AI Governance Guide: Usage Policy, Access, and First Rollout

What AI governance is for in a real company

AI governance is the written answer to four questions: what staff may paste into a model, which tools are approved, who may use them, and how the first workflow is allowed to go live. It is not a poster about principles. It is not a 90-page register that nobody opens. If your team already uses ChatGPT on personal accounts, you already have a program. It is just unofficial.

I write governance as an implementer. The policy has to survive a Tuesday afternoon, a security review, and a later automation build. This guide is the reference version of that work. The hire page is AI governance consulting. Contact is the workflow review form, not an email address.

Start with data classes, not a vibe

A useful policy names classes of data and a default for each class. Public marketing copy is usually allowed in an approved workspace. Internal ops notes may be allowed after a review. Customer identifiers, health information, and payment data need tighter rules, often redaction or a ban. Staff can follow a short table. They cannot follow "be careful."

Keep the table short. If every row needs a lawyer to interpret, people will use a personal phone on a busy Thursday. The job of the policy is to be followed, not to sound complete.

Access is a list of tools, people, and logs

Who may use a consumer chat app, who may use an API, and who may connect a plugin to the shared drive are three different risks. Write them down. Logs should answer who exported last week's tickets into a model. If you cannot answer that, you do not have control yet.

Credentials stay in your identity provider or a secrets store you own. Shared "team" passwords in a chat thread are out of policy, including any consultant's. Approved tools get a one-line job: drafting, classification, retrieval, or phone coverage. Tools without a job wait.

The first rollout is a workflow, not a town hall

A company-wide "we are now an AI company" email creates demand you cannot support. The first rollout is one job: a drafted reply, a classified ticket, or a redacted summary. It has a reviewer, a retention rule, and a person who can turn it off. After thirty days, ask whether people followed the policy and whether the workflow earned the next one.

A freeze with no approved path just hides the use. A blast with no reviewer creates incidents. The useful middle is one approved path plus an exception request.

What I do not put in the document

I do not invent residual-risk scores, maturity levels, or certification claims. I do not name client businesses. I do not publish an email address. Vendor list prices change, so this guide does not pretend they are stable. Engagement pricing on this site is only the consulting ranges already published on the homepage: typical project builds run $2,500 to $15,000.

If you need a formal attestation letter, that is a different hire. This guide is for owners who need rules the staff will actually use, then a first workflow that can pass a security review.

A one-meeting training outline

Policy that cannot be taught in one meeting will not be followed. I use a short agenda: the five data classes, the approved tool list, two examples of a bad paste, one example of an allowed draft, and how to request an exception. People leave knowing what to do on Thursday, not what a framework is called.

Record the session only if your counsel agrees. The artifact that matters is the dated policy and the attendance list, not a long video nobody rewatches. New hires get the same one-pager in onboarding. If the one-pager has grown past three pages, it has started to fail its job.

Retention, logs, and shutoff

Prompts and outputs are records. Decide how long they live, who can read them, and whether a customer can ask for them. Infinite chat history in a consumer app is usually the wrong default. An approved workspace with a retention window is easier to defend.

Every approved workflow needs a shutoff owner: one person who can disable the connection without a committee. If that person is on leave, name a deputy. Governance that cannot be turned off in an hour is not control. It is hope.

Logs should be boring. Who used which tool, on which class of data, and whether a human approved the write. You do not need a science project. You need to answer a buyer or an incident without reconstructing a week of Slack.

When a freeze is the right first move

If staff are pasting regulated records into a consumer app today, a short freeze on that class is reasonable while the policy is written. A freeze on every tool, including approved drafting of public copy, is how unofficial use moves to personal phones. Scope the freeze to the class that can actually hurt someone.

Tell people what they may do instead, and when the freeze lifts. A freeze with no date and no approved path is a culture problem waiting for the next busy week.

How this pairs with a later build

Once the policy and access list exist, an AI automation consultant engagement can ship a labor sink without restarting the argument about whether AI is allowed. A business process automation engagement can redesign a spine under the same data classes. A fractional CTO seat can keep vendor and hiring decisions aligned with the allow-list.

Work is nationwide across the US, remotely or in person. Orlando, Jacksonville, and Tampa have dedicated city pages when the first working session should be in the room.