AI governance for SMBs is the set of policies, controls, monitoring, and decision forums that make AI use safe, accountable, and effective. A practical 30/60/90 day plan covers the AUP, shadow AI inventory, training rollout, technical hygiene (sensitivity labels, conditional access), Council convening, and ROI measurement. The plan is intentionally fast — most SMBs cannot sustain a six-month governance engagement, and they should not have to.
How MSPs Deliver SMB AI Governance in 30/60/90 Days
For MSPs, the 30/60/90 day governance plan is the operational artifact that takes Phase 0–3 of TaaS and lays it on a calendar the client can see. It removes the abstraction from “governance” and replaces it with named work, named owners, and named dates.
Days 0–30: Foundation.
-
AI Leadership Survey with the executive sponsor and department heads.
-
Tenant Readiness check (Microsoft’s ARA) against M365.
-
Shadow AI inventory baseline using the Continuous Scanner.
-
AUP first draft, including the approved/conditional/blocked tool list.
-
AI Champions identified across departments.
-
Council and QBR AI Segment cadence scheduled.
-
Phase 0 → Phase 1 transition.
Days 31–60: Build.
-
Technical hygiene remediation against the ARA findings (permissions, sensitivity labels, conditional access).
-
Copilot Quick Wins identified and sequenced for rollout.
-
Training plan finalized; Copilot 101/102 sessions delivered to the pilot team.
-
First Monthly AI Council convened. AUP reviewed by leadership; first revisions captured.
-
AI Maturity Score baseline established across the 8 pillars.
-
Phase 2 work in flight.
Days 61–90: Activate.
-
Copilot Quick Wins deployed to end users.
-
AUP revised against observed real-world usage (Phase 3).
-
Use case pipeline launched from the AI Inventory.
-
Second Monthly AI Council convened. Decisions documented; owners named.
-
First quarterly AI Recap or QBR AI Segment delivered.
-
Practice transitions from onboarding mode to recurring rhythm.
What’s not in the 30/60/90 plan: large custom agent builds, departmental AI projects, and broad organizational change initiatives. Those are Program-side work that lives outside the 90-day governance plan. The plan is governance, not strategy execution.
What SMB Leaders Should Expect at Each AI Governance Gate
For SMB executives, the 30/60/90 day governance plan is the answer to a question that often stalls AI investment: how long until we have governance in place? The honest answer is 90 days under a real practice.
What you should expect from your MSP at each gate:
-
Day 30 gate. AUP first draft in hand. Shadow AI inventory baseline produced. AI Champions named. Council on the calendar.
-
Day 60 gate. Technical hygiene closed against the ARA findings. First Council convened with leadership decisions captured. Pilot team trained.
-
Day 90 gate. Quick Wins deployed. AUP revised against real usage. Use case pipeline live. First QBR AI Segment delivered.
If your MSP cannot articulate the 30/60/90 plan in writing during Phase 0, you are likely buying a project rather than a practice. The plan is the most basic test of operational maturity.
The plan also names the dependency that fails most often: executive sponsorship. Active sponsorship is required at Day 0 for the AI Leadership Survey, at Day 30 for AUP approval, and at Day 60 for the first Council. If the sponsor is not available, the plan slips — and most plans slip on the sponsor, not the technical work.
How Lemhi Standardizes the 30/60/90 AI Governance Plan for MSPs
Lemhi makes the 30/60/90 governance plan a standardized, repeatable motion across the MSP’s full client book.
-
Lemhi Engage runs the Day 0–30 motion. AI Leadership Survey, Tenant Readiness check, ROI calculator, AUP first draft.
-
VCAIO tooling runs the Day 31–60 motion. Council prep, ARA remediation tracking, AI Maturity Score baseline.
-
Continuous Scanner runs across all 90 days and beyond. Shadow AI, permissions, sensitivity labels — surfaced to the PSA queue.
-
Standardized artifacts for each gate. Day 30 gate checklist, Council agenda, AUP template, QBR AI Segment slides.
-
Compass Module variant. For clients too small for the full plan, the Compass Module compresses the 30/60/90 plan to fit the owner-led format.
The 30/60/90 plan is what governance looks like when it ships from a practice instead of from a consulting engagement. Lemhi sells the practice; the plan is the visible artifact.
