Rules for AI use, in place before you need them
Governance and compliance readiness for companies adopting AI: an inventory of the AI tools in use and where their data flows, a written usage policy with approval paths, and logs, evidence and vendor files archived as one set. When a client, an auditor or a regulator asks, you produce documents — not apologies and a scramble.
Who it fits, and what gets in the way
Companies already using or now adopting AI, whose clients have started asking how data is handled — and whose own answers are not yet written down.
Staff use a dozen AI tools between them; the company cannot even list them, let alone say where the data goes
A large client’s vendor questionnaire arrives with the AI section blank, and the deal stalls on compliance
Everyone agrees rules are needed; policy, process and evidence are three separate piles and nobody knows which to start
What you get
| Component | What is included | Deliverable |
|---|---|---|
| AI asset inventory | Tools, accounts and data flows itemized, including staff-brought tools | An AI asset register |
| Policy & process | Usage policy, data tiers, tool approval path — written as formal documents | A policy pack, issued by you |
| Logs & evidence | Logging standards and an evidence index established, archived monthly | An evidence set, retrievable on audit |
| Vendor files | Terms and data-processing documents for tools in use, filed for reference | A vendor folder set |
| Monthly management | New-tool approvals, policy updates and archive upkeep on a monthly rhythm | A monthly management log |
How it runs
Inventory interviews
One to two weeks: tools, data and current state mapped into a register and a gap list
Rules written
Policy and process drafted, through your internal review, issued
Evidence set built
Logging standards and evidence index live; history back-filed
Monthly operation
Approvals, updates and archiving monthly; a readiness summary each quarter
Boundaries
Not included
- We are not your lawyers or auditors: legal opinions and formal audits belong to licensed firms; we build the governance and the material
- No promised certification outcomes: what is promised is complete material, consistent positions, retrievable on demand
- We never issue policy in your name: policy is issued by you; we draft and maintain
What we need from you
- Interview access across departments on current tool use
- One executive who can settle policy positions
- Contracts and terms for tools in use, as available
How engagement and quoting work
Inventory and gap list first, priced on its own; the managed service runs monthly, confirmed by a person after discovery and written down. All material is your property and handed back in full at the end; the quarterly readiness summary keeps your current standing visible.
Questions on this page
We barely use AI yet. Too early?
Rollout is the cheapest moment: the inventory is small and rules precede habits. Companies already deep in use start with the same inventory, as catch-up.
Can you help answer client questionnaires?
Yes, from the evidence set, item by item, so answers and material agree. Final submission is yours to approve.
How does this relate to our legal counsel?
Counsel advises; we implement: registers, policy text, evidence archiving and monthly upkeep. The two halves meet in the middle.
Are new tools covered as they appear?
Approval review is part of the monthly service: new tools pass a data and terms review before use, with the verdict on file.
How do we start?
Describe your current AI use in a few sentences on the contact page. We book the inventory and return a gap list before any talk of the managed service.
Related
Government AI Governance
The public-sector version: use-case registers and filing discipline
Rules for AI use, in place before you need them
Tell us where it hurts first. Scoping and a written quote come before anything starts; looking costs nothing.
Or ask Leo, the assistant at the bottom right, first — get the questions clear before you write to us.
