AI strategy for business leaders: a 90-day implementation plan

The practical framework for building an AI strategy that delivers results and meets EU AI Act requirements. Audit, pilot, scale -- in 90 days.

Why you need an AI strategy for your business now

An AI strategy for business is no longer a competitive luxury -- it is a regulatory requirement. Since February 2025, the EU AI Act (Regulation 2024/1689) has mandated that every organisation deploying AI systems ensure adequate AI literacy among staff under Article 4. By August 2026, national enforcement authorities will begin active supervision of high-risk AI obligations.

But compliance is only half the story. Organisations that adopt AI strategically -- with clear governance, measurable goals, and trained teams -- consistently outperform those that adopt AI reactively. The difference is not the technology itself. It is whether leadership treats AI as a tool to be managed or a force to be harnessed.

The challenge most business leaders face is not a lack of ambition. It is a lack of structure. They know AI matters. They see competitors investing. They read the headlines. But they do not have a practical roadmap that connects business objectives, team capabilities, and regulatory requirements into a single actionable plan.

That is what this guide provides.

The five most common AI strategy mistakes

Before diving into the framework, it is worth understanding what goes wrong when organisations attempt AI adoption without a strategy. These patterns repeat across industries and company sizes.

The 90-day AI implementation framework

This framework divides AI implementation into three 30-day phases. Each phase has clear objectives, deliverables, and compliance checkpoints. The phases build on each other -- you cannot pilot effectively without auditing first, and you cannot scale without learning from pilots.

Phase 1: Audit and assess (days 1 to 30)

The first phase is about understanding your current state. You cannot build a strategy on assumptions, and most organisations dramatically underestimate how much AI they already use. The goal of this phase is a complete, honest picture of your AI landscape.

Week 1: AI inventory

Start by documenting every AI system and AI-powered feature in use across your organisation. This includes the obvious tools -- ChatGPT, GitHub Copilot, Midjourney -- but also the embedded AI features that most people overlook. Your CRM probably uses AI for lead scoring. Your email platform uses AI for spam filtering and smart replies. Your analytics dashboard likely has ML-powered forecasting built in.

For each tool, record: what it does, who uses it, what data it processes, what decisions it influences, and who the vendor is. This inventory becomes the foundation of your EU AI Act compliance checklist.

Week 2: Risk classification

Using the EU AI Act risk framework, classify each AI system in your inventory. The regulation establishes four risk tiers: unacceptable (banned under Article 5), high-risk (Annex III, strict obligations), limited risk (transparency obligations under Article 50), and minimal risk (voluntary codes of practice). Most business tools fall into the limited or minimal risk categories, but you need to verify this -- not assume it.

If you are unsure how to classify your tools, our guide on AI risk classification under the EU AI Act walks through Annex III categories with real examples.

Week 3: Skills assessment

Survey your workforce to understand current AI literacy levels. Article 4 of the EU AI Act requires that training be proportionate to role -- which means you need to know where people stand before you can design proportionate training. Use a simple three-tier assessment: basic awareness (can staff identify which tools use AI?), operational competence (can they use AI tools effectively and safely?), and governance understanding (do they know their obligations under the regulation?).

Week 4: Baseline report

Compile your findings into a baseline report. This document becomes your reference point for everything that follows. It should include: the complete AI inventory, risk classifications, skills assessment results, gap analysis, and a prioritised list of opportunities and risks. Share it with your leadership team and use it to secure buy-in for phases two and three.

Phase 2: Pilot and train (days 31 to 60)

With your audit complete, phase two is about controlled action. You select pilot projects, begin staff training, and establish the governance structures that will support long-term AI adoption. This phase is where strategy becomes practice.

Selecting pilot use cases

Choose two to three pilot projects based on your gap analysis. The ideal pilot has three characteristics: a clear, measurable business outcome (reduce processing time by 30%, improve forecast accuracy by 15%), limited scope (one department, one process), and manageable risk (not a high-risk AI system under Annex III). Pilots are experiments, not commitments. They should be designed to produce learning, not just results.

Staff AI literacy training

Article 4 training should begin in this phase, starting with the roles most exposed to AI systems. A practical approach uses three tiers: awareness training for all staff (what AI is, what your obligations are, how to recognise AI systems), operational training for daily AI users (how to use tools effectively, when to trust outputs, when to escalate), and governance training for managers and oversight roles (risk assessment, documentation, regulatory obligations).

Our workforce training guide provides a detailed breakdown of what each tier should cover and how to document compliance.

Establishing AI governance

Create a lightweight AI governance committee. This does not need to be a new department. It can be three to five people meeting monthly: a senior sponsor, someone from legal or compliance, someone from IT, and one or two business unit representatives. Their mandate is to review AI tool requests, monitor pilot progress, and ensure compliance documentation stays current.

Phase 3: Scale and comply (days 61 to 90)

The final phase takes what worked in your pilots and expands it. You complete training rollout, finalise compliance documentation, and establish the cadence for ongoing governance. By day 90, you should have a functioning AI strategy -- not just a plan.

Scaling successful pilots

Review pilot results against your defined metrics. For pilots that met their targets, develop a rollout plan for broader deployment. For pilots that underperformed, analyse why -- was it the tool, the training, the process, or the expectations? Failed pilots are not wasted investment if they produce actionable learning.

Completing compliance documentation

By the end of this phase, you should have the complete documentation set that national authorities will expect from August 2026: a current AI system register, risk classifications for each system, training records for all staff who interact with AI, governance committee minutes, and incident reporting procedures. This documentation is not bureaucracy -- it is your defence material.

Building the continuous improvement cycle

AI strategy is not a one-time exercise. Set a quarterly review cadence for your governance committee. Define triggers for ad-hoc reviews: new AI tool procurement, significant regulatory guidance, incidents or near-misses, and changes to business processes that involve AI. The organisations that sustain AI value are the ones that treat governance as ongoing, not one-off.

Aligning your AI strategy with EU AI Act compliance

Every element of this 90-day framework maps to specific EU AI Act obligations. This is deliberate. A well-designed AI strategy should produce compliance as a byproduct, not as a separate workstream.

Measuring AI strategy success

A strategy without measurement is a wish list. Define metrics before you start, track them throughout, and review them at the end of each phase. Here are the categories that matter.

Investment and ROI

The investment required depends on your organisation size, industry, and current maturity. Here is a realistic breakdown based on organisations we have worked with across Europe.

These figures include training costs, tool subscriptions, and internal time allocation. They do not include the cost of non-compliance -- which, under the EU AI Act, can reach EUR 35 million or 7% of global annual turnover for the most serious violations (Article 99).

Next steps: where to start today

You do not need to have everything figured out before you begin. The entire point of a phased approach is that each step informs the next. Here is what you can do this week.

Frequently asked questions

Sources and further reading

Official EU institutional sources and industry research.

Continue reading