AI Governance Is Seventy Percent Change Management

AI governance is mostly change management. Writing the rules takes less of the work than getting people to follow them, so plan the first hundred days the way BCG's rule plans AI transformation, with about 70% of the effort on people.

This piece is for whoever has just been named to lead AI governance and has roughly a hundred days before someone asks whether it is working. My claim is that most of those days belong to people, and that the first people to recruit are the ones who doubt the idea but can still be persuaded.

Where Does the Seventy Percent Come From?

From BCG. Its leader's guide to transforming with AI, published in December 2024, says the companies setting the pace "are guided by the 10–20–70 rule: 10% of a company's efforts should be focused on algorithms, 20% on technology and data, and the remaining 70%... on people and processes." The rule covers AI transformation in general, and it measures effort; it says nothing about where value comes from. Applying it to governance is my own step.

I take that step because governance changes how people build and buy AI, and a policy nobody follows changes nothing. The artefacts are the smaller share. Minimum Viable Governance (MVG) produces the inventory, the risk register, the named owners and the deployment gate in 90 days with three people. Getting product teams, buyers and managers to use them is the larger share, and it rarely appears in the plan.

The survey evidence fits, though none of it measures governance effort directly. McKinsey's state of AI survey, published in March 2025 from 1,491 responses collected in July 2024, tested 25 attributes against the profit companies reported from generative AI. CEO oversight of AI governance was, in McKinsey's words, "one element most correlated" with that profit. Only 28% of respondents said their CEO held that job, and 17% said the board did. Of twelve adoption and scaling practices, tracking well-defined KPIs had the most impact, yet fewer than one in five respondents said their organisations did it, and fewer than a third followed most of the twelve. These are correlations in self-reported data, so they show where companies fall short. They do not prove cause.

Failure studies say something similar. RAND interviewed 65 experienced data scientists and engineers in 2024 and found that "misunderstandings and miscommunications about the intent and purpose of the project are the most common reasons for AI project failure."

What Happens in the Hundred Days?

The plan runs beside the 13 weeks of MVG. MVG builds the artefacts; the other streams get people to use them. It borrows its order from Kotter's accelerators (urgency, a guiding coalition, a volunteer army, short-term wins) and checks each person against Prosci's ADKAR: awareness, desire, knowledge, ability and reinforcement.

Days 1 to 30: find the reality and make one visible win. Build the inventory in MVG's first two weeks, and include the tools nobody approved. In IBM's 2025 breach study, one in five organisations reported a breach due to shadow AI, 63% of breached organisations had no AI governance policy or were still writing one, and only 34% of those with a policy audited for unsanctioned AI. Map your stakeholders with four questions: who decides, who uses the systems, who do the systems decide about, and who do colleagues go to when they are stuck. Ask the sponsor to say in public, at an all-hands, that governance is a priority, so the commitment is hard to walk back. Then pick one AI system that many people use, put it through a gate review in under two weeks, and publish what the review found and how long it took. The MVG worksheet has the inventory, the risk register, the gate checklist and a communication plan for each stakeholder group on printable pages.

Days 31 to 60: put people around the inventory. By now the list exists, so the work turns to the people who use it. Name a champion in each department, starting with the persuadable doubters (next section). Train by role: a short briefing for all staff, a working session for managers who approve AI use, and deeper sessions for the teams that build or buy it. In the EU this is also a legal duty: Article 4 of the AI Act has required AI literacy measures since 2 February 2025. Since 27 July 2026, in the wording set by the Digital Omnibus, Regulation (EU) 2026/1744, providers and deployers must "take measures to support the development of AI literacy of their staff", though no specific level has to be guaranteed. Run the second and third gate reviews and publish how long each took.

Days 61 to 100: make it the way work is done. Move the gate into the release path, so a system cannot ship without passing it. The PRIME framework shows how to build those checks into the pipeline. Publish five numbers every month: the median days from request to decision, the share of systems with a named owner, reviews completed, systems changed or stopped by a review, and systems found outside the inventory. In the last two weeks, hold the first quarterly review and ask each team what slowed it down.

Why Recruit the Doubters First?

Because a doubter's word can carry further than yours. The default is to recruit enthusiasts, and Amit Kothari, chief executive of Tallyfy and an AI adviser, names the result: "If your champion network is made up of people who already love technology, you've built an echo chamber. You need the skeptics, the practical operators, the people who will say 'this doesn't work for my workflow' and force you to make it better."

My reasoning is that colleagues expect the governance lead to praise governance, so they discount what the lead says. When the engineer who said the gate would slow everyone down tells the team it caught something they would have missed, people listen. Research on change adds a limit. Julie Battilana and Tiziana Casciaro studied 68 change initiatives in the UK's National Health Service and found that a change agent's close ties to influential fence-sitters raised the odds of adoption, while close ties to outright resisters helped only when the change departed little from existing practice. With bigger changes those ties could become a liability.

So recruit the doubters who are still persuadable, and leave the committed opponents for later. Recruit two or three in the first month. Pick people others already go to for help, in operations, sales or HR as much as engineering. Give them a real say: they can propose changes to the gate checklist, and the governance owner accepts or rejects each one within two weeks, in public.

