As early as possible. Keep in mind you don't need to communicate with all app owners all at once from day 1.
It may be better to start small. You don't need to deploy total zero trust in your entire organization all at the same time. Focus first on some small, lower priority apps. Get the app owner onboard, get your security team onboard, deploy VENs, monitor traffic (for 6 weeks), and write and enforce rules. Once you've secured a win with a smaller app you can use that process as a framework for other apps in your organization.