Minimum Viable Governance Gets You Governed in Ninety Days

One model, three stages: Assess, days 0 to 90 → Align, months 3 to 6 → Assure, ongoing. You are here: Assess.

Minimum Viable Governance (MVG) is the smallest AI governance that can still stop a system. Every AI system gets three things: a place on a list, a short record of how it could fail, and a named person with the authority to pause it. MVG follows NIST's AI Risk Management Framework, function by function, and reaches its first governed deployment in 90 days.

Updated 4 October 2026 and rebuilt as a short reference. What changed is listed at the end.

Why Do Full Governance Frameworks Stall?

They describe a company that already governs. The NIST AI RMF 1.0 has 19 categories and 72 subcategories across its four functions. ISO/IEC 42001 sets requirements for a complete AI management system. The EU AI Act asks providers of high-risk systems for a risk management system, technical documentation and human oversight. Each is sound. Each assumes a risk team, an owner for every system and the habit of reviewing them.

Most companies start without the list. In a Gartner survey of 302 cybersecurity leaders in March to May 2025, 69% of organisations suspected or had evidence that employees were using prohibited public generative AI tools. You can't govern a system you can't see.

I call this the Readiness Paradox. Governance frameworks need a maturity that only comes from governing. MVG breaks the loop by starting with something small enough to begin this month.

What Are the Three GOVERN Questions?

Start with three questions. A team of three can answer them in two weeks: the governance owner, one business stakeholder and one technical lead.

1. What AI systems do we have? A list, kept short: each tool or model in production or pilot, who uses it and which decisions it touches. Include the generative AI tools staff use on their own. This is the inventory.
2. What could go wrong? For each system, the three failures that would do the most harm, how likely each one is and how bad it would be, and a tier. High means it affects a person's rights, safety, money or job. Medium means it shapes business decisions or customer experience. Low means an internal tool with no consequential output. Together, the failures and the tier make the risk register.
3. Who decides? One person per system, by name, with the authority to pause it. A committee can advise, but nobody can call a committee at four on a Friday afternoon. This is the accountability matrix.

The third question carries the most weight. In Moffatt v. Air Canada, a British Columbia tribunal found the airline liable in February 2024 after its website chatbot gave a customer wrong advice about bereavement fares. Air Canada had in effect argued that the chatbot was "a separate legal entity". The tribunal called that "a remarkable submission". A company answers for what its AI tells people, so someone inside it should own the decision to switch that AI off.

What Happens in the 90 Days?

The plan runs through NIST's four functions in order. Each phase ends with something written down.

• Weeks 1 to 2, GOVERN. Answer the three questions. The output is the inventory, the risk register, the accountability matrix and a one-page charter that says who may approve, pause and retire an AI system.
• Weeks 3 to 6, MAP. For each system, starting with the high tier, record who its outputs affect, what data it uses and where that data comes from, whether it is internal, customer-facing or decision support, and which rules apply. Each system leaves the phase with a context and impact record.
• Weeks 7 to 10, MEASURE. Decide what "working" means for each system: a metric, its baseline, an alert threshold and a pause threshold. Set up monitoring in production. Every system ends the phase with a baseline and a monitoring plan.
• Weeks 11 to 13, MANAGE. Write the escalation path, the incident procedure and the deployment gate checklist, then put the first system through the gate. The output is the first governed deployment and a date for its next review.

How Does Each MVG Artifact Map to NIST?

Every artifact answers a specific NIST subcategory. So MVG is the first stage of the NIST framework. A company that later adopts all of it keeps building on these same documents.

The table covers 12 of the 72 subcategories. Those left for later include diverse teams in risk decisions (GOVERN 3.1), feedback from people outside the team (GOVERN 5) and risk from third-party AI (GOVERN 6 and MANAGE 3). For AI you buy, the vendor scorecard covers the third-party part.

What Is the Family Test?

It is one question, asked by the governance owner at two points: before a system enters the inventory, and before it passes the deployment gate. Would I be comfortable if this AI system made this decision about my family?

Think of it as a smoke detector. The fire code still matters, and the test doesn't replace the risk register. It catches what a checklist can pass: a system that meets every written rule and still treats people in a way nobody inside the company would accept for their own family. If the answer is no, the system waits until someone can explain why it should go ahead.

What Comes After Day 90?

Day 90 closes the first of three stages, which I call Assess, Align and Assure. MVG is the Assess stage. The Governance Playbook covers the other two, in which each MVG document becomes the first entry in one of five layers: Policy, Process, Tooling, People and Assurance. For the people side of those first three months, see AI Governance Is Seventy Percent Change Management.

• Assess, days 0 to 90. The plan above: the inventory, the risk tiers, governance ownership, monitoring baselines and escalation paths.
• Align, months 3 to 6. Build each document out into its layer. Four of them go to Process: the context record, the risk register, the gate and the escalation procedure. The inventory and the charter start Policy, the baselines and monitoring start Tooling, and the named owners become People. The Governance Playbook maps the other 60 NIST subcategories to the layers; start with the gaps above. Add ISO/IEC 42001 if customers ask for it, and the EU AI Act duties that apply to your role. A cross-functional review group belongs here, once the named owners exist.
• Assure, ongoing. Run the Assurance layer. Each system comes back for review on its tier’s cadence: monthly for high, quarterly for medium and yearly for low. The first reviews fall due from the date set at the gate, so they start during Align. Automate monitoring where you can, review the exceptions, and feed what the reviews find back into policy.

When Is MVG Not Enough?

When a failure would do serious harm before anyone could step in. Clinical diagnosis, criminal justice, credit and hiring decisions at scale, and safety systems need their governance designed and tested before they go live. For those systems the 90 days are design work, finished before launch.

MVG doesn't make you compliant either; the questions below explain why. For what comes after day 90, see the Governance Playbook. For why written policy alone fails, see Policy Is Not Control.

The MVG worksheet has the inventory, the risk register, the accountability matrix, the deployment gate checklist and the 13-week planner on printable pages.

Sources and Changes

• NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023, Tables 1 to 4. The NIST AI RMF page, read 4 October 2026, says RMF 1.0 is being revised under the White House AI Action Plan.
• ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system, edition 1.
• EU AI Act Article 4, Article 113 and Annex III, in the EUR-Lex consolidated text at 27 July 2026, as shown on the Commission's AI Act Service Desk; Regulation (EU) 2026/1744, OJ L, 24 July 2026.
• Gartner press release, 19 November 2025.
• Moffatt v. Air Canada, 2024 BCCRT 149, 14 February 2024.

Changes on 4 October 2026. The piece was cut to a short reference. The 90-day plan now runs week by week. The NIST mapping now names subcategories. An earlier figure on this page mapped the risk register to MAP 3 and the deployment gate to MANAGE 3, which cover benefits and costs and third-party risk. The survey statistics were removed because most dated from 2024 and 2025. The Trust Premium section was removed because that argument has its own article. The quick-start diagnostic is now in the worksheet. Later the same day, the page became the Assess stage of one model with the Governance Playbook, which covers Align and Assure. The two pages now share one set of three risk tiers, and the Align and Assure descriptions here follow the playbook's five layers.