The problem the role exists to solve
Most organisations do not have an AI governance problem so much as an ownership problem. Risk owns a piece. Legal owns a piece. Data protection owns a piece. IT owns the tooling. Procurement owns the contracts. Each of them is doing their job competently, and the question “is our AI under control?” still has no owner, because it sits in the gaps between all five.
A full-time Chief AI Officer solves that and costs, in the UK, somewhere between a senior director and an executive salary plus the recruitment risk of hiring into a role the organisation has never had. For a great many organisations that is the right answer eventually and the wrong answer now.
Days 1–30: find out what is actually true
The first month is deliberately unglamorous. It produces no strategy and no framework. It produces an accurate picture, which almost nobody has at the start.
Not the procurement list. What is actually in use, including the AI features that arrived inside tools you already owned, and the free accounts individual teams opened without telling anyone. This number is routinely two to three times the one the organisation started with.
Of those systems, which make or materially influence decisions about people — customers, patients, applicants, employees. That subset is where the risk concentrates and where the attention goes for the rest of the engagement.
Policy, approval process, risk register, impact assessments, incident history. Not whether they are good — whether they exist, when they were last touched, and whether anyone follows them.
A short written picture for the board or executive: here is the estate, here is where people are affected, here is what is governed and what is not. Frequently the first time anyone has seen all of it in one document, and occasionally uncomfortable reading.
Days 31–60: start deciding
The second month is where the role becomes different from advisory work. Decisions start routing through one place, and that is felt immediately.
The approval gate goes live — usually a light one at first, because a heavy gate on day thirty-one simply teaches people to route around it and rebuilds the shadow estate you just finished counting. A tiered gate, where low-risk internal use is fast and anything touching a decision about a person is not, tends to survive contact with an actual organisation.
Policy exceptions get decided rather than deferred, and this is the most useful thing that happens all quarter. Every exception request is information: it tells you where the policy is wrong, where the process is too slow, and where somebody has a real need the framework did not anticipate. An organisation with no exception requests in month two does not have a well-designed policy; it has one nobody is using.
And the systems found in month one that should not be running get switched off, or brought inside the gate. This is where the authority actually matters, and where an advisory arrangement would have produced a recommendation and stopped.
Days 61–90: make it survive you
The third month is about durability. A governance function that depends on one person attending is not a function; it is a dependency, and it fails the moment that person is on leave.
Inventory reconciliation, risk review and management review get calendar dates and named internal owners. The dates matter more than the documents — they are what an auditor asks for, and they are what stops the system quietly going stale.
A quarterly report in a fixed shape, so the second one is comparable with the first. Written for a non-executive: what changed, what is exposed, what needs a decision. Not a dashboard.
Who gets called when an AI system does something unexpected at four o'clock on a Friday, and what they are authorised to do before anyone else is available. Written down, and walked through with the people named in it.
Who inside the organisation could hold this in twelve months, and what would they need. Sometimes the honest answer is nobody yet, which is itself a finding worth giving the board.
Three signs it is not working
- Nothing has been refused. An approval gate that has approved everything for ninety days is not a gate. Either the risk genuinely is uniformly low — possible, and worth saying out loud — or the gate is decorative.
- The role is producing documents rather than decisions. Deliverables are easy to generate and easy to mistake for progress. If month two produced three frameworks and no refusals, exceptions or switch-offs, the arrangement has quietly reverted to consulting.
- Nobody internally is closer to being able to do it. Ninety days in, at least one person should be visibly picking things up. If the dependency is deepening rather than reducing, that is a problem to raise rather than a sign of value.
What it is not
It is not a fix for not having an AI strategy — governance tells you whether what you are doing is under control, not whether it is worth doing. It is not a substitute for a data protection officer, and it does not carry the statutory independence that role has. And it is not certification: nothing a fractional CAIO does makes you certified against ISO/IEC 42001, which only an accredited body can do.
What it is, is a named person with the authority to decide, reporting on a cycle, accountable for an answer to a question that currently has none.
This article is general information, not legal advice. Certification against ISO/IEC 42001 is issued only by a certification body accredited under ISO/IEC 42006. VisionXY7 Ltd prepares organisations for certification audits and reviews their systems independently; it does not perform them.