Download the guide (PDF, 23 pages)
AI is probably already inside your organization. It arrived through individual accounts, through features your vendors switched on, or through work product nobody labeled. Governance arrived later, or not at all.
I wrote Regulated AI: From Tools to Systems for the person who owns the regulatory obligation when that happens, rather than the person who administers the network. It assumes you already know your industry. You know what a risk assessment is, what a vendor contract is supposed to say, and what happens when a regulator asks a question you cannot answer. What it adds is the AI governance layer on top of that expertise.
Every section carries at least one framework, scored instrument, or decision tool you can use on your own organization. Here is what is in it, and the few ideas I would most like a reader to leave with.
Three failures that share a root
Part 1 starts with the gap between how much AI is in use and how much of it is governed. That gap shows up in three recurring forms:
- Regulated data entered into public AI tools, under consumer terms rather than a BAA or DPA, with no record that the disclosure happened.
- AI-generated work product with no audit trail. The output may be correct. The exposure is that nobody can reconstruct how a conclusion was reached once somebody challenges it.
- Vendor AI capabilities deployed without due diligence. A product you already license adds AI processing, your contract predates the feature, and nothing triggers a review.
Each one is paired with a cited incident: Samsung’s source code in a consumer chatbot, Mata v. Avianca, and Zoom’s 2023 terms change alongside the FTC’s Premom order. In every case the failure is an absence of systemic control rather than a malicious actor. That matters, because it means the remediation is structural and therefore tractable.
Ungoverned adoption is the riskiest posture
The guide compares three postures: no adoption, ungoverned adoption, and governed adoption. The one that fails worst under examination is the middle one. Ungoverned adoption gets you the benefits and the liability at the same time, and it is where most organizations are sitting right now.
A blanket ban does not get you out of it. It moves AI use onto personal devices where you have no visibility at all, and professional competence obligations do not come with a technology opt-out.
Speed is not the main payoff of doing this properly. The payoff is that performing and documenting an analysis now costs little enough to run it on every change, not only on the ones big enough to justify the hours.
Four readiness dimensions, one scorecard
Part 2 is the working section. “AI-ready” gets used as though it were a single condition. It is a set of conditions across four dimensions: data, documents, governance, and infrastructure. Each has a scored instrument, and each resolves to the same four bands: Absent, Reactive, Defined, Managed.
A few things in these instruments are deliberate and worth knowing before you run them:
- Your governance band is your lowest stage, not your average. The governance matrix covers four artifacts: an acceptable use policy, a vendor due diligence process, an AI incident response protocol, and a committee charter. Governance fails at its weakest artifact, and averaging hides that.
- The vendor process has to start on existing vendors adding AI features, not only on new procurements. That is the trigger most processes miss.
- Documents written for human readers break AI systems. A person tolerates a policy with three revision dates in the header. A model reads all three and treats every one as authoritative.
- The data decision tree is run per use case, not per organization. Its last question is the one that gets skipped: can you reconstruct, six months from now, what the system was given and what it returned? If not, you have a logging gap, not a model gap.
The four results go on one scorecard, and your lowest band sets your starting phase. An organization at Absent on any dimension starts at Phase 1 regardless of how the other three scored.
Four phases, in order
The phases are Inventory, Foundation, Deployment, and Operations. Each one ends in an exit criterion you can check, and each one produces the inputs the next one consumes. Phase 1 ends when you can state what runs where, on what data, under which contract. Phase 2 ends when an employee with a new AI use case has a documented path to approval, and the person who approves it exists.
Phases 1 and 2 are where organizations most often try to save time. They are also the two that determine whether Phases 3 and 4 work at all.
The section closes with a one-page readiness plan template. The row I would look at first is the Owner row, which asks for a name and a role rather than a department. If you cannot fill it in with a person’s name, that is your first problem to solve.
The orchestration layer
Part 3 is the honest accounting. The gap is not capability. The models are good at reading, reasoning, and following instructions. The gap is that nobody gave them the right instructions, and the data they would need is not ready for them.
Federal regulations are machine-accessible but not machine-ready. State regulations are a separate integration per state. Organizational data has the digital attic problem: the material is all there, it is not in one place, and nothing indicates which copy governs. Remediating that is a structured project with human judgment at every stage, not a software install.
Somebody has to sit between the regulatory requirement and the system configuration. At most organizations that work is already happening in pieces, without a name or time budgeted for it. The guide lays out the three ways to fill that role, building it, engaging it, or adopting a platform that encodes it, along with a decision framework for which to start with.
Where to start
Run the four assessments in Part 2 and record the results. That costs you an afternoon and no money, and it tells you which phase you are actually starting from.