May 16 2026. Maya Okafor walks into Acme's HQ at 7:47 a.m. as the firm's first Chief AI Risk Officer. Badge in pocket. Mandate ratified by the board March 14 2026 (lesson 097). Office on the 14th floor next to the Chief Risk Officer. AI Governance Committee charter ratified six months earlier (lesson 015). 11 Tier-1 systems in production. €11.8M FAIR ALE_95 baseline (lesson 086). The EU AI Act Annex III high-risk obligations bind December 2 2027, 565 days away. The first board AI subcommittee meeting Maya is responsible for is October 24 2026, 161 days away. The audit committee chair has asked for a 90-day reading and a 180-day plan. The General Counsel has asked for an Article 73 incident posture review by Day 30. The CFO has asked whether the €17.9M three-year appetite envelope is the right shape (lesson 098). The CIO has asked whether his AI engineers will be slowed down. Two regulators, one in Brussels, one in Washington, have sent letters introducing themselves. Maya opens her laptop, opens a blank 180-day calendar, and writes the only honest question a new CAIRO can write on Day 1: where do I start? This is the final lesson of the 110-lesson skill.re AI Governance, Risk & Red Teaming program, the L5 capstone that synthesizes the entire arc into a 180-day actionable plan for the newly-appointed CAIRO or equivalent AI risk leader. Six named epochs (Days 1-14 Listen + Map; Days 15-45 Diagnose + Prioritize; Days 46-90 Decide + Execute First Wave; Days 91-120 Build + Scale; Days 121-150 Codify + Ratify; Days 151-180 Externalize + Commit). A 15-item Day-1 readiness checklist. Top-10 questions every CAIRO must answer in Days 1-30. Five anti-patterns that wreck CAIRO transitions. The Acme worked example, Maya's actual 180 days. The L1-L5 program synthesis. And the program close: regulator-defensible AI is mission-aligned with the long-term commercial viability of AI in enterprise.

The Six Epochs - From Day 1 to Operating

The 180-day transition is not a single arc. It is six distinct epochs, each with a distinct posture, a distinct primary activity, and a distinct decision-making latitude. The error CAIRO transitions make most often is collapsing the epochs into a continuous "execute fast" period: which surfaces as the Day-30 over-promising anti-pattern, the Day-90 over-rotation toward tactics, or the Day-150 failure to externalize. The six epochs are the cadence the regulator-grade transition runs on.

Epoch 1 - Days 1-14: Listen + Map. The CAIRO's primary activity is structured listening, not decision-making. Named meetings: AIGC chair (lesson 015); first-line owners of the top-5 inventory systems by risk tier (lesson 045); audit committee chair; board AI subcommittee chair (lesson 100); General Counsel; Chief Risk Officer; Chief Information Officer; Chief AI Officer (CAIO peer, lesson 108); Chief Information Security Officer; Chief Privacy Officer; Internal Audit lead (lesson 093); existing AI Risk Office staff (lesson 075); HR for talent strategy context (lesson 107); CFO for envelope context (lesson 098); two-to-three named external regulators who have already reached out. The deliverable: an internal listening memo to the AIGC summarizing what the CAIRO has heard, what is working, what is not, and what the CAIRO will decide about in the next epoch. No major decisions in Days 1-14. Decisions made in the listening epoch are decisions made without information.

Epoch 2 - Days 15-45: Diagnose + Prioritize. The CAIRO opens the four diagnostic instruments: heat-map refresh (lesson 042), AIRA assessment (lesson 074), FAIR ALE_95 ballpark (lesson 086), Tier-1 inventory verification (lesson 045). Each instrument is refreshed, not rebuilt, the CAIRO does not waste the first 45 days rebuilding what already exists. Output of the four instruments: the top-5 AI risks with named owners, named treatment plans, and named treatment dates; an updated heat-map; a refreshed AIRA with the CAIRO's first-pass risk appetite calibration; a FAIR ALE_95 reading that informs penalty exposure conversations with the General Counsel and the CFO. Named deliverable: the first AIGC report-out at Day 45 covering the top-5 risks, the heat-map refresh, and the immediate action plan. The CAIRO's authority to decide widens in Epoch 2: small operational decisions (tooling procurement re-prioritization, FRIA pipeline cadence) are legitimate; structural decisions (operating model, headcount ramp, certification strategy) wait for Epoch 3.

