Method
Five stages from unmanaged AI use to a governed programme
The method exists so the programme survives after the consultants leave: defined owners, repeatable routines and evidence that accumulates.
What are the five stages of the VGrid method?
Read maps actual AI use, tools, data, vendors and applicable obligations. Prioritise classifies use cases by risk and business impact to decide what is treated first. Implement deploys policies, controls, approval flows, documentation and technical safeguards. Govern operates the committee, indicators, evidence, incident handling and internal audit. Evolve adjusts the programme as regulation, models, agents and the organisation's AI footprint change.
The five stages in detail
- 01
1. Read
Discovery interviews, tool inventory, data flow mapping, vendor review and a gap analysis against ISO/IEC 42001 and NIST AI RMF. Output: a factual picture, not an opinion.
- 02
2. Prioritise
Risk classification per use case, regulatory tiering, business impact and a sequenced roadmap with owners and effort estimates.
- 03
3. Implement
Policy set, control library, human oversight arrangements, documentation templates, technical safeguards and training, rolled out with the accountable teams.
- 04
4. Govern
Committee cadence, decision records, indicators, evidence collection, incident and complaint handling, internal audit and management review.
- 05
5. Evolve
Periodic reassessment as new models, agents, vendors and regulatory milestones arrive, keeping classification and controls current.
Frequently asked questions
Can we start at a later stage?
Organisations with an existing inventory and risk method sometimes start at Implement. We still validate the earlier stages briefly, because programmes built on an incomplete inventory tend to fail at the audit stage.
Start at stage one
The Read stage delivers a factual picture of your AI footprint in four to six weeks.