The 90-Day Diagnostic
What to demand in the first quarter. The artifacts a board should require within 90 days of any AI executive appointment.
The appointment is the easy part. A board hires a Chief AI Officer, announces it, and assumes the operating layer will follow. Ninety days later the only artifact that exists is a strategy deck. The diagnostic below is the set of artifacts a board should require in the first quarter — not to evaluate the person, but to confirm the function is being built as a system rather than a portfolio of experiments.
Day 30 is the inventory. A single register of every model in production or pilot, who owns it, what data it touches, and which regulation applies. Most organizations cannot produce this in thirty days, and the inability is the finding. If the new executive cannot enumerate the AI surface area, no one is governing it.
Day 60 is the control map. Each item in the inventory mapped to the controls that govern it: access, logging, evaluation, human review, and the audit trail. The board is not looking for completeness at day 60. It is looking for the mapping to exist, because the mapping is what turns shadow AI into a managed estate.
Day 90 is the single accountable seat and the unit economics. One named owner for the total spend and the total risk, plus a P&L the CFO can read. If three different executives still own three slices of the program at day 90, the operating system has not been built; the portfolio has just been renamed.
The diagnostic is deliberately boring. None of these artifacts is novel — they are the same artifacts ISO 27001 forced on information security a decade ago, applied to the model layer. A board that demands them in the first ninety days gets an operating system. A board that waits for the strategy deck gets governance debt.