Epoch 3 - Days 46-90: Decide + Execute First Wave. The CAIRO converts diagnosis into action. AIRA either reaffirmed or refined and re-ratified by AIGC (lesson 074); first Annex IV Technical Documentation File refresh executed for the top Tier-1 system (lesson 028); first red team finding closure cycle run end-to-end (lessons 081 + 084); first Article 27 FRIA cycle initiated for an Annex III deployer system (lesson 026); first Article 73 incident-response tabletop drill scheduled (lesson 037); first board AI subcommittee 6-slide brief delivered (lesson 100). The 6-slide brief is the CAIRO's first regulator-grade external-facing artifact: written for the audit committee chair, the board AI subcommittee chair, and the regulator who will eventually read it. Epoch 3 is also the operating-model decision deadline (lesson 108), embedded vs centralized vs hybrid, because hiring decisions in Epoch 4 depend on the operating-model architecture.

Epoch 4 - Days 91-120: Build + Scale. The CAIRO stands up the operating-maturity layer. Conformity Assessment Function operationalized (lesson 077); red team scaled to Year-2 ramp curve (lessons 081-084); Independent Model Validation process documented and first cycle initiated (lesson 068 + lesson 070); ISO 42001 readiness assessment commissioned (lesson 056); Article 4 literacy program advanced to 85% in-scope coverage (lesson 014). Epoch 4 is the headcount-acceleration epoch, the talent strategy from lesson 107 executes against named openings; the operating-model from lesson 108 directs reporting-line architecture; the function roadmap from lesson 106 directs ramp pacing. The CAIRO's decisions in Epoch 4 are the most capital-intensive of the 180 days.

Epoch 5 - Days 121-150: Codify + Ratify. The CAIRO codifies what has been built. Article 17 Quality Management System documented (lesson 079); RACI codified across the intake-to-decommission lifecycle (lesson 075); Three Lines of Defence codified (lesson 073); operating-model decision ratified by board AI subcommittee (lesson 108); function roadmap ratified by board (lesson 106). Epoch 5 produces the audit-defensible documentation set: what an ISO 42001 Stage 1 auditor, an SR 11-7 examiner, or an AI Office surveillance inquiry will inspect. The CAIRO's signature on each codified instrument is part of the personal accountability trail under EU AI Act Article 22 (authorised representative) and Article 47 (declaration of conformity).

Epoch 6 - Days 151-180: Externalize + Commit. The CAIRO turns outward. First regulator engagements (lesson 103, NIST CAISI + AISIC; lesson 105, public testimony, ISO JTC1 SC42, CEN-CENELEC); first coalition participations (lesson 104, GPAI Code of Practice working groups, industry coalitions); three-year plan board-ratified (lesson 098 + lesson 106); CAIRO signs the first Article 47 Declaration of Conformity (lesson 102) for an Annex III system entering the Year-1 EU database registration cycle (Article 71). Epoch 6 is the commitment epoch, the CAIRO's name appears on regulator-facing documents that bind the firm and bind the CAIRO personally. The 180-day plan ends with the CAIRO operating, not transitioning.

The six-epoch cadence is the same regardless of firm size, sector, or jurisdiction. What varies is the depth of pre-existing instruments. A firm with a mature AIGC and a refreshed AIRA can compress Epoch 1 to 10 days; a firm with neither extends Epoch 1 to 21 days. The total 180-day envelope holds. The board AI subcommittee tracks against the six-epoch cadence, not against a continuous "what have you done lately" metric.

Day-1 Readiness Checklist and the Top-10 Questions

The CAIRO's first day cannot be a discovery exercise. The 15-item Day-1 readiness checklist is the minimum information set the CAIRO must have before the badge activates. The checklist is the responsibility of the search committee, the General Counsel, and the outgoing risk leader (if applicable), not the CAIRO. A CAIRO who arrives without the checklist completed is operating with one hand tied.

