Minimum Viable AI Governance: The 90-Day Program for Companies Without an AI Department

Executive Summary

Seventy-seven percent of organizations are building AI governance programs (IAPP AI Governance Profession Report, n=671, May 2025), but almost none started with a CAIO or dedicated team. The practical question for a 200-500 person company is not whether to govern AI, but how to build a program that satisfies regulators, clients, and your own board without creating a bureaucracy that stalls adoption.
A minimum viable governance program costs $75K-$150K in year one and takes 90 days to stand up. That covers a part-time governance lead, five core policy documents, a shadow AI audit, a risk-tiered tool registry, and basic training. It does not require new headcount. It requires reallocating 15-20% of an existing senior leader’s time and assembling a cross-functional steering committee that meets monthly.
The cost of not governing is quantified: shadow AI adds $670,000 to the average data breach (IBM Cost of a Data Breach, 2024), and 63% of breached organizations lacked AI governance policies (ISACA, 2025). Colorado’s AI Act penalties reach $20,000 per violation starting June 2026. The governance investment pays for itself on a single prevented incident.
Organizations with governance programs adopt AI faster, not slower. CSA/Google Cloud (2025) finds companies with comprehensive governance policies have a 46% agentic AI early adoption rate — versus 12% for those still developing policies. Governance is the accelerator. Ungoverned AI is the brake.
The 5% that get governance right do three things: they inventory before they policy, they tier by risk instead of banning by category, and they treat governance as a quarterly practice rather than an annual compliance exercise.

Why Governance Cannot Wait (Even Without a CAIO)

The governance conversation often starts with “We’ll get to that when we’re bigger.” The data says your employees already made that decision for you.

Gartner (2025) finds 68% of employees use AI tools without IT approval. Ninety-eight percent of organizations report some unsanctioned AI use. Shadow AI tool usage increased 156% from 2023 to 2025. The average mid-sized enterprise hosts roughly 200 unauthorized AI tools per 1,000 users (Lasso Security, 2026 compilation). For a 500-person company, that means approximately 100 AI tools you did not approve, processing data you have not classified, with terms of service you have not reviewed.

This is not a hypothetical risk. Fifty-six percent of security professionals acknowledge unauthorized AI use in their organizations (Elvex Shadow AI Report, 2025). Roughly half of U.S. office workers report using AI contrary to company policy. The tools are already in use. The data is already flowing. The only question is whether you know where.

Meanwhile, regulators are not waiting either. Colorado’s AI Act (SB 24-205) takes effect June 30, 2026, requiring annual impact assessments for high-risk AI systems with penalties up to $20,000 per violation. Texas RAIGA (HB 149) has been effective since January 1, 2026. California has multiple AI bills advancing. There is no federal preemption in sight. A company operating across three states faces overlapping obligations today.

Enterprise clients are asking, too. Microsoft’s Supplier Security & Privacy Assurance (SSPA) program v10 now includes AI requirements. Due diligence questionnaires from Fortune 500 procurement teams increasingly ask: “Describe your AI governance program.” Having nothing to describe is a competitive disadvantage in B2B sales.

The Five Documents You Need (And Only Five)

A 200-500 person company does not need a 200-page AI governance manual. It needs five documents that employees will actually read and that satisfy the regulators and clients who will ask for proof:

1. AI Acceptable Use Policy (2-4 pages)

The foundation. This defines what employees can and cannot do with AI tools, what data categories are off-limits, and the consequences for violations. It should classify tools into three tiers:

Tier 1 — Sanctioned: Enterprise-licensed tools with security reviews complete (e.g., ChatGPT Enterprise, Claude for Business, Microsoft 365 Copilot). No restrictions beyond standard data handling.
Tier 2 — Tolerated with restrictions: Free-tier or personal-account tools allowed for non-sensitive work only. No client data, no PII, no proprietary information.
Tier 3 — Prohibited: Tools that failed security review or operate in jurisdictions with inadequate data protection. Blocked at the network level where possible.

Timeline to draft: 2-3 weeks. Adapt an existing template (AIHR, PurpleSec, and Lattice all publish free ones) to your specific data classification scheme and regulatory exposure.

