For compliance officers: a 90-day plan

Days 1–30: know what you have

1. 1
   Build the inventory: add systems you know about and run discovery for the ones you don't.
2. 2
   Give every system an owner.
3. 3
   Classify every system. Stop anything prohibited.
4. 4
   Agree an AI policy and acceptable-use rules (checklist) and start AI literacy training (plan).

Days 31–60: close the big gaps

1. 1
   For each high-risk system, open the assessment and run a gap analysis.
2. 2
   Turn the top gaps into findings with owners and dates.
3. 3
   Send vendor questionnaires for high-risk systems you buy.
4. 4
   Set up the incident process so everyone knows how to report a problem.

Days 61–90: prove it

1. 1
   Collect evidence for implemented controls; seal key evidence with Proof Seal.
2. 2
   Draft FRIAs and DPIAs where needed (explained).
3. 3
   Schedule re-assessments for every high-risk system.
4. 4
   Ask a reviewer to approve each high-risk assessment.
5. 5
   Share the board report with leadership.