• (1) Badge + physical access. Building, floor, secure rooms, board room, AIGC room, AI Risk Office, executive committee room. Day-1 working.
• (2) Digital access. Corporate email, intranet, evidence repository (lesson 092), AI inventory platform (lesson 045), GRC tooling, regulator portal, board portal. Day-1 working with audit logs enabled.
• (3) Mandate documented and ratified. CAIRO mandate (lesson 097) ratified by board, with reporting line, veto rights, and dotted-line to board AI subcommittee chair explicit. Mandate countersigned by CEO + Board Chair + Audit Committee chair.
• (4) Board chair introduction. 30-minute one-to-one in Day-1 calendar. Topic: board's information appetite, board's risk tolerance, board's posture toward AI.
• (5) Audit committee chair introduction. 30-minute one-to-one in Week 1. Topic: audit committee's reporting cadence expectations, the existing AI audit plan (lesson 093), third-line independence posture.
• (6) AIGC chair introduction. 30-minute one-to-one in Day-1 calendar. Topic: AIGC operating tempo, decision quality record, current open items.
• (7) CAIO peer introduction. 30-minute one-to-one in Week 1 (lesson 108). Topic: operating model alignment, intake-to-deployment lifecycle ownership, friction points.
• (8) Top-5 inventory items briefed. One-page briefing per system covering risk tier, owner, deployment date, Annex III classification, regulator exposure, FAIR contribution. Provided pre-arrival.
• (9) Existing AIRA reviewed. Full AIRA document (lesson 074) provided pre-arrival; CAIRO has read it before Day 1 and identified open questions.
• (10) Existing heat-map reviewed. Current heat-map (lesson 042) provided pre-arrival; CAIRO has identified top-5 unresolved risks before Day 1.
• (11) Existing red team status. Red team operating posture (lesson 081), open findings register, last engagement date per high-risk system. Provided pre-arrival.
• (12) Existing FRIA pipeline. List of FRIAs in progress and pending (lesson 026), with named owners and target completion dates.
• (13) Existing Article 73 incidents. Article 73 incident register (lesson 037) with last 12 months of reported incidents, resolution status, regulator correspondence.
• (14) Existing ISO 42001 status. Readiness assessment outcome (lesson 056), Stage 1 or Stage 2 status if applicable, surveillance plan, certification body identity.
• (15) Existing vendor concentration. Vendor due diligence questionnaire results (lesson 089), top-5 model providers by exposure, contractual renewal calendar, indemnity ladder per vendor.

The checklist is not exhaustive. It is the floor. A new CAIRO with all 15 items addressed before Day 1 spends Days 1-14 listening and mapping. A new CAIRO with only six items addressed spends Days 1-30 doing the search committee's job, and the regulator-grade transition slips a full month.

Parallel to the checklist is the Top-10 questions every CAIRO must answer in Days 1-30. These are the questions the board AI subcommittee, the audit committee, and the first regulator inquiry will ask in the first quarter, and the CAIRO who cannot answer them at Day 30 is operating without situational awareness.

• (1) How many AI systems are in production right now? Counted by the inventory definition the firm uses, validated against the model registry, validated against the shadow-AI scan output (lesson 045). Answer must distinguish first-party, vendor-provided, and embedded models.
• (2) Which are Annex III high-risk? Counted by EU AI Act Annex III categorization (lesson 042). Answer must cite the specific Annex III §X clause per system and the December 2 2027 binding date.
• (3) Which are agentic? Counted by the agent autonomy tier control matrix (lessons 081-084 + agentic-AI-governance-autonomy-tools-memory-kill-switches). Answer must include autonomy tier, tool allowlist scope, memory architecture, and kill-switch evidence per system.
• (4) Where are we vs Annex III Dec 2 2027 deadline? Gap analysis per Annex III system covering Article 9 RMS, Article 10 data governance, Article 11 + Annex IV TDF, Article 13 transparency, Article 14 human oversight, Article 15 accuracy / robustness / cybersecurity, Article 17 QMS, Article 27 FRIA, Article 47 declaration, Article 71 database registration (lesson 079 + lesson 102).
• (5) Which regulator is most likely to inquire first? Based on jurisdiction footprint, sector, public profile, recent enforcement patterns. Named regulator with named likely inquiry vector.
• (6) What is our worst-case scenario? Top-5 FAIR loss event scenarios with ALE_95 and ALE_99 (lesson 086). Each scenario named, each impact quantified, each treatment plan referenced.
• (7) Where are we within risk appetite? Per AIRA dimension (lesson 074 + lesson 098): within tolerance, near tolerance, at tolerance breach. Named treatment plan per breach.
• (8) What is our insurance coverage? Cyber + tech E&O + D&O AI exposure. Named policy limits, named exclusions, named renewal date (lesson 109).
• (9) Who reports to me + who do I report to? Full org chart with named individuals, dotted-lines, RACI on each operating process (lesson 075). The reporting line is the second-most common ISO 42001 Stage 2 finding (lesson 097).
• (10) What is the board AI subcommittee's information appetite? 6-slide brief cadence, level of detail expected, escalation triggers, regulator-correspondence pre-clearance protocol (lesson 100).

