Sprint 3 · Days 61–90 — Scale or Stop, and Governance

Most SMB AI pilots never get an explicit decision made about them. They either fade quietly as attention moves to the next priority, or they expand by default because nobody actually said no — a second team starts using the tool, then a third, without anyone deciding that should happen. Phase three exists to force the decision that phases one and two were built to inform: scale it, fix it, or stop it, on purpose, with the pilot’s evidence actually in hand.

The day 60 numbers should answer this directly, not phase three. If the hours-saved figure is real and the friction from the pilot is fixable, this phase is about expanding deliberately to a second workflow — one more disciplined step, not a company-wide rollout. If the numbers are weak but the friction is fixable, this phase is about fixing the pilot before touching anything else. If neither is true, stopping cleanly is the correct outcome, not a failure that needs to be quietly buried. A clean stop with a documented reason is worth more to whoever runs the next attempt than a pilot left to fade unexplained.

None of this requires adopting a governance framework built for a listed enterprise. For a company in the thirty-to-a-hundred-fifty-headcount range, the minimum viable version covers a short list of practical questions, not a policy binder. Data handling: what’s allowed to go into an external AI tool, and what isn’t — client data, financials, anything under NDA. Ownership of outputs: who’s accountable for checking AI-generated work before it goes external, and how that check actually happens. Access: who can use which tools, and on which account, personal or company, so the shadow use uncovered in phase one doesn’t quietly turn into an uncontrolled liability. Three short, written answers to those cover most of the real risk at this size of company — a starting point, not a substitute for legal or compliance advice where the use case genuinely warrants it.

For the fuller version of this — risk tiers, vendor due diligence, and the documentation register — see the AI Governance Playbook Series.

Whoever needs to see the result — a board, investors, or just the rest of the leadership team — should get the same kind of number defined in phase one and measured in phase two: hours, cost, or turnaround time, against the baseline it’s measured from. Reporting anything vaguer than that at day 90 undercuts the credibility of running phase four, five, and six on the next workflow.

This is also the phase most adoption efforts skip outright, because by day 90 the original energy has usually already moved on to the next priority. Without a deliberate reinforcement step — a recurring check-in cadence, a named owner going forward, a plan for what happens when the tool changes or the person running it leaves — usage typically drifts back toward where it started within two more quarters. The sprint doesn’t end at day 90 with a report. It ends with a decision about who keeps this alive, and how.

Day 90 isn’t a finish line. It’s proof the sequence works on one workflow — which means the same structure can run again on the next one, faster the second time, because the diagnosis habits from phase one and the measurement discipline from phase two are already built in.

By day 90, four things should be true:

• An explicit scale, fix, or stop decision has been made and written down.
• The three governance questions — data, ownership, access — have short, written answers.
• A real number has been reported upward, with its baseline.
• Someone owns what happens next, by name.