AI Governance Institute
← News
Research2026-09-12

FTI Consulting's 30-Day AI Governance Playbook Sets a Program-Launch Baseline

What happened

FTI Consulting's Risk Management in the AI Era: A Playbook for Leaders gives compliance officers a sequenced 30-day structure for getting an AI governance program off the ground. The playbook is organized in three phases: securing leadership alignment on risk appetite and accountability, conducting a baseline assessment of existing AI exposure, and identifying where AI creates the most business value and therefore the greatest governance priority. Rather than treating every AI risk as equally urgent, the framework directs teams to triage by business impact, which gives compliance officers a practical rationale for sequencing their workload. The document is aimed at leaders who recognize the need to govern AI but lack a coherent starting point, and it positions governance as an ongoing operating model rather than a one-time compliance exercise. The publication follows a growing body of practitioner guidance from consulting firms, including similar efforts catalogued in reports from Bluewave's 90-day blueprint and Keyrus's 2026 baseline operating model, reflecting demand for implementation-ready frameworks over high-level principles.

Why it matters

  • ·Organizations without a documented AI governance program face increasing exposure as regulations such as the EU AI Act: High-Risk AI Systems, Transparency, and Enforcement Powers Applicable 2 August 2026 and state-level frameworks create affirmative compliance obligations -- an undocumented program is difficult to defend in an audit or enforcement context.
  • ·The playbook's sequencing logic -- alignment before assessment, assessment before deployment review -- addresses the most common operational failure mode in AI governance programs, where controls are adopted before ownership and risk appetite are settled, producing documentation that does not reflect actual practice.
  • ·For risk and audit functions, the 30-day triage model creates a concrete deliverable timeline that can be reported to senior leadership and the board, supporting the kind of structured AI risk reporting that frameworks such as ISO/IEC 42001:2023 - Artificial Intelligence Management System and mature governance programs now expect.

Governance controls affected

BRD-006AI Risk Tolerance and Appetite DocumentationBRD-002AI Governance Committee Charter and Decision RightsHOC-001AI System Risk ClassificationMGV-002AI System Intake and Approval WorkflowMGV-003AI Governance Program Milestone Framework

What to do now

  • ☐Use the FTI playbook's first phase as a checklist prompt: confirm that your organization has documented AI risk appetite and assigned clear ownership before attempting to expand or formalize technical controls.
  • ☐Map the playbook's baseline assessment phase against your existing AI inventory to identify gaps between systems currently in use and systems subject to formal governance review.
  • ☐If your governance program is still undocumented, treat the 30-day structure as a board-reportable milestone plan and schedule a progress update at the 30-day mark.
  • ☐Cross-reference the playbook's value-identification phase with your AI system inventory to prioritize governance resources toward the use cases with the highest business impact and corresponding regulatory exposure.
  • ☐Benchmark your program launch timeline against peer frameworks published by FTI, Bluewave, and Keyrus to identify which phases your organization has completed and which remain open.

What to watch next

As practitioner demand for implementation-ready AI governance models grows, compliance teams should monitor whether consulting firm playbooks begin to be cited by regulators or enforcement bodies as a reasonable standard of care -- a pattern already visible in financial services through guidance like SR 26-2. The NIST Artificial Intelligence Risk Management Framework Playbook and ISO/IEC 42001:2023 - Artificial Intelligence Management System remain the most widely cited foundations for program design, and teams should track whether forthcoming regulatory guidance begins referencing phased launch structures as a baseline expectation. Organizations that have not completed a governance program launch should also watch for enforcement actions where the absence of a documented program -- rather than a specific control failure -- becomes the primary finding.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-09-09

Credo AI Survey of 371 Leaders Maps Where Mature AI Governance Programs Pull Ahead

Credo AI released The State of AI Governance Report 2026, drawing on survey data from 371 senior leaders to benchmark where enterprise AI governance programs are advancing and where common gaps persist. The report identifies AI inventories, accountability structures, and review workflows as the controls that most differentiate mature programs from lagging ones. Compliance teams can use the findings to compare their operating models against peer practice and prioritize remediation.

Research2026-09-09

ELDR's 2026 Flagship Report Sets a Comparative Maturity Bar for AI Governance Programs

ELDR has published its annual State of AI Governance 2026 report, examining governance structures, program maturity, and oversight practices across organizations. The report offers compliance teams a comparative reference for evaluating where their own programs stand against peers and against the controls most commonly found in active AI oversight functions.

Research2026-09-06

Telstra's Role-Based AI Policy Overhaul Offers a Replicable Governance Blueprint

A case study published by the University of Technology Sydney documents how Telstra restructured its AI governance program around role-based policy ownership and simplified intake and impact assessment workflows. The research, produced through UTS's Human Technology Institute, identifies specific operational changes that reduced friction in AI triage while strengthening accountability. Enterprise compliance teams can extract a practical operating model from the findings.