The Top-10 questions are answered in writing by Day 30 and shared with the AIGC, the audit committee chair, and the board AI subcommittee chair. The CAIRO's Day-30 written response is the first audit-defensible artifact of the transition, and the first instrument the regulator-grade examiner will request in any forward inquiry.

Five Anti-Patterns That Wreck CAIRO Transitions

Five anti-patterns recur across 2025-2026 CAIRO transitions observed across financial services, healthcare, energy, public sector, and platform firms. Each is predictable and each is preventable. The board AI subcommittee chair and the executive sponsor (CEO or CRO) should review the anti-pattern list before the CAIRO arrives, the transition's success rate doubles when the sponsor is watching for these failure modes.

Anti-pattern 1 - Over-promising in Days 1-30. The CAIRO arrives, feels the pressure of audit committee questions and regulator letters, and over-promises in the first all-hands or first AIGC meeting. "We will have Annex IV TDF for all Tier-1 systems by Day 60." "We will close all open red team findings in the first quarter." "We will have ISO 42001 readiness by Q3." The CAIRO cannot deliver because the existing instruments are not in the state the CAIRO assumed; the first missed promise creates a credibility deficit that compounds across the 180 days. The fix: in Days 1-14 the CAIRO commits only to listening; in Days 15-45 the CAIRO commits to diagnostic deliverables; first executable commitments wait for Day 45. The Day-45 AIGC report-out is the first place the CAIRO makes named commitments.

Anti-pattern 2 - Under-promising and loss of sponsorship. The mirror failure. The CAIRO arrives cautiously, commits to almost nothing in Days 1-90, and the executive sponsor, CEO or CRO, loses confidence that the function will produce. By Day 90 the CFO is questioning the Year-1 spend; by Day 120 the audit committee chair is asking whether the role should report differently; by Day 150 the CAIRO has lost the political capital to ratify the operating model. The fix: the CAIRO commits to specific diagnostic deliverables in Epoch 2 (refreshed heat-map by Day 30, refreshed AIRA by Day 45, top-5 risks named by Day 45), specific executable deliverables in Epoch 3 (first 6-slide board brief by Day 90, first FRIA cycle by Day 90, operating-model decision by Day 90), and specific build deliverables in Epoch 4 (CAF stood up by Day 120, red team scaled by Day 120). Under-promising and over-promising are both failures of calibration; the fix is the six-epoch cadence itself.

Anti-pattern 3 - Too-tactical in Days 91-180 (no strategic posture). The CAIRO over-rotates toward tactical execution in Epochs 4-5 and fails to externalize in Epoch 6. By Day 180 the function has stood up CAF + red team + IMV + ISO 42001 readiness, but the CAIRO has not engaged a single regulator, has not joined a single coalition, has not signed an Article 47 declaration, has not testified or commented on a single standards proceeding. The function looks operationally healthy and strategically invisible. The next regulator inquiry treats the firm as a tactically-mature but strategically-unknown entity, and tactically-mature-but-strategically-unknown firms draw closer examination than tactically-mature-and-strategically-engaged firms (lessons 103 + 104 + 105 cover the externalization moves the CAIRO must make by Day 180). The fix: Epoch 6 calendar slots for regulator engagement, coalition participation, and the first Article 47 declaration are blocked in the CAIRO's Day-1 calendar, non-negotiable.

Anti-pattern 4 - Ignoring third-line independence. The CAIRO arrives and absorbs the Internal AI Audit function under the second-line CAIRO office for operational convenience. The third-line independence is structurally broken from Day 1 (lessons 073 + 093). The ISO 42001 Stage 2 finding follows; the SR 11-7 finding follows; the board audit committee chair raises the issue at the first review. The fix: Internal AI Audit (lesson 093) reports to the Chief Audit Executive with dotted-line to the Audit Committee chair; the CAIRO has zero authority over Internal AI Audit hiring, planning, scope, or findings; the three-line architecture is named in the CAIRO mandate ratified before Day 1 (lesson 097).

Anti-pattern 5 - Skipping cultural assessment (engineering pushback later). The CAIRO focuses on policy + process + tooling + headcount in Epochs 1-3 and skips the cultural assessment with engineering, product, and ML practitioner populations. By Epoch 4 the CAIRO's policies meet engineering pushback: "we cannot ship like this," "the FRIA process is too slow," "the red team is blocking releases." The pushback escalates to the CAIO and the CIO; the operating model from lesson 108 fractures. The fix: in Epoch 1 (Days 1-14) the CAIRO conducts named cultural-assessment listening sessions with engineering leadership, ML practitioners, product managers, and front-line developers; the AI Risk Office adopts a service-design posture toward the first line (lesson 075 + lesson 108); the operating model is co-designed with the CAIO, not imposed.