2. AI Risk Assessment Framework (3-5 pages)

A decision tree for evaluating new AI use cases before deployment. Every proposed AI use case gets classified:

Low risk: Internal productivity tools using non-sensitive data. Approve with training acknowledgment.
Medium risk: Tools processing business-sensitive data, customer-adjacent workflows. Require security review, data flow mapping, quarterly monitoring.
High risk: Tools making or influencing consequential decisions — hiring, lending, pricing, legal analysis, healthcare recommendations. Require formal impact assessment, human-in-the-loop mandate, monthly audits.

The NIST AI RMF’s four-function model (Govern, Map, Measure, Manage) provides the structure. You do not need to implement all 400+ subcategories. You need the risk classification decision tree and the approval workflow.

Timeline to draft: 3-4 weeks. Requires input from legal, IT security, and at least one business unit leader.

3. AI Vendor Evaluation Checklist (2-3 pages)

A standardized checklist for evaluating any AI vendor before procurement. Covers:

Data handling: Where is data stored? Who can access it? Is it used for model training?
Security certifications: SOC 2 Type II, ISO 27001, model cards, evaluation artifacts.
Contractual terms: Liability allocation, audit rights, data deletion on termination, IP ownership of outputs.
Regulatory alignment: EU AI Act compliance (if applicable), NIST AI RMF alignment.

Timeline to draft: 2 weeks. Legal counsel reviews in parallel with IT security.

4. AI Incident Response Plan (2-3 pages)

An addendum to your existing incident response plan, not a standalone document. Covers:

AI-specific incidents: data leakage through AI tools, hallucinated outputs reaching clients, biased outputs in consequential decisions, model manipulation or prompt injection.
Escalation paths: Who is notified? What is the containment procedure? What is the disclosure obligation?
Fallback procedures: What happens when AI tools go down? What is the manual backup?

Timeline to draft: 2 weeks. Integrates with existing IR plan.

5. AI Use Case Registry (living document)

A single spreadsheet or database tracking every AI tool and use case in the organization. For each entry: tool name, vendor, business owner, data types processed, risk tier, approval status, last review date. This is the inventory that makes everything else work. You cannot govern what you cannot see.

Timeline to build: 4 weeks (including shadow AI audit discovery). Updated continuously.

Total policy development time: 60-75 days. These documents can be developed in parallel. The acceptable use policy ships first (week 3-4) because employees need guardrails immediately. The registry is ongoing.

The Governance Team (No New Headcount Required)

A 200-500 person company cannot justify a full-time AI governance hire at $150K-$200K (IAPP median for AI governance professionals). It does not need one. The proven model for this company size is a part-time governance lead backed by a cross-functional steering committee.

The AI Governance Lead (15-20% of an existing role)

Assign ownership to a senior leader who already touches risk, compliance, or technology. The most common choices, per IAPP’s 2025 data on where AI governance responsibility sits:

General Counsel or Head of Legal (22% of organizations) — natural fit for regulatory compliance, already owns risk.
CIO or VP of IT (17%) — owns the technology stack, understands shadow AI discovery.
Chief Privacy Officer or Head of Compliance (22% combined privacy and legal/compliance) — already manages data governance, extends naturally to AI governance.
CFO — owns the budget, measures ROI, chairs the steering committee in some models.

This person does not become a CAIO. They own the governance program as 15-20% of their existing role. Estimated cost of time reallocation: $30K-$50K/year in imputed salary (based on a $200K-$300K senior leader dedicating ~1 day per week).

The AI Steering Committee (2 hours per month)

Five to seven people who meet monthly. Composition:

Role	Why They Are There
AI Governance Lead (chair)	Program owner, drives agenda
IT Security / CISO	Shadow AI discovery, technical controls, vendor security
Legal / Compliance	Regulatory monitoring, contract review, risk classification
HR	Workforce impact, training, acceptable use enforcement
Finance	Budget, ROI measurement, procurement oversight
Business Unit Leader (rotating)	Grounding in actual use cases, adoption feedback

Cost: negligible incremental. These people already attend meetings. This replaces one of their less productive ones.

