AI Governance 90-Day Review: Turning Results Into Decisions

Three months after approving an AI tool and starting a pilot, the licences are active and people say they use it. Has the work improved? Are outputs reliable? Which pilot deserves more support, and which should end? An AI governance 90-day review joins business outcomes to everyday experience. **In short** - Use a 90-day leadership review to decide what to continue, change, expand or stop. - Check business results, quality, staff experience and risk alongside tool usage. - Compare outcomes with a baseline and include the time spent checking and correcting AI output. - Keep an owner and review date for each use; escalate serious issues when they arise. - Feed lessons back into the policy, champions' support and the next working group's priorities. ## A review is more than a usage report A dashboard might show that 80 people logged into a tool. It cannot tell you whether their work became better, faster or easier. Usage matters, but it is only one part of the story. The UK government's guidance on measuring AI impact suggests considering quality, efficiency, user experience, usage and cost. It also recommends a baseline and evaluation throughout a product's life. That guidance addresses government AI products; a smaller business can use the questions without copying a public-sector evaluation programme. [Source: UK Government AI Knowledge Hub](https://knowledgehub.dev.ai.gov.uk/how-to/measure-impact). Start with the process each use was meant to improve. For customer responses, measure total time to a satisfactory reply, corrections, customer outcomes and review effort. Ten minutes saved drafting followed by fifteen minutes of extra checking is no gain. Ask whether time saved created capacity, reduced delay or improved quality before claiming a financial benefit. ## What should leaders see every 90 days? Keep the pack short enough for a decision-making meeting. A one-page view can cover five areas: | Area | Question to answer | Example evidence | |---|---|---| | Uses and ownership | What is proposed, being tested, approved, paused or retired? | Use list with owner and next review date | | Outcomes | Did the targeted process improve? | Before-and-after turnaround, quality and rework | | People | Can staff use the tools appropriately and raise concerns? | Champion feedback, questions, short user interviews | | Controls | Are approved tools, access, checks and information rules still suitable? | Exceptions, incidents, supplier or feature changes | | Decisions | What needs an owner or leadership decision now? | Open actions, options and decision dates | Use the pack to see where action is needed. Consequential or rapidly changing uses may need checks much more often than the 90-day leadership discussion. The government's 2026 AI Risk Management Toolkit describes risk identification, assessment, treatment, monitoring and reporting across the AI lifecycle. [Source: UK Government AI Risk Management Toolkit](https://www.gov.uk/government/publications/ai-risk-management-toolkit/ai-risk-management-toolkit-guidance). ## A simple rhythm for the first quarter **Days 1–30: establish the starting picture.** Name an owner for each active use. Record its purpose, permitted scope, baseline and what success would look like. Ask staff what they already do and which rules remain unclear. Choose a small number of pilots with process owners and review points. **Days 31–60: inspect the work.** Working groups test within agreed limits. Champions gather questions and examples. Process owners check outputs and record corrections, delays and unexpected effects. Bring urgent security, privacy or service issues through existing escalation routes immediately. **Days 61–90: make decisions.** Compare results with the starting picture. Invite the people doing the work to explain what changed. Confirm which uses should expand, continue in a narrower scope, be redesigned or stop. Name owners and dates for the resulting changes. The dates are illustrative. Government evaluation guidance recommends baseline information and consideration of unintended outcomes and other causes of change. A before-and-after comparison does not necessarily prove AI caused an improvement. [Source: Guidance on the Impact Evaluation of AI Interventions](https://www.gov.uk/government/publications/the-magenta-book/guidance-on-the-impact-evaluation-of-ai-interventions-html). ## Ask whether the safeguards work in reality A policy can be published and still fail the test of daily use. Can someone find the current approved-tool list? Do they know who can answer a data question? Does a reviewer have enough time and knowledge to challenge an AI output? Have new features changed what a tool can access or do? Review errors and near misses for patterns. One unclear rule may prompt the same mistake across a team. A champion may report that colleagues are quietly avoiding an approved tool because it makes their work harder. Those observations are management information. The ICO's accountability toolkit says data protection policies and procedures should be reviewed at documented dates and updated when operational or regulatory changes require it. It also asks whether staff can find policies and explain their responsibilities. Use those questions when AI involves personal information. [Source: ICO policies and procedures toolkit](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/policies-and-procedures/). ## Close the loop between the four parts of governance The review should give each part of your governance model its next task. The **AI Council or senior owner** decides priorities and resolves open questions. The **policy owner** updates rules and examples. **Champions** help colleagues understand the changes and report where they do not work. **Working groups** investigate the next process problem or revise a test that fell short. For example, a pilot may cut the time to produce a draft but increase review and correction. The leader might narrow its scope, ask the working group to improve source information, and have champions show colleagues what a satisfactory output looks like. At the next review, the business checks whether the total process improved. Record what changed and why, so the next team can use the lesson. ## End with decisions people can act on A useful 90-day meeting finishes with a few explicit statements: “Continue this use within these boundaries.” “Test this change on another set of cases.” “Update this rule.” “Stop this tool.” Each needs an owner and date. That is how governance stays connected to business performance. It provides the means to support a promising use and to recognise when the promised benefit has not arrived. **This week's action:** Put a review date in the diary for one active AI use. Ask its owner to bring the original aim, a baseline or best available starting evidence, current results, staff feedback and the decision they need. ## Explore the governance series - [AI governance for SMEs](/insights/ai-governance-for-smes-practical-starting-point/) - [AI Council](/insights/does-your-business-need-an-ai-council/) - [AI policy](/insights/writing-an-ai-policy-your-team-will-actually-follow/) - [AI Champions](/insights/ai-champions-business-role/) - [AI working groups](/insights/ai-working-groups-process-plan-action/) ## FAQs ### How often should an SME review AI governance? A 90-day leadership review is a practical starting rhythm, not a legal requirement. Monitor active uses at a frequency suited to their impact and escalate incidents as they arise. Review policy and controls sooner when a tool, process or risk changes. ### Which AI governance metrics matter most? Start with each use's business purpose. Track its owner and status, relevant quality and process outcomes, review effort, staff feedback, exceptions and incidents. Tool usage alone cannot show whether the business gained value. ### How do you calculate time saved by AI? Measure the whole task before and after, including preparation, checking and correction. Compare similar cases and state the limits of the comparison. Then explain what the freed capacity enabled; do not automatically treat estimated minutes as a financial saving. ### What should happen if an AI pilot fails? Record what was tested and why it fell short. The problem may be the process, source information, tool, controls or the use case itself. Decide whether to revise, pause or stop and share the lesson with the teams considering similar work. ### Who is responsible for the 90-day review? A senior owner or AI Council should make cross-business decisions. Process owners bring results for their uses, champions bring staff feedback, and relevant security or data protection specialists review issues in their remit. One named person should keep the decisions and follow-up actions together.

This article was written by Peter Lowe. The ideas and opinions are his own; AI was used to assist with drafting and editing.