The five anti-patterns map to the six-epoch cadence: anti-patterns 1 and 2 are Epoch-1 to Epoch-2 failures of calibration; anti-pattern 3 is an Epoch-6 failure of externalization; anti-pattern 4 is a Day-1 structural failure of mandate design; anti-pattern 5 is an Epoch-1 failure of cultural assessment that surfaces in Epoch-4. A CAIRO who understands all five at Day 1 has a materially higher success probability than a CAIRO who learns them by experience.

Acme Worked Example - Maya Okafor's 180 Days

Maya Okafor's 180-day transition at Acme ran from May 16 2026 to November 12 2026. Acme is a €10B-turnover diversified financial services and technology platform firm with 11 Tier-1 AI systems in production, four Annex III §5(b) consumer credit systems, two Annex III §6 employment systems, one Annex III §8 essential public service system, and four GPAI-derivative systems with Article 50 transparency exposure. The firm's pre-existing instruments at Maya's Day 1: AIGC charter ratified October 2025; CAIRO mandate ratified March 14 2026; AIRA v1 ratified March 2026 by AIGC; preliminary heat-map dated February 2026; AI inventory at 91% coverage with 8% shadow-AI exposure; first-pass red team baseline against OWASP LLM Top 10 dated January 2026; Article 4 literacy program at 78% coverage; ISO 42001 readiness assessment commissioned but not yet started.

Days 1-14 (May 16 - May 29). Maya runs 38 listening conversations: AIGC chair, audit committee chair, board AI subcommittee chair, CEO, CRO, CFO, CIO, CAIO peer, CISO, CPO, General Counsel, Internal Audit lead, three first-line owners of the top-5 inventory systems, HR head, four AI Risk Office staff, two external regulators (one DG CNECT desk officer, one US-CFPB AI office contact), three external advisors. Output: a 14-page listening memo to AIGC May 30 covering what is working (AIGC tempo; AIRA v1 quality; AI inventory coverage), what is not (red team siloed from IMV; ISO 42001 readiness not yet commissioned; Article 4 literacy under-90%), and what Maya will decide in the next epoch.

Days 15-45 (May 30 - June 30). Diagnostic instruments refreshed: heat-map updated with two new agentic systems escalated to Tier-1; AIRA v1 reaffirmed with two refinements, Annex III §5(b) consumer credit appetite tightened, Article 99 penalty exposure ceiling raised by €1.4M; FAIR ALE_95 ballparked at €11.8M against the refreshed inventory (lesson 086); Tier-1 inventory verified with three additions and one decommission. Top-5 risks named with owners: (1) Annex III §5(b) consumer credit Article 27 FRIA gap (owner: Head of Consumer Lending + Maya); (2) agentic system memory poisoning exposure (owner: Head of Engineering + Red Team Lead); (3) vendor concentration in foundation model (owner: Head of Procurement + Maya); (4) Article 73 incident-response runbook incomplete (owner: CISO + Maya); (5) Article 4 literacy gap in three business units (owner: HR + Maya). First AIGC report-out June 30. Decisions made: heat-map ratification; AIRA refinement ratification; top-5 risk owners assigned. Decisions deferred: operating model; ISO 42001 certification commitment; red team Year-2 ramp.

Days 46-90 (July 1 - August 14). Execution wave one. AIRA v1.1 ratified by AIGC July 14 and noted by board July 28. First Annex IV TDF refresh for Annex III §5(b) consumer credit system completed August 8 (lesson 028). First red team finding closure cycle run end-to-end on prompt injection finding in the customer-service agent: finding raised July 6, IMV re-validation August 1, finding closed August 12 (lessons 081 + 084). First Article 27 FRIA cycle initiated for Annex III §5(b) consumer credit system July 14 (lesson 026). First Article 73 tabletop drill scheduled for September 18 (lesson 037). First board AI subcommittee 6-slide brief delivered August 14 covering top-5 risks, 4-KPI dashboard (FRIA completion 73%, Annex IV TDF coverage 27%, Article 4 literacy 84%, red team coverage 38%), Article 99 penalty exposure (€11.8M ALE_95), and immediate action plan. Operating-model decision made August 11 (lesson 108): federated-hybrid with CAIRO office centralized + AI Risk Officers embedded in three business units; ratified by AIGC August 12 and noted by board AI subcommittee August 14. Acme is now executing, not transitioning.