External Support (Optional, High-Value)

For companies without deep AI expertise, a fractional AI governance consultant provides the specialized knowledge without the full-time cost:

Essential advisory (5-10 hours/month): $2,000-$5,000/month. Policy templates, quarterly regulatory updates, on-call guidance.
Standard engagement (10-25 hours/month): $5,000-$15,000/month. Policy development, steering committee facilitation, risk assessments, training delivery.
AI governance specialists specifically command $300-$600/hour (TechJackSolutions salary data, 2026), reflecting legally-driven demand and scarcity.

A 6-month advisory engagement at $5,000-$10,000/month ($30K-$60K total) gets the program built. After that, the internal team sustains it with quarterly external check-ins.

The 90-Day Implementation Roadmap

Days 1-30: Discovery and Foundation

Week 1-2: Shadow AI Audit

Conduct a 30-day shadow AI audit following the Elvex framework:

Technical discovery. Deploy CASB (Cloud Access Security Broker) scans for OAuth grants and AI platform connections. Monitor DNS traffic for known AI service domains. Review endpoint detection logs for installed AI applications. Tools: your existing CASB (Netskope, Zscaler, Microsoft Defender for Cloud Apps) or standalone shadow IT discovery.
Employee survey. Anonymous survey asking: What AI tools do you use? What for? What data do you input? Frame this as enabling better tools, not policing. Elvex reports employees willingly disclose tools when the purpose is governance rather than punishment.
Expense audit. Scan corporate cards and expense reports for AI subscriptions. Check Slack/Teams for AI bot integrations.
Build the registry. Every discovered tool goes into the AI Use Case Registry with owner, data types, and preliminary risk tier.

Week 3-4: Policy Drafting (Phase 1)

Draft and publish the AI Acceptable Use Policy. This is the fastest-impact deliverable — it gives employees clear guardrails today while the rest of the program develops. Require all employees to acknowledge within 30 days.

Simultaneously, convene the AI Steering Committee for its first meeting. Agenda: review audit findings, approve the acceptable use policy, assign risk assessment responsibilities.

Days 31-60: Policy and Controls

Week 5-6: Risk Framework and Vendor Checklist

Complete the AI Risk Assessment Framework. Classify every item in the registry by risk tier. Complete the AI Vendor Evaluation Checklist and apply it retroactively to all Tier 1 (sanctioned) tools.

Week 7-8: Technical Controls

Implement network-level blocks for Tier 3 (prohibited) tools. Configure DLP rules for AI tool data flows. Enable enterprise versions of the most-used shadow AI tools — replace the risk with sanctioned alternatives. Deploy activity logging for Tier 2 (tolerated) tools.

Days 61-90: Training and Operationalization

Week 9-10: Training Rollout

Role-specific AI training. Not a generic webinar — targeted sessions:

All employees (1 hour): Acceptable use policy, data handling rules, how to request new tools.
Managers (2 hours): Risk classification, team AI use monitoring, escalation procedures.
IT and security (4 hours): Shadow AI monitoring, incident response, vendor evaluation.

Week 11-12: Incident Response and Steady State

Publish the AI Incident Response Plan addendum. Run a tabletop exercise with the steering committee. Establish the quarterly governance review cadence: full registry refresh, policy updates, regulatory monitoring, metrics review.

What It Costs

Year One Budget: $75K-$150K

Line Item	Low Estimate	High Estimate	Notes
Governance lead time (15-20% of existing role)	$30,000	$50,000	Imputed cost, not new spend
External advisory/consulting (6 months)	$15,000	$60,000	$2.5K-$10K/month
Steering committee time (7 people x 24 hrs/year)	$8,000	$15,000	Imputed cost
Shadow AI audit (tools + labor)	$5,000	$10,000	Using existing CASB; standalone if needed
AI governance platform (optional Year 1)	$0	$25,000	Many start with spreadsheets; 55% still do (ModelOp, 2026)
Training development and delivery	$5,000	$15,000	Internal delivery with external content
Legal review of policies	$5,000	$15,000	Outside counsel if no in-house AI expertise
Total	$68,000	$190,000

The realistic range for most mid-market companies: $75K-$150K year one, dropping to $40K-$80K annually once policies are established and the program is in maintenance mode.

