AI governance and policy for organisations already using AI

Why the usual approach fails

A policy that bans AI produces two outcomes and neither is compliance. People stop telling you what they use, and the organisation loses the productivity anyway.

So the work here is not to write a prohibition. It is to make the safe path the easy one, and to know what is in use.

What the work is

Discovery

What is actually in use, by whom, holding what. Done without blame, because the moment it feels like an investigation it stops being accurate.

Policy and standards

Short, readable, and specific about the cases that matter to your organisation. Client information, personal information, code, anything that carries a confidentiality obligation.

The register and the guardrails

A record of approved uses and tools, the assessment that gets a new one added, and the controls that make the approved path the path of least resistance.

Board reporting

Directors are being asked about AI exposure and most cannot answer. This gives them something defensible to say and a way to see it change.

The goal is not to slow the business down. It is that nobody has to guess whether what they are about to do is allowed.

Where it sits with the rest

AI governance is where a lot of organisations first meet ISO 42001 and the AI provisions arriving in their client contracts. Where that is the driver, this work runs alongside the frameworks engagement rather than duplicating it.

Is this the conversation you need to have?

Say what is prompting it and you will get a straight answer, including when the honest answer is that something else comes first.

Every enquiry is read by a senior leader. There is no sales sequence behind this form.

Nothing is resold to you and no vendor introduction is waiting at the other end.

A first conversation is a conversation, not a scoping call with a proposal attached.

Your people are already using it. Governance is how you find out on purpose.