Days 91-120 (August 15 - September 13). Build wave. Conformity Assessment Function operationalized August 22 (lesson 077) with CAF lead + Annex IV TDF lead + FRIA lead in seat. Red team scaled to 4 FTE (toward 6-FTE Year-2 target by Q1 2027, lesson 081). Independent Model Validation process documented and first cycle initiated September 1 on the highest-risk Annex III §5(b) system (lesson 068 + lesson 070). ISO 42001 readiness assessment commissioned with BSI September 5 with target Stage 1 audit Q2 2027 (lesson 056). Article 4 literacy program advanced to 89% coverage September 12 (lesson 014). First Article 73 tabletop drill executed September 18, post-mortem ratified by AIGC October 6. Hiring decisions: 5 named offers extended in Epoch 4; 4 accepted.

Days 121-150 (September 14 - October 13). Codification wave. Article 17 QMS documented and ratified September 28 (lesson 079); RACI codified across intake-to-decommission lifecycle October 5 (lesson 075); Three Lines of Defence codified October 5 (lesson 073) with Internal AI Audit reporting to Chief Audit Executive confirmed; operating-model decision ratified by board AI subcommittee October 24 (lesson 108); function roadmap presented to board AI subcommittee October 24 (lesson 106). Audit committee chair signs off on third-line independence architecture October 25.

Days 151-180 (October 14 - November 12). Externalization wave. First regulator engagement: Maya joins NIST CAISI working group on agentic-system evaluation October 17 (lesson 103). First coalition participation: Acme joins GPAI Code of Practice industry working group October 24 (lesson 104). First public comment submitted: ISO JTC1 SC42 ballot comment on AI agent terminology October 31 (lesson 105). Three-year plan board-ratified November 7 (lesson 098 + lesson 106). First Article 47 Declaration of Conformity signed by Maya November 12 for the highest-risk Annex III §5(b) consumer credit system, entering the Article 71 EU database registration cycle (lesson 102). The 180 days end with Maya operating, not transitioning.

Quarterly retrospective, what worked. The six-epoch cadence held, Maya did not collapse Epoch 1 into Epoch 2 despite pressure from the audit committee chair. The pre-existing instruments (AIGC charter, AIRA v1, AI inventory at 91%, first-pass red team baseline) compressed Epoch 1 from 21 days to 14. The Day-1 readiness checklist completed by the search committee meant Maya started executing on the listening epoch on Day 1, not Day 7. The Top-10 questions answered by Day 30 became the spine of the first audit committee briefing.

What was painful. The operating-model decision (lesson 108) took longer than planned, the CAIO peer wanted full embedded; Maya wanted full centralized; the federated-hybrid compromise required four bilateral meetings and three AIGC discussions before ratification. The Article 4 literacy gap in three business units (anti-pattern 5) surfaced as engineering pushback in Epoch 3; Maya recovered by running cultural-assessment listening sessions retroactively in Epoch 4 but the pushback delayed the operating-model ratification by two weeks. The vendor concentration risk (top-5 risk #3) could not be resolved within 180 days, Maya committed to a Year-2 procurement diversification plan in the function roadmap.

What would be different next time. Maya would commission the ISO 42001 readiness assessment in Day 1 of Epoch 1, not Day 5 of Epoch 4, the 90-day commissioning lead time pushed Stage 1 from Q1 2027 to Q2 2027. Maya would run the cultural-assessment listening sessions in Epoch 1, not retroactively in Epoch 4, anti-pattern 5 is preventable, not recoverable. Maya would block the Epoch 6 regulator engagement calendar slots on Day 1, even before knowing which regulators, blocking the time prevents the calendar from filling with tactical work that crowds externalization.

Aggregate Article 99 exposure reduction across 180 days. FAIR ALE_95 May 16 baseline: €11.8M. FAIR ALE_95 November 12 reading: €9.4M. Six-month reduction: €2.4M (20%). Projected 180-day reduction across the function roadmap horizon (lesson 106): 35-50% by end of Year 1; 48-60% by end of Year 3. The 180-day plan execution materially reduces aggregate exposure even before structural maturity arrives at Year 2-3.

