The nine-step Implementation Pathway

The order in which an organisation builds the system for the first time, what each step produces and roughly what it takes to get through them.

The Implementation Pathway is the order in which an organisation builds the system for the first time. Nine steps, each producing something concrete, with several running in parallel rather than strictly one after another.

Elapsed time is typically six to ten weeks, with somewhere in the region of 20 to 40 person-hours of Governance Lead effort spread across it. Organisations move at different speeds depending on size, how much AI they turn out to be using and how quickly leadership engages, so treat those figures as a typical shape rather than a schedule.

The nine steps

Secure leadership commitment

Week 1

Somebody with authority agrees that AI will be governed, appoints the Governance Lead and records the appointment. Without this the register stalls at the first department that declines to answer.

Draft the AI Governance Policy

Weeks 1 to 2

The written position on what is permitted, what is prohibited and who decides. Short enough that staff read it, specific enough that it settles arguments.

Build the Activity Register

Weeks 2 to 4

Discovery across the organisation, then recording each Activity against the twelve minimum fields. The longest step, which determines whether everything after it is worth anything.

Conduct Consequence Profiling

Weeks 3 to 5

Score every registered Activity across the five domains and take the highest score as the overall rating. Starts before discovery finishes, since the obvious Activities can be profiled while the rest are still being found.

Select and assign Safeguards

Weeks 4 to 6

Apply SG1 to everything, then add Safeguards in proportion to each rating and record the selection against the Activity.

Deliver training

Weeks 5 to 7

Bring people to the Competence Level their role requires and record it. Level 1 for everyone, Level 2 for users of a sanctioned Activity, Level 3 for anybody reviewing output that affects individuals.

Establish the Governance Evidence Pack

Weeks 6 to 8

Assemble the ten minimum contents in one place, with retention periods applied by record class.

Schedule the first Assurance Review

Week 8

Set the date and the scope, covering the six mandatory areas. Frequency thereafter follows the highest Consequence Rating on the Activity Register.

Conduct maturity self-assessment

Weeks 8 to 10

Record the organisation’s current Maturity Level and identify practical improvements.

What happens after implementation

The nine-step Implementation Pathway establishes AIGMS™ for the first time. After Step 9, the organisation keeps its Activity Register, Consequence Profiles, Safeguards, competence records and Governance Evidence Pack current.

It completes Assurance Reviews according to the applicable review frequency, records incidents and improvement actions and responds to changes in AI Activities, providers and the legal landscape.

Who needs which training

Step 6 is where most implementations either land or unravel, because a Safeguard requiring human review is worth nothing if the reviewer does not know what to look for.

The four Competence Levels
Level	Who	Typical duration	Refresh
1 AI Aware	Every employee, contractor and partner with access to systems or data	30 to 45 minutes	Annual
2 AI User	Anybody using a sanctioned AI Activity, before first use	1 to 2 hours per Activity	Annual, plus on Activity change
3 AI Reviewer	Managers and professionals reviewing or approving AI output that informs decisions about individuals, for Activities rated Moderate or above	2 to 4 hours plus practice	Annual, plus on appointment
4 Governance Lead	The Governance Lead and their deputy	1 to 2 days plus ongoing development	Annual, plus immediately on version change

Level 3 competence has to be actively confirmed and recorded rather than assumed from attendance. A reviewer who has sat through a session is not yet evidence that the Safeguard works.

What it costs to run

Beyond the Governance Lead time already described, first-year out-of-pocket cost for a fifty-person organisation typically falls somewhere between £3,000 and £6,000, covering material, training delivery and any specialist input the organisation chooses to buy. Much of that is one-off.

Organisations that already run a health and safety or quality management system usually find the cost lower, since the review habits, record keeping and leadership routines are largely in place and AIGMS™ is designed to sit inside them rather than beside them.

Continue reading

MaturityThe Maturity Model SafeguardsThe Safeguard Catalogue OverviewWhat AIGMS™ is

Framework version 3.1 · Page last reviewed 28 July 2026 · Next scheduled review 28 July 2027
Material changes since the previous version See how AIGMS™ is structured

Put this into practice

The AIGMS™ packages provide the documents, registers, workbooks and training needed to implement the governance management system.

Compare the three packages Get the free Starter Guide