What It Costs Not To

Average breach cost increase from shadow AI: $670,000 (IBM Cost of a Data Breach, 2024)
Colorado AI Act penalties: up to $20,000 per violation
Lost B2B deal from failing due diligence: varies, but one lost enterprise client pays for the entire program
Regulatory investigation legal costs: $200K-$500K+ for a state AG inquiry

The governance program is insurance. At $75K-$150K against a $670K+ exposure, the math is straightforward.

What Satisfies Regulators (Without Over-Engineering)

NIST AI RMF Alignment

You do not need to implement all four functions across all subcategories. A minimum viable NIST alignment means:

Govern: Steering committee exists, governance lead assigned, policies published.
Map: AI use case registry maintained, risk tiers assigned.
Measure: Quarterly risk assessment reviews, incident tracking, training completion metrics.
Manage: Incident response plan in place, remediation procedures for identified risks.

Implementation timeline for foundational NIST alignment: 3-6 months (NIST guidance; IS Partners, 2025). Full organization-wide integration: 12-24 months.

State Regulation Compliance

Colorado AI Act (June 2026): Annual impact assessments for high-risk AI systems. Your risk assessment framework and registry satisfy the “reasonable risk management program” requirement if you can show: risk tiering, annual reviews, developer documentation for high-risk systems, consumer notice for consequential decisions.

Texas RAIGA (January 2026): Intent-based, lighter touch than Colorado. Strongest requirements target state agencies. For private sector: prohibitions on specific harmful uses plus safe harbors for organizations following recognized frameworks (NIST AI RMF qualifies).

Multi-state strategy: Build to Colorado’s standard (the most restrictive) and you are covered everywhere. One program, most restrictive baseline, defend everywhere.

Enterprise Client Due Diligence

When a Fortune 500 procurement team asks “Describe your AI governance program,” you can answer with:

Named governance lead and cross-functional steering committee
Published AI acceptable use policy with employee acknowledgment records
Risk-tiered AI use case registry
Vendor evaluation checklist applied to all sanctioned tools
Incident response plan with AI-specific procedures
Quarterly review cadence with documented minutes

That answer satisfies 90% of due diligence questionnaires. The 10% that ask for ISO 42001 certification are asking for a 12-18 month, $200K+ undertaking that is a Year 2-3 decision, not a Day 1 requirement.

Key Data Points

Metric	Value	Source
Organizations building AI governance programs	77%	IAPP (n=671), May 2025
Employees using AI without IT approval	68%	Gartner, 2025
Organizations reporting unsanctioned AI use	98%	Industry aggregate, 2025
Shadow AI tools per 1,000 users (mid-market)	~200	Lasso Security, 2026
Shadow AI breach cost premium	+$670,000	IBM Cost of a Data Breach, 2024
Breached organizations lacking AI governance	63%	ISACA, 2025
Companies with governance: agentic AI adoption rate	46% vs. 12%	CSA/Google Cloud, 2025
Colorado AI Act penalty ceiling	$20,000/violation	SB 24-205, effective June 2026
NIST AI RMF foundational adoption timeline	3-6 months	IS Partners/NIST, 2025
AI governance professionals — median salary	$151,800	IAPP Salary Report, 2025
Organizations satisfied with AI governance staffing	1.5%	IAPP (n=671), 2025
Projects with predefined success metrics: success rate	54% vs. 12%	Pertama Partners (n=2,400+), 2025-2026
Change management with strong sponsorship: success rate	88% vs. 13%	Prosci benchmarking, 2025

What This Means for Your Organization

The governance gap at 200-500 person companies is the most fixable problem in enterprise AI. You do not need a CAIO. You do not need a $500K governance platform. You need a named owner, five documents, a monthly meeting, and 90 days of disciplined execution. The organizations that capture AI’s value are the ones that govern it — and the data shows they adopt faster, not slower, once governance is in place.

The 90-day program described here is designed for a specific profile: an American company with 200-500 employees, $50M-$5B in revenue, no dedicated AI team, operating across multiple states, selling to enterprise clients who ask about governance. If that is you, the first step is not buying a governance platform or hiring a CAIO. The first step is appointing someone who already owns risk or compliance to chair a monthly steering committee. The second step is the shadow AI audit — because you cannot write policies for tools you do not know about. Everything else follows from those two decisions.