L1-L5 Program Synthesis - How 110 Lessons Map to the 180 Days

This is the final lesson of the skill.re AI Governance, Risk & Red Teaming program, 110 lessons across five levels, designed as a learning arc from L1 (Risk Aware) through L5 (Chief AI Risk Officer). The lessons were not written as standalone artifacts. They were written as a coherent operating doctrine, and the CAIRO's 180-day transition is where the doctrine becomes practice. The L1-L5 program maps onto the CAIRO's actual 180 days as follows.

L1 (Risk Aware) - Days 1-7 ramp content. The L1 chapters (regulatory stack, prohibited practices, high-risk classification, GPAI thresholds, AI literacy, governance committee fundamentals: lessons covering Articles 5 + 6 + 50 + 51-55, AIA + AI risk assessment + FRIA distinctions, NIST AI RMF cross-walk, ISO 42001 vocabulary) are the CAIRO's Day-1 working vocabulary. The CAIRO did not learn this material in transition, the CAIRO arrived already fluent. A CAIRO who is not fluent in L1 material at Day 1 cannot run the listening epoch, cannot ask the diagnostic questions in Epoch 2, and will be exposed in the first AIGC.

L2 (Policy Author) - Days 30-60 reusable patterns. The L2 chapters (AI acceptable use policy, vendor risk policy, intake policy, model lifecycle policy, incident response policy, RACI patterns, three-lines policy, AIGC charter patterns) are the reusable patterns the CAIRO draws on in Epochs 2-3 to refresh, refine, or ratify policy instruments. The L2 lessons are templates, not narratives, a CAIRO authoring a new vendor risk policy in Epoch 3 reaches for the L2 vendor risk policy lesson as a working template.

L3 (Risk Practitioner) - Days 60-120 execution toolkit. The L3 chapters (AI inventory build, heat-map construction, FAIR quantification, Annex IV TDF build, FRIA execution, red team build + technique catalogue, IMV cycle, Article 72 PMM, Article 73 incident-response runbook, evidence management) are the execution toolkit the CAIRO operates in Epochs 3-4. The L3 lessons are the operating instruments, the CAIRO running a FRIA cycle in Epoch 3 references lesson 026; the CAIRO scaling the red team in Epoch 4 references lessons 081-084.

L4 (Governance Lead) - Days 120-180 operating model. The L4 chapters (Conformity Assessment Function design, Article 17 QMS, RACI codification, three-lines codification, Internal AI Audit build, operating-model decision, function roadmap, talent strategy, AIRA appetite, board AI subcommittee operating, regulator engagement, coalition participation, standards engagement) are the operating-model instruments the CAIRO ratifies in Epochs 5-6. The L4 lessons are the codification artifacts, the CAIRO codifying the operating model in Epoch 5 references lesson 108; the CAIRO ratifying the function roadmap in Epoch 6 references lesson 106.

L5 (Chief AI Risk Officer) - Day 1 + ongoing executive lens. The L5 chapters (CAIRO mandate, AIRA executive appetite plan, function roadmap, talent strategy, operating model, what-changes-next horizon scanning, this 180-day plan) are the executive lens the CAIRO carries on Day 1 and refreshes quarterly thereafter. The L5 lessons are not transition content. They are operating content. The CAIRO who treats lesson 110 (this lesson) as a one-time transition artifact misses the point: the 180-day plan repeats on a multi-year horizon, with each Year-2 and Year-3 CAIRO refresh re-running the six-epoch cadence at progressively higher maturity.

The 110-lesson arc was designed so that any L5 reader could trace any L5 decision back to its L1 vocabulary, its L2 policy pattern, its L3 execution toolkit, and its L4 operating-model anchor. A CAIRO deciding in Epoch 5 to ratify the operating model from lesson 108 can trace the decision through lesson 075 RACI (L4), lesson 073 three-lines (L4), back to lesson 015 AIGC charter (L1), and forward to lesson 106 function roadmap (L5). The arc is integrated by design.

This lesson explicitly closes the 110-lesson program. The skill.re AI Governance, Risk & Red Teaming program was launched as a complete L1-L5 capability build for the AI risk professional emerging in the 2026 regulatory window. It is now complete. The L1 graduate is Risk Aware. The L2 graduate is a Policy Author. The L3 graduate is a Risk Practitioner. The L4 graduate is a Governance Lead. The L5 graduate is a Chief AI Risk Officer. A new CAIRO who completes the program before Day 1 of transition arrives at the badge desk with the full operating doctrine in working memory, and runs the 180 days as practiced execution, not first-time discovery.

