First 90 Days AI Leadership Action Plan

Why this plan exists

AI is already entering housing through staff tools, supplier products and local experiments. Waiting for perfect certainty will leave the organisation exposed. Moving too fast can damage tenant trust, breach data protection, or impact service quality. The first 90 days should create enough structure for safe learning, regardless of where your organisation is along the AI journey and the level of maturity.

What good looks like after 90 days

A named executive owner for AI.

A simple AI register covering staff tools, supplier AI and local experiments.

Safe-use guidance for staff.

A risk triage route for new AI ideas.

Two or three small use cases with clear baselines and benefit measures.

A first view of supplier AI features and contract risks.

A short board or Audit and Risk Committee update.

Month 1: Understand current use

Leadership question: What AI is already entering the organisation, and which workflows are under the most pressure?

Month 2: Set guardrails and choose use cases

Leadership question: What can people do safely, and where could automation improve a workflow?

Month 3: Test, measure and report

Leadership question: What have we learned about tools, workflows and service outcomes?

Month 1: Understand Current Use

Action	Owner	Output
Name an executive owner for AI.	Chief executive or executive team	One accountable sponsor.
Create a first AI register.	IT/digital/data lead	List of staff tools, supplier features, pilots and informal use.
Map obvious high-risk areas.	Governance, data protection and service leads	Short list of uses involving tenant data, decisions, complaints, repairs or vulnerability.
Pick two or three priority workflows to study.	Executive team with service leads	Candidate journeys such as repairs triage, complaints handling or damp and mould response.
Ask core suppliers about AI roadmaps.	Procurement and IT	Supplier AI feature list and review dates.
Brief the board on the approach.	Executive owner	Short note: current position, risks, next 60 days.

Month 2: Set Guardrails and Choose Use Cases

Action	Owner	Output
Publish safe, restricted and prohibited AI uses.	Executive owner with IT and governance	One-page staff guidance.
Create a simple risk triage.	Governance and data protection leads	Low, medium and high-risk route for AI ideas.
Screen data protection and tenant impact.	Data Protection Officer or equivalent	DPIA screening questions and escalation route.
Add supplier checks to procurement.	Procurement and cyber leads	AI supplier question set.
Pick two or three early use cases.	Executive team	Small use cases with owners, baselines and success measures.
Decide board reporting rhythm.	Governance lead	Quarterly AI assurance update format.

Good early use cases: Usually, these have a narrow task, clear human oversight, and low data sensitivity. For example, summarising non-personal policy documents, classifying themes in anonymised feedback, or drafting internal communications.

Month 3: Test, Measure and Report

Action	Owner	Output
Run small experiments.	Use-case owners	Evidence from two or three controlled tests.
Measure value.	Service and finance leads	Time saved, quality improved, errors reduced or resident outcome improved.
Check risks and incidents.	Governance, IT and data protection	Issues log and lessons learned.
Review staff confidence.	People and service leads	Training gaps and adoption feedback.
Update the AI register.	IT/digital/data lead	Current register with risk ratings and next actions.
Report to board or Audit and Risk Committee.	Executive owner	Short assurance report and decision points.

First board update template — suggested headings

Heading	What to include
Current AI position	What is already in use or under review.
Ownership	Executive owner, delivery leads and governance route.
Risk	Highest risks, gaps and mitigations.
Data and tenant impact	Where we might breach data protection, or where fairness, accessibility, or resident trust may be affected.
Supplier exposure	AI features in current or planned supplier systems.
Early use cases	What is being tested and why.
Measures	Baseline, expected benefit and review date.
Decision needed	Approve, pause, continue, resource or escalate.