AI Governance and Risk
AI policy development and acceptable use
An enforceable enterprise AI use policy, plus the shadow-AI inventory that tells you what is already running
- Duration
- 3 to 5 weeks
- Ladder stage
- Pre-Proof
- NATIVE stages
- Notice, Assess
The situation
When this engagement is the right one
A policy written without an inventory forbids things nobody does and permits things already causing risk. We inventory first. Then we write a policy people can actually follow, with a sanctioned route for the work that drove them to the unsanctioned tool.
You are probably seeing
- Your policy is a one-page prohibition and usage has not fallen.
- Legal wrote the policy and no operational owner has read it since.
- Nobody knows which data has already left the boundary.
What we do
The work, in the order it happens
- 01Run a no-blame shadow-AI inventory across functions.
- 02Classify usage by data sensitivity and business necessity.
- 03Write the acceptable-use policy in operational language, with examples per function.
- 04Define the sanctioned alternative for each high-value unsanctioned use.
- 05Set the exception process, because a policy with no exception path is bypassed rather than followed.
What you get, and keep
- A shadow-AI inventory by function and data class.
- An acceptable-use policy with worked examples.
- A sanctioned-tooling map.
- An exception request and approval process.
Prerequisites
- A commitment that the inventory carries no disciplinary consequence. Without it, the inventory is fiction.
Not included
- Legal review and sign-off remain with your counsel.
Where this sits in the method
Commercially this is a Pre-Proof engagement on the Proof, Product, Platform ladder.
FAQ
Questions we get asked
- Will people tell the truth in the inventory?
- Only if you say in advance that disclosure is safe, in writing, from the CEO. We will ask you to do that.
- How long should a policy be?
- Short enough to be read. The detail belongs in the workflow standard, not the policy.
Related engagements
Work that usually sits either side of this
AI Governance and Risk
AI Governance Framework
A standing governance discipline with approval, override, and escalation named per workflow, not per company
AI Governance and Risk
AI Vendor Due Diligence
Contract, portability, and exit-cost review, with specific attention to fine-tuning data portability and lock-in
Next step
Ready to scope ai policy and acceptable use?
Bring the pilots you already have running. The first call is a scoping conversation, not a pitch.