Using AI safely needs operating rules, not a 30-page framework. We set the rules, the tool inventory, and the data-handling lines your team actually needs — written with the people who use AI daily and maintainable without a legal department.
Common pain points
People on your team are already using AI tools, and you don't have visibility into which tools or what data goes into them.
Nobody can answer "what's our policy on AI?" without making something up on the spot.
Sensitive customer or product data is being pasted into ChatGPT or similar without clear rules about what's acceptable.
New AI tools get adopted by whoever finds them first — there's no approval flow and no named owner deciding what's in or out.
The AI policy somebody drafted six months ago is sitting in a Notion doc nobody reads, and reality has moved on.
Leadership wants control over AI use, but doesn't want to add bureaucracy, hire a legal team, or buy a governance platform.
The work delivers four things. The operating rules — which tools can be used, for what, with what data. A tool inventory with named owners. A lightweight approval flow for new tools, and a review cadence when something changes. We write them with the people who already use AI, fit them inside the workflows your team already runs, and leave you with a runbook the team owns. Not legal advice, not enterprise compliance, not a governance platform.
What we deliver
Area 1
We write your AI usage rules with the people who actually use the tools, in language they understand. The rules cover what's allowed, what needs approval, and what's off-limits — per tool and per data class. Output: a usage policy your team can read on one page and edit when reality changes, not a 60-page binder.
Area 2
We inventory every AI tool your team is actually using — including the ones leadership doesn't know about. Each entry captures the tool, the data class it touches, the owner, and the approval status. Output: a current map of your AI surface area, not a list copied from a vendor catalog.
Area 3
We design an approval flow your team can run without legal review for routine cases. Routine asks go to a named operations owner; non-routine asks go to a small review group with explicit criteria. No three-page request forms, no compliance committee. Output: a written decision flow with named owners.
Area 4
We define what data is acceptable in ChatGPT, Claude, Gemini and the other tools your team uses — per data class (public, internal, customer, secret). Rules are concrete and tool-specific, not abstract data classification frameworks. Output: a per-tool data handling sheet your team can apply the same day.
Area 5
We give your team a one-page view of where AI risk sits in the operation — by tool, by data class, by team. No governance platform purchase, no risk taxonomy workshop, no audit trail engineering. Output: a risk map an operations owner can update monthly.
Area 6
We assign explicit ownership for the policy, the inventory, and the approval flow — and set up a monthly review cadence your team runs without us. The review catches new tools, stale rules, and incidents that need a rule change. Output: a named owner per area and a 30-minute monthly review agenda.
Your team knows what AI use is allowed, what needs approval, and what's off-limits — without anyone having to guess.
The AI tool inventory is a real list with named owners, not "let me ask around".
Sensitive customer and product data stays out of the wrong AI tools — by design, not by hope.
New AI tools and use cases get decided by named people, not by whoever moves fastest.
The rules live inside the operation and get updated monthly — not in a forgotten PDF.
You can run AI governance with 30 people and no legal department — and still know what's happening.
No. We don't interpret law, opine on liability, or issue legal opinions. The operating rules we write are internal — they help your team make decisions about how to use AI day to day. If you need legal counsel, for example on contract risk, employment law impact, or specific regulatory interpretation, we'll tell you and recommend you talk to a lawyer.
No. We use the EU AI Act as context for operational awareness — most B2B SaaS use cases fall outside the high-risk classification, but documentation and visibility expectations are rising. We do not certify compliance, implement Act requirements, or provide regulatory readiness as a service. If you need formal EU AI Act compliance work, you need a legal or compliance firm — not us.
A short written AI usage policy your team can read on one page. A populated inventory of the AI tools your team uses, with named owners. A written approval flow for new tools and use cases. A data handling sheet per tool. A one-page risk map. A 30-minute monthly review agenda with a named owner per area. No 60-page binder, no platform purchase.
No. The whole point is that a 10–500 person B2B team can operate this without a legal department. If something specific does require legal review, the approval flow flags it and you route it externally — that's a small fraction of routine decisions.
A governance platform is a tool. This work is the rules and ownership that should exist before any tool helps you. If you eventually buy a platform, you'll need the rules anyway — and most teams under 500 people don't need a platform at all. We're tool-agnostic and we don't sell or resell any platform.
It doesn't include legal advice, compliance certification, EU AI Act implementation, cybersecurity audits, privacy law interpretation, AI model development, or enterprise GRC platform implementation. If you need formal legal, privacy, security, or compliance work, we'll tell you and point you to the right specialist.
Your team uses AI every day with no written rules for what's allowed, what needs approval, and what's off-limits. We write the policy with the people who act…
Read moreKnow what's running, not a governance platformYour team is using AI tools leadership doesn't know about, with no flow for what's approved. We map what's actually in use and set up a lightweight approval…
Read moreBook a call to scope your practical AI governance work. We'll talk through what's running in your team today, where AI is showing up without rules, and what the operating model needs to look like. If what you actually need is legal counsel or formal compliance work, we'll tell you and point you in the right direction.
Book a call