AI Implementation Roadmap

Prepared for: Small Rock Trust Company (illustrative) — an independently owned Trust Company, 32 staff, Jersey.
Prepared by: Change AI Consortium
Roadmap horizon: a 30-day sprint to a board-signed-off plan and a tested pilot, then 90 days to the next deliveries.

This roadmap is one of two linked deliverables. The AI use policy and the controls that make it safe to act on sit in a companion document: read the sample AI Governance Policy and Controls.

1. Named owner

Accountable executive: Chief Operating Officer. The COO owns this roadmap, its delivery and its results, and reports progress to the board monthly.

Oversight: Head of Risk and Compliance. Owns the AI policy, challenges each new use before it starts, and reviews the controls quarterly.

AI decisions are not left to individual staff or to IT. One named role holds the plan, and a second, independent role checks it.

2. Prove ROI: the pilot Optional

Board Pack Assistant

What it does. Collates the monthly board pack from existing internal reports and produces a first draft for the Company Secretary to review. Formatting and assembly only, no new analysis generated, and no client data used.

How it runs. In a sandbox, with no changes to core systems and no access to operational data. A named reviewer confirms every figure against source before the pack is circulated.

How ROI is measured. Time to first draft of the monthly board pack. Baseline measured in week 1; target a 30% or greater reduction, measured at day 30. This is a target set at the start, not a promised result.

Why this one. It scores highest on value and ease in the backlog below, it has a human check already built into the existing process, and it keeps AI entirely away from client data while the controls are proven.

If the firm opts out of the pilot, the roadmap is still delivered in full, and the ROI case rests on the ranked backlog below.

3. Opportunity backlog, ranked by ROI

Five opportunities, ranked on value against ease of implementation. Each carries a technical deliverable and a business deliverable, a risk, and an owner.

Opportunity	Technical deliverable	Business deliverable	Risk	Value	Ease	Owner
1. Board reporting pack assembly Pilot	AI-assisted collation of the monthly board pack from existing internal reports, formatting only, no new analysis generated.	A named reviewer confirms every figure against source before the pack is circulated.	Medium — a wrong figure reaching the board is a real error, caught by the review step	High	High	Company Secretary
2. Internal policy drafting support	AI-assisted first draft of internal policy updates from regulatory source material, never published without a named sign-off.	A short reviewer's checklist, so a human always checks the draft against the source before it becomes policy.	Low — nothing reaches a client or a regulator unreviewed	Medium	High	Head of Risk and Compliance
3. Correspondence drafting	AI-assisted first draft of routine, non-client-data correspondence templates.	A style guide so drafts sound like the firm, not like a generic assistant.	Low	Medium	High	Office Manager
4. Client onboarding review support	AI-assisted first read of onboarding documents against the firm's own checklist, output reviewed by staff before any decision. Opens only after the client-data gate in row 5 is passed.	Staff training on how to brief and check the tool, and when to override it.	Medium — touches client documents, so it waits for the client-data controls; a misread could delay onboarding	High	Medium	Head of Client Services
5. Client-matter AI use	Deliberately not scoped this phase. No client data, including anything covered by legal professional privilege, goes into an AI tool until the governance and technical controls in the companion policy document are in place and tested.	A board decision, recorded in minutes, on if and when this phase opens, with named conditions.	High — confidentiality and privilege are the firm's top concern	High	Low	The Board

4. Why this order

The first three opportunities keep AI away from client data and privileged material entirely, and keep a named human checking the output before it goes anywhere. Onboarding support is high value but touches client documents, so it waits until the controls are proven on internal work first. Client-matter use, the highest-value and highest-risk opportunity, is named and scoped, not started, until the board opens it. This is a deliberate ordering decision, not caution for its own sake.

5. How the 30 days ran

Week 1: Align and discover Leadership workshop: the state of AI in the industry (usage, regulator guidance, use cases, risks), the firm's own business model and processes, and where AI could help. Stakeholders and governance roles agreed. Pilot opportunity chosen, and roles and approach agreed with IT. Pilot baseline measured.

Weeks 2 to 3: Build and review Pilot built and validated with the process owners. AI framework and controls reviewed with Risk and Compliance, and fitted into the firm's existing policies.

Week 4: Test, release and sign off Pilot user testing and limited production release. Lessons learned reviewed with leadership. Roadmap finalised and signed off by the board, with the accountable executive named in minutes.

6. What happens next: the following 90 days

Pilot results reported to the board against the week 1 baseline, with a decision to keep, extend or stop it.
Approved tool list published to staff, alongside the AI policy in the companion document.
Opportunities 2 and 3 begin, both inside the internal-only boundary.
Client-data controls tested, so the board can decide whether opportunity 4 opens.

7. Value tracking

Each opportunity is reviewed 90 days after it starts against one plain question: is this saving real time, and is the output still being checked properly? The pilot is judged against its week 1 baseline, so the answer is a number, not an impression. An opportunity that fails either test is paused, not quietly continued. This is how the roadmap avoids the most common failure seen across the sector: AI deployed with no clear use case and no way to judge whether it is working.

← Return to home page · Read the AI Governance Policy and Controls →