A 90-Day AI Readiness Plan for the Not-Yet-Ready

Most companies already have AI inside them. Leadership may not have approved it, written it into a policy, or seen it on an invoice. It came in through the people who work there.

Microsoft’s 2024 Work Trend Index shows the scale: the report drew on a survey of 31,000 people across 31 countries, of which 75% of knowledge workers said they use generative AI at work, and 78% of those users brought their own tools in without the company supplying them.

That activity tends to stay out of sight. More than half of the people surveyed said they are reluctant to admit using AI on their most important tasks.
So most firms begin from a position of use already underway, with no record of where it sits or what data it reaches.

Are you considering the right factors before committing to new tools? AI Questions Your Board Needs to Ask First

Two Ways Firms Get Stuck on AI

Two responses show up when a mid-market company sizes up AI:

The first is to wait. The tools keep changing, the headlines keep shifting, and holding off feels safer until the picture settles. The problem is that waiting does nothing about the use already happening in the background.

The second is to move fast on whatever is newest. A tool is bought, a few people try it, and the cycle repeats the next quarter. This one adds spending without a clear problem to solve, plus exposure the company cannot see.

Both responses come from the same gap: neither one begins with a clear view of what is currently in use.

Readiness is a short, repeatable process. It starts with knowing what your people use and what data those tools reach. From there, each tool gets an owner, and the next 90 days build on that view.

Days 1 to 30: Take Inventory of What Is Being Used Now

The first month has one goal: get a clear, current picture of how AI is being used across the company. No new tools go in during this phase.

Find Out What Is Already Running

Start by asking. A short survey or a few team conversations will surface more than a network scan on its own.

• Ask each team which AI tools they use and for which tasks.
• Note the tools that connect to company systems such as email or file storage.
• Write down the free and personal-account tools too, since those are the ones most likely to sit outside any contract.

Map Tools to the Data They Reach

Not every use carries the same weight. A tool that drafts a social post carries less weight than one that handles customer records or financial data.

• Flag any tool that handles customer records or financial data, and anything that falls under a compliance requirement.
• Record where that data goes once it leaves your systems.

What You Should Have by Day 30

A simple register. One row per tool, with a handful of columns:

• The tool and who owns it
• The task it is used for
• The data it touches
• Whether it is approved

This register becomes the baseline for everything that follows. You cannot write a sensible rule for a tool you have not named.

Strategic technology planning is a different beast altogether from day-to-day IT maintenance: Why Small IT Teams Struggle with Strategic IT Planning

Days 31 to 60: Set Guardrails and Pick Low-Risk Wins

Month two adds two things together. A short set of rules, and a small number of tests.

Create an Acceptable AI Use Policy

Keep it to a page or two. A long document will sit unread, and people will go back to doing what is easy. Cover the basics:

• What data may never be entered into public AI tools
• Which tools are approved for which kinds of work
• Who to ask when someone wants to use something new
• A plain reminder that approved tools exist, so the easy path is also the safe one

You do not have to build this from scratch. The NIST AI Risk Management Framework gives a voluntary structure that organizations of different sizes can adapt. It organizes the work around four functions: govern, map, measure, and manage.

Pick One to Three Low-Risk Wins

With rules in place, choose a small number of pilots. The aim is to prove value in a setting where a mistake is cheap and reversible. A good first pilot meets a few tests:

• It stays internal, with no direct effect on customers.
• It can be switched off without disruption if it does not work.
• It has one named owner who is accountable for the result.
• Success is written down before the pilot starts.

Some safe places to start:

• Drafting internal documents and first versions of routine emails
• Summarizing long message threads or meeting recordings
• First-pass sorting of inbound IT tickets
• Pulling the key points out of long reports

Set the Measure Before Starting

Decide how you will know whether a pilot worked. Pick something you can see.

• Time saved on a specific task, measured each week
• A drop in errors or rework on a defined process

Then ask the people running the pilot whether it genuinely helps, and write their answer down.

By the end of day 60, you have a short rulebook people can follow and a handful of pilots with clear owners and clear measures. That sets up the final month, when you decide what stays and what gets governed for the long term.

Days 61 to 90: Putting Governance in Place

Month three turns a set of experiments into something the business can stand behind. The pilots have run long enough to show results. Now you decide what happens to them and how new AI use gets handled from here.

Review Each Pilot Against Set Measures

Go back to the success criteria you wrote down in month two. Judge each pilot on what it produced, not on how interesting it was to run. For each one, pick an outcome:

• Keep it, and fold it into normal work.
• Hold it, and give it more time with a tighter scope.
• Stop it, and record why so the lesson sticks.

Set Governance Rules

A pilot that works becomes a standing part of operations. That needs light governance so it does not drift.

• Name who approves a new AI tool and what they check before saying yes.
• Set a review date, since a tool that was safe six months ago may have changed its terms.
• Keep the register from month one current as tools come and go.
• Give each approved tool a named owner who answers for how it gets used.

Connect AI Use to Compliance Requirements

If the company works under a compliance requirement, map your AI use to it now, while the footprint is small. Catching a gap with three tools in play is far easier than catching it with thirty.

For firms that want a formal structure, ISO/IEC 42001, the first international standard for AI management systems, lays out a repeatable way to govern AI over time. It was built to sit alongside ISO/IEC 27001, the information-security standard many firms already uphold.

Plan For the Next Two Quarters

Take the pilots you kept and turn them into a short roadmap. Give each item an owner and a date. Add the next few use cases you want to test, drawn from the time-wasters your teams named back in month one.

At day 90, the kept pilots have owners and dates, and new AI use has a path to follow.

Get a better picture of the risks before diving into the tools: Shadow AI Risks for Business

A Few Traps to Sidestep

Even a solid plan can go sideways. These are the ones that catch mid-market firms most often.

• Buying the platform first: A signed contract does not tell you which problem the tool solves. Let the pilot findings decide the purchase.
• Chasing every new release: A tool that shipped last week has no track record inside your company. Give the plan time to produce evidence before you change course.
• Writing draconian rules: A policy that blocks the useful along with the risky pushes people back to private tools, which is the state you started in.
• Treating AI readiness as a one-time project: The register and the review cadence only help if they keep running after day 90.
• Leaving security out of the room: AI use touches the same data your security controls protect. Keep whoever owns security involved from the start.

90 Days Into Your AI Readiness Planning – Then What?

Three months of this work replaces a vague sense of being behind with a clear view and a working routine.

Each cycle after this gets easier. You already know where your data goes and who owns which tool. New use cases slot into a process that exists, with measures ready to show whether they earn a permanent place.

The question changes. It moves from whether the company is ready to what it should take on next.

Most leaders can run the first 30 days on their own. The harder part comes later, when the guardrails and the governance have to hold up under a risk assessment. That work moves faster with someone who has set it up before.

Louisville Geek runs AI readiness assessments and builds the roadmap alongside your team. Our AI plans are written by the same in-house team that handles your security and compliance, so the guardrails and the data protections live in one plan.

If you want a clear read on where you stand and a path mapped to your business, reach out to our expert team.