How to run AI assessments properly — scope, classification, control review, three-team operating model, vendor diligence and documentation that supports decisions, not paperwork.