Guide 01 · Step 1 of 5

Frame and decide

Before anything is inventoried, someone has to say what this covers and who answers for it.

Independent guidance from Synergy. ISO/IEC 27001, ISO/IEC 42001 and ISO 22301 are published by ISO/IEC, which has no affiliation with Synergy and has not reviewed this material. Always work from the published text of the standard.

Most AI governance fails quietly. Nobody writes a policy that says "we will ignore this". What happens is that someone produces a register in March, everyone is pleased, and by September the register lists four systems while eleven are running.

This guide is five steps. The first two are a week of work for one person. The last two are not, and by then you will understand why.

Write a scoping note. It does not need to be more than a page.

• What is in scope — which AI systems, which departments, which data. If you use an AI feature embedded in software you already own, say whether it counts. It does.
• What is out of scope, and why — being explicit here prevents the argument in month four.
• What "good" looks like in twelve months — one sentence. Not a maturity model.

Then get a decision on risk appetite. Not a framework — a position, in writing, signed by the managing director or equivalent. Something like: we accept errors in internal drafting tools that a human reviews; we do not accept unreviewed output reaching a customer or a regulator.