The 90-Day Defensibility Roadmap is the operating cadence for a legal function moving from baseline to a credible Defensibility posture. It is the cadence the Free Baseline Diagnostic recommends to any function below Maturity Band 4. The Roadmap is not a generic implementation plan; it is the disciplined sequence the Advanta engagement model follows when a function commits to the operating standard the Legal AI OS names.
The Roadmap is organised in three thirty-day windows. Each window has named outputs, accountable owners, a measurable gate, and a defined transition to the next window. Compression below ninety days is possible at smaller scale; expansion above ninety days is common at larger scale; the operating principle is that the windows execute in sequence rather than in parallel.
Days 1-30: Diagnose
The Diagnose window establishes the current operating posture against the eight pillars and the Maturity Stack. Outputs at Day 30 include: a current AI Inventory; a populated Risk Register mapped against the Risk Taxonomy 2026; a draft Defensibility Posture Statement that names what is true today (not what is aspirational); a per-pillar maturity score from the Free Baseline Diagnostic; a stakeholder map with named primary contacts; and a documented gap analysis against Band 4 across the four Maturity Lenses.
The owner of the Diagnose window is the AI Governance Lead, with the General Counsel as accountable sponsor. The Day 30 gate is the executive committee briefing that ratifies the diagnosis and authorises the Document window to proceed. Functions that compress Diagnose below thirty days typically produce a Document window that operates against an incomplete picture and surfaces gaps mid-implementation.
Days 31-60: Document
The Document window converts the diagnosis into operating artefacts. Outputs at Day 60 include: a ratified Defensibility Posture Statement signed by the General Counsel; an Evidence Register established and populated for each active AI system; the Five Defensibility Elements documented as currently operated; the AI BoM at first-pass completeness; the prompt and template library at first-pass codification; the four-quadrant ROAI scoring frame applied to the active portfolio; and the autonomy band determinations recorded per use case.
The Document window distributes ownership across the function. The AI Governance Lead owns the Posture Statement and the Evidence Register. Legal Operations owns the AI Inventory, the BoM, and the prompt library. Practice group leads own the ROAI scoring and the autonomy band determinations for their respective portfolios. The Day 60 gate is the governance committee sign-off that the documented posture matches the operating reality. Functions that document an aspirational posture rather than the operating reality fail at the Defend window's twenty-four-hour test.
Days 61-90: Defend
The Defend window operationalises the documented posture. The function runs a controlled twenty-four-hour Defensibility Posture Statement exercise: a simulated regulator, insurer, or acquirer request that the function must respond to within twenty-four hours using the Evidence Register, the Posture Statement, and the named accountable owners. The exercise surfaces every gap between documented intent and operating reality. Gaps are remediated within the Defend window.
Outputs at Day 90 include: a passed simulation of the twenty-four-hour test; a refined Posture Statement and Evidence Register reflecting Defend window remediations; a documented operating cadence for the Governance Lead, Legal Operations, and practice group leads; a defined refresh schedule per active AI system; the Continuous Learning log in active operation; and a board-ready report on the function's Defensibility posture suitable for the next board cycle.
The Day 90 gate is the readiness assessment for Executive Diagnostic attestation. Functions that pass the Day 90 gate may schedule the Executive Diagnostic; functions that pass partially complete the remaining remediations under a defined extension before scheduling. The Executive Diagnostic itself is not part of the 90-Day Roadmap; it is the certification instrument the Roadmap prepares the function to be eligible for.
What the Roadmap is not
The Roadmap is not a tooling acquisition plan. It assumes the function has tooling in place sufficient to be at least Foundational; if it does not, a pre-Roadmap procurement and deployment phase is sequenced first. It is not a Pillar 2 estate cleanup; estate work continues after the Roadmap and is typically a 6-12 month investment that runs in parallel. It is not a training programme; Pillar 3 talent investment runs across years and informs the Roadmap rather than being subsumed by it. The Roadmap is specifically about producing the institutional artefacts and operating cadences that satisfy Defensibility, given the function's existing footing on the other seven pillars.
Where the Roadmap sits in the framework
The Roadmap operationalises the move from Band 3 (Integrated) toward Band 5 (Defensible) for functions that have already cleared Bands 1 and 2 (Foundational and Operational). Functions at Band 1 require a pre-Roadmap stabilisation phase. The Roadmap touches every pillar but lands its evidence most visibly at Pillar 4 (Governance, the Defensibility Posture Statement and Evidence Register) and Pillar 7 (Maturity, the diagnostic scoring and Index benchmarking). It is the operating cadence the Advanta diagnostic and advisory engagements follow.