AI Security & Governance

AI is already inside your business; how much of it can you see?

AI didn't arrive as a project with a budget and a sponsor. It arrived through employees signing up for ChatGPT, Claude, and Gemini on their own, through Microsoft Copilot switched on across your email and files, through vendors adding AI features to software you already pay for, and through agents that can now act on your systems. Most leadership teams can't say where AI is in use, what data it touches, which providers hold that data, or who answers for what it does.

Where It's Already Showing Up

Your people are using it, often on personal accounts.

The same AI tool can behave very differently depending on the plan. Consumer accounts may retain what employees type and, depending on settings, use it to train future models. Enterprise agreements typically don't. Most companies don't know which version their people are using.

Your providers decide what happens to your data.

OpenAI, Anthropic, Google, and Microsoft each have their own terms for data retention, training use, where data is processed, and what administrators can control. Those terms change, and few companies have read them.

Your vendors turned it on.

CRM, HR, finance, and support platforms now ship AI features enabled by default, reading the same data you trusted the vendor to protect. The contract you signed rarely anticipated it.

It can act, not just answer.

AI agents can read email, move files, and take actions in business systems. An assistant like Copilot can surface anything a user has access to, which exposes every permission that was too broad to begin with.

Others are starting to ask.

Customers send AI questionnaires with their security reviews. Insurers ask about AI on renewal applications. Boards ask whether the company is exposed.

Something else is unsettled.

If AI has come up in a board meeting and nobody could say who owns it, that's reason enough to talk.

The Rules Are Still Being Written

Nobody has this fully figured out, including the regulators.

Texas's Responsible AI Governance Act took effect in January 2026. Colorado rewrote its AI law this year, and the new version takes effect in January 2027. California now requires disclosures from the developers of the most capable models. The EU AI Act is phasing in for companies with European customers or operations. New York City requires bias audits for AI used in hiring. Meanwhile, the federal government is pushing to override state AI laws, and that fight is unresolved and likely to take years.

Waiting for the law to settle isn't a plan. The better course is a program built on recognized frameworks that holds up however the law lands, and that can be adjusted as specific obligations come into force where you operate.

The question isn't whether to use AI. It's whether anyone is in charge of how it's used.

How We Govern AI

We don't sell AI tools, and we don't start by banning them.

We start with what's actually happening, then build governance on frameworks your customers, auditors, and regulators already recognize.

Find it.

We build an inventory of AI in use across the business: approved tools, personal accounts, AI features inside vendor platforms, and agents with access to your systems. We draw on sign-in records, expense reports, network activity, vendor reviews, and conversations with the people doing the work.

Look hard at the providers.

For each AI provider and vendor that touches your data, we review the actual terms: what's retained, whether it's used for training, where it's processed, and what controls you have. Where a consumer account is in use, we determine whether an enterprise agreement closes the gap.

Set rules people can follow.

Leadership decides what's acceptable. We turn that into an AI use policy, an approved tool list, clear data boundaries, and permission standards for agents, including where a human must approve before AI acts.

Anchor it to recognized frameworks.

The NIST AI Risk Management Framework is the backbone. ISO/IEC 42001 applies where you need a certifiable management system. The OWASP Top 10 for LLM Applications and MITRE ATLAS cover the technical threats specific to AI, such as prompt injection and data leakage.

Map your obligations.

We identify which laws and contract terms apply based on where you operate and how you use AI, with particular attention to hiring, lending, insurance, healthcare, and anything else that affects people's lives.

Give every decision an owner.

AI risks go into a register with named owners. Risks the business accepts are accepted on purpose, by the executives accountable for them, and recorded.

Keep it current.

Vendors ship new AI features constantly, and the law keeps moving. We review on a set cadence, report to leadership, and keep your answers ready for customers, insurers, and auditors.

What Changes for Leadership

Your people stop guessing and start using AI the way the business intended.

The risks that come with it are ones leadership chose, not ones it discovered later.

And when a customer, an insurer, or your board asks how you govern AI, you have an answer you can stand behind.