AI governance: AI usage rules for staff, a system register and clear owners
We write clear rules your staff actually read: what can go into ChatGPT, which tools are approved and who signs off new ones. Plus an AI system register with an owner for each system.
What hurts
Your staff already use ChatGPT and other services. Someone pastes contracts, customer lists or financial reports into them, and you do not know.
Banning everything does not work: people just use personal phones. Allowing it without rules is risky because nobody knows who is responsible for the consequences.
A partner, bank or auditor asks to see your AI usage policy. All you have is an email from the CEO two years ago.
What we build
- A survey of departments: which AI tools are already in use and why
- Data classification: what is allowed, what is not, and what only in corporate tools
- An AI usage policy for staff in plain language
- An AI system register with owner, data and risk level
- An approval process for new AI tools
- Roles and responsibilities: who owns, who reviews, who decides
- A document structure aligned with ISO/IEC 42001
- Staff training and a short comprehension quiz
What you get
- An AI usage policy agreed with your legal and HR teams
- A completed AI system register
- A request template and approval process for new tools
- A roles and responsibilities matrix
- Training materials and a recording for staff
How we measure the result
- Share of employees who completed training and the quiz
- Number of AI tools in the register with an owner
- Time to approve a new tool
- Number of policy breaches found and resolved
Systems and stack
Industries
Questions
How much does AI governance work cost?
From $5,000 over 4–6 weeks. The price depends on company size, the number of departments and whether you need an ISO/IEC 42001 structure. A smaller company often needs only a policy, a register and one training session.
Will you certify us against ISO/IEC 42001?
No. Only an accredited certification body can issue a certificate after its own audit. We prepare documents and processes in the structure of the standard so you have something to take to the auditor. We went through ISO 27001 certification ourselves and know what that preparation looks like.
Will this be another document nobody reads?
That is why we keep it short with examples from your work: pasting an email draft is fine, pasting the customer database is not. We add training and a quiz. It works best when an approved corporate tool arrives together with the rules.
What do you need from us?
One owner on your side, short interviews with department heads, and your existing security and data protection policies. Your legal team, DPO and HR sign off the final version.
How does this relate to the EU AI Act?
An AI system register and clear roles are the first step of EU AI Act readiness. If you operate in the EU, we build the register so it can be extended to the regulation requirements later.
What happens after launch?
The register and policy must stay alive. They should be reviewed each quarter along with new tools. We can do that under an SLA or train your owner to do it.
Related services
More in this section
Describe the task. We reply within one business day, the first call is with the founder.
Describe the task. The first call is with the founder.
We reply within one business day. 30 minutes to tell you whether it is worth doing and what it costs.