Appendix D. A 90-Day Responsible AI Plan

Days 1–30: Discover and establish boundaries

1. Inventory existing AI tools and informal use.
2. Classify data and identify prohibited or high-risk uses.
3. Name an executive sponsor, operational owner, privacy/security contacts, and review group.
4. Select one or two low-risk, measurable use cases.
5. Define baseline performance, user needs, and success criteria.

Days 31–60: Test and prepare

1. Assess privacy, security, fairness, legal, accessibility, and supplier risks.
2. Create representative test cases, including failure and misuse scenarios.
3. Write user guidance and an incident-response route.
4. Train a small pilot group and document feedback.
5. Agree on acceptance thresholds and conditions for stopping the pilot.

Days 61–90: Pilot, evaluate, and decide

1. Run the pilot within a limited scope and with appropriate human oversight.
2. Measure quality, error severity, time saved, cost, user experience, and unintended effects.
3. Review incidents, complaints, overrides, and group-level outcomes where relevant.
4. Decide whether to scale, modify, pause, or stop; document the reasons.
5. Set a monitoring schedule, named owner, review date, and exit plan.

A 90-day plan is a starting point, not a guarantee of safety. High-risk or complex systems may require longer assessment, formal approvals, external testing, or regulatory engagement.