Keep it simple and focused on outcomes. Name one owner, list AI use cases with a risk tier, publish clear guardrails, and add short reviews for high risk cases. Bake checks into your existing product and security processes. Scale the program as risk grows.