The cost-benefit is not close. At $75K-$150K year one against a $670K average breach premium, $20K-per-violation state penalties, and lost enterprise deals from failing due diligence — governance is the highest-ROI investment in your AI program. The companies in the 5% do not skip this step. They do it first.

Sources

IAPP, “AI Governance Profession Report 2025” (n=671, May 2025). Independent professional association survey. Credibility: High — largest global privacy/governance professional body, no vendor funding. https://iapp.org/resources/article/ai-governance-profession-report
IAPP, “Salary and Jobs Report 2025-26” (n=1,600+, March-April 2025). Professional salary benchmarking. Credibility: High. https://iapp.org/resources/article/salary-survey-summary
CSA & Google Cloud, “The State of AI Security and Governance” (2025). Credibility: Moderate-high (Google co-sponsorship noted, but controls are framework-agnostic). https://cloudsecurityalliance.org/blog/2025/12/18/ai-security-governance-your-maturity-multiplier
Gartner, “Global AI Regulations Fuel Billion-Dollar Market for AI Governance Platforms” (February 2026, n=360 Q2 2025 survey). Credibility: Moderate — analyst firm with vendor ecosystem interests. https://www.gartner.com/en/newsroom/press-releases/2026-02-17-gartner-global-ai-regulations-fuel-billion-dollar-market-for-ai-governance-platforms
ModelOp, “2026 AI Governance Benchmark Report” (n=100, March 2026). Credibility: Low-moderate — vendor-funded, small sample. https://www.globenewswire.com/news-release/2026/03/11/3253668/0/en/ModelOp-s-2026-AI-Governance-Benchmark-Report
ISACA, “The Rise of Shadow AI: Auditing Unauthorized AI Tools in the Enterprise” (2025). Independent audit and governance association. Credibility: High. https://www.isaca.org/resources/news-and-trends/industry-news/2025/the-rise-of-shadow-ai-auditing-unauthorized-ai-tools-in-the-enterprise
Elvex, “How to Conduct a Shadow AI Audit in Your Organization” (2025). Vendor blog with practical methodology. Credibility: Moderate — vendor-authored but methodology is sound. https://www.elvex.com/blog/how-to-conduct-shadow-ai-audit-organization
Lasso Security, “What is Shadow AI? Risks, Tools, and Best Practices for 2026” (2026). Vendor research compilation. Credibility: Moderate — vendor-funded, aggregated data. https://www.lasso.security/blog/what-is-shadow-ai
Colorado AI Act (SB 24-205) and SB25B-004 amendments. Primary legislation. Credibility: High. https://leg.colorado.gov/bills/sb24-205
Texas RAIGA (HB 149). Primary legislation. Credibility: High. https://www.swept.ai/post/state-ai-regulations-2026-guide
NIST AI Risk Management Framework (AI RMF 1.0) (January 2023, updated through 2026). Federal standard. Credibility: High. https://www.nist.gov/itl/ai-risk-management-framework
Pertama Partners, “AI Project Failure Statistics 2026” (n=2,400+ enterprise initiatives, 2025-2026). Advisory firm research synthesis. Credibility: Moderate — synthesizes multiple sources including RAND, MIT Sloan, McKinsey. https://www.pertamapartners.com/insights/ai-project-failure-statistics-2026
Prosci, “Change Management Success” (benchmarking research, 1998-2025). Independent change management research. Credibility: High — longitudinal data, largest CM benchmarking dataset. https://www.prosci.com/change-management-success
IBM, “Cost of a Data Breach Report” (2024). Annual benchmarking study. Credibility: High — Ponemon Institute methodology, large sample, longitudinal. Referenced via industry reporting on shadow AI cost premium.
IS Partners, “NIST AI RMF: Process, Timeline, and Cost” (2025). Implementation advisory. Credibility: Moderate — consulting firm guidance. https://www.ispartnersllc.com/hubs/nist-ai-rmf/process-timeline-cost/
TechJackSolutions, “AI Governance Salary Data 2026” (2026). Salary benchmarking compilation. Credibility: Moderate — aggregated from multiple sources. https://techjacksolutions.com/ai-governance-salary-data/

Created by Brandon Sneider | brandon@brandonsneider.com March 2026