The First 90 Days:A Chief AI Officer's Plan
For a new CAIO joining a law firm with little or no AI infrastructure in place — the phase-by-phase plan for laying a durable foundation while showing visible value early enough to earn the mandate to build the rest.
The situation, and what it demands
Joining a firm with almost no AI setup is a greenfield build, and greenfield is both a gift and a trap. The gift is a clean slate and visible impact. The trap is the temptation to disappear for three months architecting a grand strategy while the partnership wonders what they hired. The job in the first 90 days is to do two things at once: lay a durable foundation and show visible value early enough to earn the mandate to build the rest. Credibility is the currency that funds everything that comes later, and in a partnership you earn it by persuasion and results, not authority.
One principle overrides the rest at a low-maturity firm: security and governance guardrails come before scale. If there is no AI use policy today, lawyers are almost certainly already pasting client-confidential material into consumer chatbots. The fastest way to lose the partnership in month one is a confidentiality incident. So the very first foundational act is not a strategy deck — it's a guardrail.
Days 1–30
Listen, diagnose, and stop the bleeding
The goal of the first month is understanding, relationships, and one urgent risk fix. Resist the urge to decide anything big yet.
Run a structured listening tour. Meet, deliberately and separately, with: the managing partner and executive committee; practice group leaders across every major practice; the COO/executive director, CFO, and CTO/CIO; information security and risk/GC; KM and the library; a spread of partners known as enthusiasts and skeptics; associates who'll actually use the tools; and, if you can, one or two key clients. For each, learn their priorities, their pain, their appetite for change, and the politics. You are mapping both the opportunity and the terrain.
Assess the current state honestly. Inventory what already exists: any tools in use (sanctioned or shadow), the document management system, data infrastructure and its condition, security posture, and any existing policies. Find out where AI is already happening informally — it always is — and how client data is flowing.
Do the one thing that can't wait: put an interim guardrail in place. Within the first few weeks, issue a plain-language interim AI acceptable-use guidance: what's approved, what's forbidden (no client-confidential or privileged material in public/consumer tools), and where to go with questions. It doesn't need to be perfect or permanent — it needs to exist. This single move protects the firm and signals that you take the obligations seriously.
Understand the economics and the mandate. Who controls the budget, what's actually committed, and what leadership expects and by when. Surface any mismatch between expectations and resources now, not in month three.
End-of-30 deliverable: A written current-state assessment, an interim use policy in force, and a first draft of your strategic point of view — shared with your sponsor.
Days 31–60
Set strategy, stand up governance, choose the first pilots
Now convert learning into a plan and the scaffolding to execute it.
Draft and socialize an AI strategy tied to firm goals. Not a technology wish-list — a roadmap connected to revenue, competitiveness, talent, and client demand, with a clear year-one focus. Present it to leadership, secure alignment, and confirm budget and mandate. Socialize it one-on-one with key partners before the formal presentation so the room is already warm.
Build the governance foundation. Stand up an AI steering/governance group (partners plus IT, risk, and KM), formalize the interim policy into a real acceptable-use and data-handling standard, and define a clear process for how tools get evaluated, security-reviewed, and approved. The aim is governance that enables responsibly, not a department of “no.”
Prioritize a small number of pilots. Pick one to three high-value, lower-risk use cases with named owners and defined success metrics — chosen to produce a visible win and to match the practices that matter most to your firm (for example, document review or discovery workflows in litigation; contract analysis or diligence in transactional work; a secure enterprise gen-AI assistant firmwide). Discipline matters here: do not buy everything the market is selling.
Evaluate vendors rigorously. Define your methodology — real use cases, security review, head-to-head comparison where possible — and begin structured pilots rather than committing to a full rollout on a demo.
Plan the team. Given a greenfield, decide what roles you need and in what order (often an adoption/training lead, a technologist, and governance support come first), and put the headcount ask in front of leadership with the strategy.
Where possible, ship a small quick win in this window — secure, trained access to an approved enterprise gen-AI tool, for instance — to build momentum while the bigger pilots spin up.
End-of-60 deliverable: An approved strategy and budget, a governance framework adopted, pilots selected with owners and metrics, and a team plan submitted.
Days 61–90
Launch, prove value, and plan to scale
The final month is about execution and evidence.
Launch the pilots with real change management. Access is not adoption. Pair each pilot with training, named champions in the practice, focus groups, and a feedback loop back to you and the vendor. Embed the tools into actual workflows rather than leaving them as a novelty.
Measure from the start. Establish a baseline and an honest ROI approach — distinguishing time genuinely saved from time merely shifted — and collect both usage data and qualitative feedback. You will need this to keep the partnership funding the effort.
Deliver and communicate a demonstrable early win. Find the concrete result — a workflow measurably faster, a matter team that adopted a tool and won't give it back — and tell that story to the partnership. Visible wins are what convert a pilot budget into a program budget.
Firm up governance and the next phase. Get the full policy formally adopted, make or post your first key hires, and present a 6–12 month roadmap with priorities, resourcing, and metrics — the handoff from setup to scale. Be ready, too, to answer the client question that's coming: “what's your firm's AI capability?”
End-of-90 deliverable: Live pilots with early adoption data, a documented win communicated to leadership, governance formally in place, initial hires underway, and a funded roadmap for the next two to three quarters.
Principles to hold throughout
Credibility is currency. Balance foundation-building with visible wins; never go dark for 90 days.
Security before scale. Guardrails first — one client-data incident undoes a year of goodwill.
Lead by influence. In a partnership you build coalitions and persuade; you rarely command.
Discipline against hype. Pilot before you roll out; kill what doesn't earn its place.
Adoption is the job. Deploying a tool is 20% of the work; getting lawyers to change how they work is the other 80%.
Set honest expectations. Tell leadership up front that ROI is hard to isolate and adoption takes time — then over-deliver on what you promised.
Common mistakes to avoid
- Rolling out firmwide before a disciplined pilot proves the tool and the workflow.
- Buying the flashiest platform on day one instead of matching tools to real use cases.
- Building governance so heavy it blocks everything — or so light it protects nothing.
- Neglecting information security and risk as partners rather than obstacles.
- Mistaking enthusiasm and licenses purchased for genuine adoption.
- Spending the whole 90 days on strategy and producing nothing the firm can see.
What success looks like at 90 days
You have the partnership's confidence, a strategy and budget with a real mandate, governance that protects the firm without smothering it, one or more pilots live with early evidence of value, a visible win the leadership can point to, your first hires in motion, and a funded roadmap for what comes next. You've moved the firm from nothing in place to a credible, governed, resourced program with momentum — which is exactly what the next twelve months need to build on.
Hiring a Chief AI Officer?
Define the profile with the needs assessment, then test candidates against it with the interview guide.