AI Governance & Guardrails

Rules that hold up in an audit: what the AI may see, what it may do, and what it must never touch.

Get a Free Quote

Talk to a Specialist

PolicyAcceptable use written for real workflows

AccessWhat may reach a model, and what may not

EvidenceLogging and audit trails that stand up

How the engagement runs

From first call to steady state

01
Review
How staff actually use AI today, including the tools nobody told you about.
Shadow usage is common and worth finding before an incident does.
02
Classification
Data mapped by sensitivity, and what may reach which model.
This determines which tools are usable at all.
03
Policy
Acceptable use written against real workflows, in language staff can follow.
Vague policy gets ignored; specific policy can be enforced.
04
Controls and evidence
Access control, logging, and injection defences configured in the tools.
Then periodic review, because models and rules both change.

What’s included

Scope, spelled out

Acceptable-use policy written for how staff actually work
Data classification and what may reach a model
Access control, logging and audit trails
Prompt-injection and data-leak defences
Model and vendor risk review
Staff guidance and periodic policy review

Policy staff can actually follow

A policy copied from a template is ignored within a month. We write acceptable-use rules against how your team genuinely works, so the guidance is specific enough to follow and enforceable when it matters.

Acceptable-use policy written for how staff actually work
Data classification and what may reach a model
Staff guidance and periodic policy review

Signs you need this

This is usually when we get the call

You cannot list which AI tools staff are using
Client contracts mention confidentiality but not model providers
There is no record of what was sent to an external AI service
Nobody can answer what happens if a model produces a wrong answer

Guardrails in the system, not just on paper

Rules that depend on everyone remembering them are not controls. Access control, logging and defences against prompt injection and data leakage are configured in the tools themselves, so the guardrail holds whether or not anyone read the document.

Access control, logging and audit trails
Prompt-injection and data-leak defences
Model and vendor risk review

What we need from you

Before the first call

Honest disclosure of which AI tools staff already use
Your client confidentiality and regulatory obligations
A view of data classification, even if informal
An owner for the policy once it is written

Most delays in any engagement trace back to access, decisions, or content. Naming these up front is what keeps a project on schedule.

Questions we get asked

Straight answers

Staff are already using AI tools. Is that a problem?

It is common, and worth finding out before an incident forces the question. The practical response is a policy people can follow plus controls in the tools, not a blanket ban that pushes usage further underground.

Do we need a policy if we are not in a regulated industry?

Client confidentiality obligations usually apply regardless of your industry. If your contracts promise to protect client information, that promise extends to whatever tools your staff paste it into. That is the argument that tends to land.

What is the actual risk being managed?

Mainly three: sensitive data reaching a service you have not assessed, model output being treated as fact, and no record of either. Controls and logging address all three; a policy document alone addresses none.

How often does this need revisiting?

Models, tools, and staff habits all change. An annual review keeps it current, and a review after any significant tool change. A policy written once and filed away stops reflecting reality within a year.

Where to go next