Does every company need the same number of phases?

No. Combine or divide phases to fit the scope and available people. Preserve the important dependencies: understand the use, authorize its boundaries, implement the checks, and review evidence before expanding.

Should the roadmap start with buying a governance platform?

Start by identifying the workflow and the changes it needs. Then choose tools that support those requirements. A purchase does not settle ownership or show that a proposed control works.

What happens when a phase misses its target date?

Review the blocker, remaining work, and possible effect of delay. Change the plan explicitly rather than treating the date as permission to skip an exit check.

Can a successful pilot authorize all future AI use?

No. Its evidence applies to the tested scope and conditions. A different use, information source, or action permission needs review before you assume the same approval applies.

AI Governance Roadmap: From Inventory to Ongoing Review

Build AI governance in phases with a clear owner, a useful deliverable, and an exit check for each stage. Keep implementation separate from a policy launch.

September 15, 2026Updated October 21, 20266 min read

An AI governance roadmap is a phased plan for putting ownership, rules, controls, and review into everyday AI use. Give each phase an accountable person, an observable result, and an exit check before expanding the work. A shared record such as fenbs keeps the approved choices and implementation tasks available across people and assistants; it does not enforce the controls in other systems.

Discover real AI use and select an initial workflow with a clear boundary.
Name the decision maker and agree permitted uses, prohibited actions, and escalation.
Implement the required checks in the systems where the work happens.
Run a bounded pilot and verify ordinary use, refusal, and recovery.
Expand only after the exit checks pass, then maintain a review routine and change triggers.

What makes a roadmap actionable?

A calendar full of policy meetings is not enough. The plan must connect a governance choice to a change somebody can demonstrate. “Complete approval policy” leaves a question open; “show that a customer message waits for its named reviewer” makes the intended behavior visible.

Give every phase a small set of deliverables, dependencies, and conditions for moving forward. The same person may do several jobs in a small company, but identify which responsibility they hold when making each choice. A budget owner approving a pilot does not automatically approve every use of its outputs.

The NIST AI Risk Management Framework (opens in a new tab) organizes risk work around Govern, Map, Measure, and Manage. The phases below are a practical implementation sequence, not NIST’s mandated schedule. Use the AI governance hub for the broader set of questions, and AI governance strategy for choosing the outcomes the roadmap should serve.

A phase ends when its evidence is ready
Phase	Useful deliverable	Exit check
Discover	A bounded inventory of actual uses	Workflow owners confirm inputs, outputs, and actions
Decide	Approved boundaries and named authority	People can explain what needs approval and from whom
Implement	Controls and operating instructions	An allowed case works and a prohibited case is refused
Pilot	Results and unresolved findings	The authorized person reviews evidence and remaining limits
Maintain	An operating review routine	Changes and concerns lead to an identified next action

How do you scope the discovery phase?

Ask teams to describe work, not just software subscriptions. For each use, identify the purpose, the information involved, the output, the people affected, and whether AI can take an external action. Include informal experiments. A purchased tool can be unused, while an ordinary account can support an important business workflow.

Choose a first workflow whose owner can participate and whose boundaries you can test. Say an internal operations team uses AI to draft weekly project summaries. Start with drafts for that team rather than adding customer communications, staffing recommendations, and automatic publishing to the same pilot.

Mark what you have not discovered. “Inventory confirmed for this team’s summary workflow” is an honest milestone; “all AI is governed” is not. The everyday examples in using AI at work can help people describe uses without learning new technical vocabulary.

Which decisions must precede implementation?

Before granting access, have authorized people choose what the assistant may read, produce, and change. Specify where human review is required and who can pause use. If a proposed use involves obligations the team cannot interpret, obtain the necessary specialist review before treating it as approved.

For the summary pilot, a decision could permit drafting from approved internal notes while requiring a person to check names, dates, and claims before distribution. Name the person who can approve a broader use later. Keep unresolved requests open rather than letting a convenient experiment turn into implied permission.

A decision belongs in the record with its reason, scope, and decider. The small-team governance guide covers the practical responsibility boundaries. In fenbs, Decisions and rules make the agreed instructions available to the next connected assistant before it continues implementation.

How fenbs helps

Turn each phase into work with a reason

Keep human-approved boundaries in Decisions and rules and create tasks for the work needed to put them into practice. Add each exit check to the relevant task plan, then record the actual test result. Where we left off tells the next assistant which phase is ready and which choice still needs a person.

Create a free account

Free for one person · No credit card · Works with Claude, ChatGPT, Cursor and more

What should the pilot demonstrate?

Test the permitted workflow, a request outside the agreed boundary, and a failure that needs recovery. For the summary pilot, demonstrate drafting from an approved example, refusal of access to an excluded source, and the path for correcting an inaccurate draft. A good answer in one conversation does not establish that access restrictions work.

Keep expected results separate from observed results. Record which account, settings, and workflow were tested, using safe test material. If a control depends on a person noticing a problem, test whether that person has enough information and time to do so. Revise the workflow when the proposed oversight is unrealistic.

The NIST Manage playbook (opens in a new tab) calls for considering whether an AI system should proceed and for monitoring risks and benefits after deployment. At the pilot gate, an authorized person should choose to proceed, narrow the scope, gather more evidence, or stop. Record the remaining limitations whichever route they choose.

When can you expand beyond the first workflow?

Expand when the team can repeat the workflow and explain its limits, not merely when a target date arrives. Carry forward controls that still apply, then assess what changes in the next setting. Customer-facing output, new information, or permission to act can require different checks even when the underlying AI app stays the same.

Separate reusable work from assumptions tied to the pilot. A rule about who approves external communication may transfer; a test using one internal source does not verify a new customer database connection. Make each dependency visible so the next team does not inherit an approval that was never intended for it.

Add the people who will actually use the new workflow to the expansion check. Can they identify the reviewer and report a concern? If they need practice, arrange AI governance training around their real responsibilities rather than treating attendance as the final exit condition.

How to do this with fenbs?

Create a free account and add a project for the first workflow. A personal account is free for one person, no credit card.
Create tasks for discovery, decisions still needed, control changes, and pilot verification. Write the deliverable and exit check in each task’s plan.
Record the authorized people’s choices in Decisions and rules. Assistants can record what people chose, but cannot decide or sign off themselves.
Update testing results after the real checks. Save progress with the next phase, remaining limits, and anything waiting on a person so another assistant can continue.

fenbs is a place for the implementation record. It does not deploy access controls or monitor model behavior. If your immediate requirement is automatic enforcement, use the systems that provide it and keep references to their checks alongside the work.

How does the roadmap become ongoing work?

Name a continuing owner before the pilot ends. Set a review interval that fits the workflow, plus triggers such as changed permissions, a new source, a serious error, or a different intended use. At each review, ask whether the original conditions still hold and what evidence supports that answer.

Keep the record small enough to maintain. Close completed implementation tasks with their checked results, retain unresolved questions, and turn a repeated mistake into a lesson. A shared AI brain is useful here because the next session needs the current decision and next action, rather than a fresh retelling of the entire rollout.