Implementation · adopt in phases

A minimum viable governance stack first

Why this matters You don't need a finished program to start. A small first phase — a policy, an owner, a tiering rule — covers the biggest exposures now and scales from one unit to the whole institution without a reboot.

Phase 1 · Minimum viable stack

Stand up governance and the most urgent risk domains

09Governance, oversight & continuous review — established first

05Data, security, privacy & AI-enabled systems

01Teaching, learning & assessment

03Institutional algorithmic decision-making & student services

07Procurement, vendors & legal

Phase 2 · Full framework

Extend once infrastructure is operational

02Research & scholarship

04Student AI literacy, career readiness & workforce

06Fairness, transparency, accountability & oversight

08AI literacy & role-based competency (employees)