AI Governance & Board Blueprint
Who decides, and what the board tracks. Decision rights, AI committee, usage policy and AI Act compliance — with the board narrative and the KPIs that hold it to account. For the CEO, the chief risk officer, the head of AI or an operating partner.
PRICE
€15,000
DELIVERY
4 weeks
REVIEW
Signed by a partner
§ 01 · The problem
"Who decides which AI ships? Nobody knows. So nothing ships."
As AI scales, governance breaks first. Business units launch tools without legal review. Legal blocks projects without business context. Risk gets bolted on after the fact. Meanwhile the EU AI Act timeline keeps approaching — and the board starts asking who, exactly, owns AI risk.
This Signature installs the operating system before the chaos — policy, decision rights, committee, AI Act mapping, risk register — and gives the board the narrative and the KPIs to follow it.
§ 02 · What you get
An operating model, and the story the board will follow.
Six deliverables that turn AI governance from a slide into a working system — and give the board a narrative it can track quarter after quarter.
DELIVERABLE 01
AI policy framework
12-15 page master policy: acceptable use, prohibited use, data handling, vendor approval, employee AI usage. Drafted for your context, ready for legal review.
DELIVERABLE 02
Decision rights, RACI & committee
Who decides what, at which threshold, across business, IT, legal, risk and data. Committee membership, cadence and escalation paths. The matrix that ends the "who owns this?" loops.
DELIVERABLE 03
EU AI Act map & risk register
Current and planned AI systems classified by risk tier, compliance gaps sequenced against the enforcement timeline, and the 15 to 20 risks that matter, each with an owner.
DELIVERABLE 04
Board narrative
The story your board will read: quantified ambition, credible roadmap, named risks. Built for a board, executive committee or investor meeting.
DELIVERABLE 05
Defensible KPIs
Three to five KPIs the board can track, each with a baseline, an owner and a quarterly review. The numbers that turn an ambition into a commitment.
DELIVERABLE 06
Rollout playbook
90-day deployment plan: announcement, training, first committee meeting, first audit cycle. The runway that turns the documents into operational reality.
directors
ExCom
CTO
unit
§ 03 · Process & timeline
Four weeks. Five sessions. An operating model and a board story.
From policy drafting to the board session, co-designed with your legal, risk and AI teams from day one.
WEEK 1
Framing & AI inventory
90-min framing session + AI systems inventory across business units. We map what's deployed, in pilot, in roadmap. Risk-tier classification first pass.
WEEKS 1–2
Policy & RACI drafting
Master policy drafted to your context. RACI co-designed with stakeholders. Decision thresholds calibrated. Committee charter sketched.
WEEK 2
Stakeholder review
90-min session with legal, risk, business sponsors. Pressure-test the RACI, surface objections, calibrate thresholds. The political conversation that determines adoption.
WEEK 3
AI Act, risks, board narrative
Compliance map finalised, risk register populated, board narrative and KPIs drafted with their baselines. All deliverables consolidated and cross-referenced.
WEEK 4
Handover & rollout kick-off
Final session with the executive sponsor: walkthrough of all deliverables, board narrative rehearsed, 90-day rollout confirmed, first committee date set.
§ 04 · Frequently asked
Six honest answers to common questions.
Aren't you replacing what our legal/compliance team should do?
No — we deliver the working scaffolding your legal team would have built if they had 6 months and AI-specific experience. They review, refine, own it. We accelerate the path from blank page to defensible model. They keep the keys.
How current is your EU AI Act knowledge?
We track the regulation actively — Acts entered into force, implementing acts being adopted, national transpositions. The compliance map we deliver reflects the state as of your engagement date and flags pending uncertainties explicitly. We don't pretend to be lawyers and we don't pretend not to be informed.
Do you commit to a specific committee structure?
We propose a default structure (5-7 members, monthly cadence, escalation to Comex) but the charter is adapted to your existing governance. Forcing a parallel committee on top of your existing risk or transformation committees creates friction. We integrate, we don't duplicate.
What if our AI inventory is incomplete?
Most are. We've built a discovery workflow for the inventory phase — 30-min interviews with each business unit lead, plus targeted searches across IT and procurement systems. We surface the shadow AI you didn't know you had. This is often the most valuable part of the engagement.
How does this connect with AI Strategy Readiness?
Readiness scores your governance maturity among four other dimensions; this Signature installs the operating model and the board narrative. Diagnostic first, blueprint second — though each works on its own.
Will this slow down our AI initiatives?
On balance, no. Risk-proportionate gating means low-risk projects ship faster, with no unnecessary review, and high-risk ones are not blocked indefinitely because decision rights are clear. Teams report fewer last-minute legal blocks, not more.
§ Ready when you are
Install AI governance before the audit forces you to.
€15,000, four weeks, signed by a partner. The operating model that lets AI scale — and the board story that holds it to account.