gates, and review schedule.
Owner:
Target completion date:
Day 90
Checkpoint: First Governed Deployment
Review all four phase artifacts. Verify deployment gates pass. Begin Align (months 3 to 6) with the Governance Playbook worksheet, whose planner starts at week 14.
90-day review date:
Key learnings and next priorities for Align phase:
Notes & Observations
MVG-to-Change-Management Bridge
The 90-day MVG sprint creates governance artifacts, and people still have to change how they work. This section bridges the MVG sprint to organizational change management, preparing your team for the cultural shift that governance requires.
Post-Sprint
After MVG Sprint Completion: What Changes?
Completing the MVG sprint means the organization now has governance artifacts that did not exist before. These artifacts require new behaviors from every stakeholder group.
AI systems cannot be deployed without passing the deployment gate checklist
Every AI system has one named person accountable for its outcomes
Risk tiers set governance intensity: high-tier systems are reviewed monthly, medium quarterly and low yearly
The Family Test is applied when a system enters the inventory and before every deployment
Incident response procedures exist and have been communicated to all relevant teams
Stakeholder Communication Plan
Governance succeeds or fails on communication. Each stakeholder group needs a different message, through a different channel, at a different frequency.
Stakeholder Group
Key Message
Channel
Frequency
Owner
Executive Team
Governance accelerates AI value and reduces board-level risk exposure
Leadership briefing
Monthly
AI / ML Teams
Governance gives you clearer requirements upfront and reduces post-deployment firefighting
Team standup, Slack/Teams
Weekly during rollout
Business Units
Governance protects your AI investments from regulatory disruption and reputational damage
Town hall, department meetings
Quarterly
Legal / Compliance
MVG artifacts answer named NIST AI RMF subcategories, which shortens later regulatory preparation
Working session, shared documentation
Bi-weekly
Board of Directors
AI governance is operational risk management: known exposure, tracked reduction, fiduciary duty
Board report, quarterly presentation
Quarterly
Resistance Anticipation & Response
Every governance initiative encounters resistance. Anticipating it is half the battle. These are the three most common objections and evidence-based responses.
Resistance #1: “This slows us down”
The most common objection from engineering and product teams.
Response: Governance slows delivery when it runs as a separate track. MVG puts one gate inside the existing release path, scaled by tier: low-tier tools self-certify, so the gate is light where the risk is low. What it saves is the rework after launch, the incident and the rollback. Unstructured deployment is fast until it fails.
Resistance #2: “We don’t have budget”
The default objection from finance and operations.
Response: MVG needs the time of three people for 90 days. It needs no new team and no new tool. Set that against one incident in a system nobody can pause: in Moffatt v. Air Canada (2024), a tribunal held the airline liable for what its website chatbot told a customer. The first 90 days cost time, and the incident costs more.
Resistance #3: “Our AI is low risk”
The complacency objection from teams that believe their AI is “just internal” or “just recommendations.”
Response: Then the risk register will show it, and a low-tier system needs only a yearly review. Models still change as the world does: a 2022 study in Scientific Reports found temporal degradation in 91% of the 128 model-and-dataset pairs it tested, four standard models on 32 datasets (Vela et al., 2022). And “internal only” AI that touches hiring decisions or performance evaluations affects people’s jobs, which puts it in the high tier.
Other resistance encountered and responses developed:
First 30 Days After MVG: Quick Wins Checklist
Momentum matters more than perfection. These five quick wins demonstrate governance value within the first month and build organizational buy-in for the sustained change ahead.
Publish the AI System Inventory internally. Making the inventory visible signals that governance is real. Teams see their systems listed with named owners. Transparency creates accountability.
Run the Family Test on your highest-risk system. The system’s governance owner asks it, with the business stakeholder and technical lead in the room. Document the outcome. If the answer is “no,” you have your first governance intervention, and your first proof of value.
Complete one deployment gate review for a new AI system. Use the deployment gate checklist from the MANAGE phase. A single successful gate review creates a template for all future deployments and proves the process works without slowing delivery.
Send the first governance status report to executive sponsors. Include: number of AI systems inventoried, risk tiers assigned, first Family Test results, and the 90-day roadmap. Executives who see progress continue to sponsor it.
Schedule each system's first review on its tier's cadence. Put the dates on the calendar now: a month out for high-tier systems, a quarter for medium and a year for low. A scheduled review creates a deadline.
Quick Wins Completed
Target: all 5 within 30 days of MVG sprint completion
/5
What comes next: Change Management at Scale.
This bridge section covers the first 30 days after MVG. For the full change management method (stakeholder mapping, cultural change and resistance management), see AI Governance Is Seventy Percent Change Management.
Glossary
Definitions used throughout this worksheet. These align with the canonical MVG article.
MVG (Minimum Viable Governance). A 90-day, four-phase implementation path (GOVERN → MAP → MEASURE → MANAGE) that produces a defensible AI governance baseline using NIST AI RMF-compatible artifacts at an early maturity stage.
GOVERN (Weeks 1–2). Establish ownership. Build the AI system inventory. Assign a named accountable owner for every system. NIST RMF: GV-1.4, GV-1.6, GV-2.1.
MAP (Weeks 3–6). Risk classification. Apply the Context & Impact Matrix to every inventoried system, starting with the high tier. Determine which require deeper assessment. NIST RMF: MAP-1.1, MAP-5.1.
MEASURE (Weeks 7–10). Performance baselines and drift monitoring. Define what “working as intended” means for each system, and how you will detect when it stops. NIST RMF: MS-1.1, MS-2.4.
MANAGE (Weeks 11–13). Deployment gate, incident response, sustaining cadence. The control surface that decides what ships and what gets pulled. NIST RMF: MG-1.1, MG-1.2, MG-2.4, MG-4.1, MG-4.3.
The Family Test. “Would I be comfortable if this AI system made this decision about my family?” Applied at two checkpoints: before adding any system to the inventory, and before opening any deployment gate. If the answer is no, stop and investigate.
Trust Premium. The measurable business advantage that accrues to organizations whose AI systems are governed, auditable, and trustworthy. Quantified in the companion Trust Premium framework.
Risk tiers. High affects a person's rights, safety, money or job. Medium shapes business decisions or customer experience. Low is an internal tool with no consequential output. The Governance Playbook uses the same three tiers.
AAA path (Assess → Align → Assure). One model in three stages. Assess is the 90-day MVG sprint itself. Align (months 3 to 6) builds each MVG artifact out into its layer of the Five-Layer Governance Stack (Policy, Process, Tooling, People, Assurance), to which all 72 NIST AI RMF subcategories are mapped. Assure is ongoing: each system is reviewed on its tier's cadence.
Evidence Base
This worksheet is the operational layer of a published, sourced framework. The sources and the NIST mapping live in the canonical article below.