AI Governance Audit
If nobody can explain what the AI is allowed to do,
you do not have governance yet.
We review how AI is being used, where risk sits, who is accountable, and what controls need to exist before usage scales.
Review our AI governanceHere’s what that means: every AI action in use, with its control and the person who answers for it.
Question from the board
“What is our AI actually allowed to do?”
The problem
Many organizations have one of two problems:
No AI rules at all.
Or a policy document nobody knows how to apply.
Governance only works when it reaches the workflow
- What data can be used
- What systems AI can access
- What requires approval
- What gets logged
- Who owns exceptions
- What employees are allowed to do
What you leave with
Boundaries your
teams can use.
Typical outputs:
- Governance gap assessment
- Risk-ranked use cases
- Control recommendations
- Approval matrix
- Human-review requirements
- Logging / monitoring needs
- Policy updates
- Ownership model
Approval decisions
Unapproved chatbotPaused
Customer data was pasted into a free tool. Use stops until reviewed.
- Support reply draftingApproved, with review
- CRM updatesApproved, with review
Practical, not performative
The goal is not more paperwork.
It is to let useful AI move faster, because the boundaries are clear.
Good governance should make safe work easier, not everything slower.
Could your team explain what your AI is allowed to do today?
Map our AI useUnder the hood
What we review, and the seven questions every important use case has to answer.
What we review
From the tools in use
to who is accountable.
We examine:
- Current AI use
- Approved / unapproved tools
- Data handling
- Access permissions
- Human oversight
- Model / vendor dependencies
- Logging
- Evaluation
- Escalation
- Accountability
Control boundaries
Seven questions
for every use case.
For each important AI use case, we climb the same ladder. Choose one to see how the answers change.
- What can AI see?Tickets and the approved help center. Not billing records.Allowed
- What can it generate?Draft replies, with their sources.Allowed
- What can it change?Nothing. Read-only.Never
- What can it send?Nothing without a person.With approval
- What requires human approval?Every reply, before it goes out.
- What happens when it is uncertain?No draft. The ticket goes to a senior agent.
- Who is accountable?Support lead
- What can AI see?Call notes and records for the rep’s own accounts.Allowed
- What can it generate?Call summaries and proposed field updates.Allowed
- What can it change?Proposes changes. History is never overwritten.With approval
- What can it send?Nothing to customers.Never
- What requires human approval?The rep confirms each update.
- What happens when it is uncertain?Leaves the field empty and flags it.
- Who is accountable?Sales operations lead
- What can AI see?Contracts in the approved repository only.Allowed
- What can it generate?Clause summaries with page references.Allowed
- What can it change?Nothing. Contracts stay untouched.Never
- What can it send?Nothing outside the legal team.Never
- What requires human approval?Counsel reviews before anyone relies on it.
- What happens when it is uncertain?Marks the clause for legal review.
- Who is accountable?General counsel
Your next move
Know what your AI can do, and where it must stop.
Tell us where AI is already in use. We’ll help you see what needs an owner, a control, or a stop.
Tell us what’s slowing you down.
A few lines is enough. We’ll reply by email with what’s worth doing first.