Give champions review work, too, or the title is empty. At Microsoft, according to its Inside Track account of internal AI governance from March 2026, each organisation has a lead responsible AI champion or co-leads, and the champions "act as subject matter experts, reviewers for the impact assessment process, and points of contact for the teams developing AI initiatives." Champions also carry news upward. A blocker they report in week six that gets fixed by week eight teaches the department more than any announcement.

Five Objections, and Answers That Hold

Each objection has something true in it. Concede that part first, then answer the rest.

"This slows us down." It is right about reviews with no deadline. So set one, for example a decision on a low-risk use within a set number of working days, and publish the median review time every month. If governance does slow teams down, your own numbers will show it and you can fix the step that causes it. People go around controls that are slower than their work, which is why The Best AI Governance Is Invisible argues for making the governed route the faster one.

"We don't have budget." The first 90 days need no new tool, but they do take three people's time for a quarter, so budget for that. The bigger ask comes later, and it should be a share of AI spend. In IBM's 2025 survey of 915 executives, the quarter of companies that spent 10% or more of their AI budget on what IBM calls AI ethics reported, on average over two years, 30% higher operating profit from AI than the quarter that spent 5% or less. That is a correlation, and nobody has published how much loss a governance hire prevents, as the piece on governance ROI explains. When the time comes to ask the board for it, State Your AI Recommendation in the First Sixty Seconds sets out how: the decision and the amount in the first minute.

"Our AI is low risk." Then the risk register will show it, and a low-tier system needs only a yearly review. Models still drift: Vela and colleagues tested four model types on 32 datasets and found temporal degradation in 91% of the 128 pairs. And the riskiest system may be one nobody listed. IBM found that organisations with high levels of shadow AI paid about $670,000 more per breach than those with little or none.

"We already have compliance." A compliance programme reviews policies and contracts, and it rarely tests what a model says to a customer. The law still holds you to it. In Moffatt v. Air Canada (2024), the airline argued its chatbot was responsible for its own statements about bereavement fares. The tribunal said: "It should be obvious to Air Canada that it is responsible for all the information on its website," and ordered it to pay $812.02.

"Let's do it after launch." Retrofitting means auditing a system that customers and staff already depend on, with data you now have to check backwards. The Liability Ledger treats every obligation a system ships without as a debt from that day, at a rate that rises the longer it stays unpaid.

What Should Be True on Day 100?

Count behaviour, because a document count tells you little. By day 100:

1. Every AI system in the inventory has a named owner who can pause it.
2. At least three gate reviews are done and published, with their times.
3. Each department has a champion, and at least two of them started as doubters.
4. Training by role is under way, with a record of who has had which session, and the five monthly numbers go to someone outside the governance team.
5. The first quarterly review has changed at least one rule because a team showed it did not work.

The last item matters most. If the review changed nothing, either the rules were perfect or nobody was listening, and the rules are never perfect. A better sign still: teams bring a new system to the gate before anyone asks them to.

What If the Company Has Fifty People?

Then the plan takes three weeks. In week one, name one owner and list every AI system, including the ones nobody approved. In week two, ask MVG's Family Test of the top three: would I be comfortable if this system made this decision about my family? Write a one-page acceptable use policy. In week three, set one gate before anything new goes live. At that size the seventy percent is mostly one honest conversation with each team.

Sources and Changes

• BCG, "The Leader's Guide to Transforming with AI", 12 December 2024.
• McKinsey, "The state of AI: How organizations are rewiring to capture value", 12 March 2025. 1,491 participants, 16 to 31 July 2024.
• James Ryseff, Brandon De Bruhl and Sydne J. Newberry, "The Root Causes of Failure for Artificial Intelligence Projects and How They Can Succeed", RAND RR-A2680-1, 13 August 2024.
• IBM, "IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications", press release on the Cost of a Data Breach Report 2025, 30 July 2025.
• IBM Institute for Business Value, "The AI ethics trust engine", October 2025. 915 executives.
• EU AI Act Article 4, as replaced by Regulation (EU) 2026/1744, Official Journal, 24 July 2026; application date in Article 113, point (a).
• Amit Kothari, "How to build an AI champions network that actually drives adoption", 10 March 2026.
• Microsoft Inside Track, "Responsible AI: Why it matters and how we're infusing it into our internal AI projects at Microsoft", 26 March 2026.
• Daniel Vela and colleagues, "Temporal quality degradation in AI models", Scientific Reports 12, 8 July 2022.
• Moffatt v. Air Canada, 2024 BCCRT 149, 14 February 2024.
• Julie Battilana and Tiziana Casciaro, "Overcoming Resistance to Organizational Change: Strong Ties and Affective Cooptation", Management Science 59(4), April 2013.
• Kotter, "The 8-Step Process for Leading Change"; Prosci, "The Prosci ADKAR Model".

All sources checked on 6 October 2026.

Changes on 6 October 2026. Cut from about 4,000 words to a reference under a new headline, with the plan set beside the MVG build. BCG's 10-20-70 rule is now quoted from BCG's own page as a split of effort; the earlier version called it a split of value. Withdrawn: the claim that a $200,000 governance hire prevents $2.24 million in expected losses, about 11 times its cost, which multiplied figures from two different surveys. Removed: vendor-blog speed and incident figures, other statistics I could not trace to their surveys, seven custom graphics, a download box and a canvas prompt.