Final thought. Regulator-defensible AI is not in tension with commercially-viable AI. Regulator-defensible AI is mission-aligned with the long-term commercial viability of AI in enterprise. A firm that runs AI without governance accumulates Article 99 exposure, Article 73 incident liability, vendor concentration risk, talent-attraction debt, brand-trust erosion, insurance-coverage gaps, and regulator-attention multipliers. A firm that runs AI with governance, with a 180-day-trained CAIRO operating the doctrine of these 110 lessons, accumulates regulator-engagement quality, audit-defensible evidence, talent-attraction premium, insurance-coverage strength, brand-trust signal, and standards-shaping influence. The CAIRO's role is at the intersection where AI delivers value safely. The 180-day plan is the operating bridge from Day 1 standing-start to that intersection. Every lesson in this program was written to make that bridge crossable.

Key Takeaways

• The CAIRO's 180-day transition runs through six named epochs, each with a distinct posture: Days 1-14 Listen + Map (no major decisions); Days 15-45 Diagnose + Prioritize (refresh heat-map + AIRA + FAIR + top-5 risks); Days 46-90 Decide + Execute First Wave (operating-model decision, first 6-slide board brief, first Annex IV TDF refresh, first red team finding closure cycle); Days 91-120 Build + Scale (CAF stood up, red team scaled, IMV documented, ISO 42001 readiness); Days 121-150 Codify + Ratify (Article 17 QMS, RACI, 3LoD, function roadmap ratified); Days 151-180 Externalize + Commit (first regulator engagement, first coalition, first Article 47 declaration signed).
• The 15-item Day-1 readiness checklist is the search committee's responsibility, not the CAIRO's: badge + digital access; mandate ratified; board chair + audit committee chair + AIGC chair + CAIO peer introductions; top-5 inventory items briefed; existing AIRA + heat-map + red team + FRIA pipeline + Article 73 register + ISO 42001 status + vendor concentration reviewed pre-arrival.
• Top-10 questions every CAIRO must answer in writing by Day 30: how many AI systems in production; which are Annex III high-risk; which are agentic; where are we vs Annex III Dec 2 2027; which regulator most likely to inquire first; worst-case scenario; risk appetite posture; insurance coverage; org chart + reporting line; board AI subcommittee information appetite.
• Five anti-patterns to avoid: (1) over-promising in Days 1-30 (cannot deliver); (2) under-promising and loss of executive sponsorship; (3) too-tactical in Days 91-180 (no strategic externalization); (4) ignoring 3L independence (Internal AI Audit reporting line); (5) skipping cultural assessment with engineering (pushback surfaces in Epoch 4).
• Worked example: Acme CAIRO Maya Okafor's 180 days May 16 - November 12 2026, 38 listening conversations in Epoch 1; AIRA v1.1 ratified; top-5 risks named with owners; first Annex IV TDF refreshed; first red team finding closure cycle run end-to-end; first 6-slide board brief delivered; federated-hybrid operating model ratified; CAF + red team + IMV + ISO 42001 readiness stood up; first regulator engagement; first Article 47 declaration signed; FAIR ALE_95 reduced from €11.8M to €9.4M (20% in 180 days).
• L1-L5 program synthesis: L1 is Day-1 working vocabulary (lessons 001-030); L2 is Days 30-60 reusable policy patterns (lessons 031-060); L3 is Days 60-120 execution toolkit (lessons 045 + 053 + 067-072 + 080 + 081-084 + 086); L4 is Days 120-180 operating-model codification (lessons 073 + 075 + 077 + 079 + 093 + 108); L5 is Day-1-plus-ongoing executive lens (lessons 097 + 098 + 100 + 102 + 106 + 107 + 108 + 109 + this lesson 110).
• Aggregate Article 99 exposure reduction: 180-day plan execution materially reduces aggregate exposure 35-50% by end of Year 1 against the FAIR ALE_95 baseline; 48-60% by end of Year 3 through the function roadmap horizon. The 180 days build the operating bridge from standing-start to operating CAIRO.
• Program close: this lesson is the capstone of the 110-lesson skill.re AI Governance, Risk & Red Teaming program. Regulator-defensible AI is mission-aligned with the long-term commercial viability of AI in enterprise. The CAIRO's role is at the intersection where AI delivers value safely. The 180-day plan is the operating bridge. Every lesson in this program was written to make that bridge crossable.