AI governance
In most companies it is already happening: somebody pastes the client list into a chat to get an email drafted, somebody else uploads a supplier contract to get it summarised. Nobody declared it, nobody forbade it, and nobody knows what was uploaded or where it went.
Then one day the question arrives in writing. A large customer, the parent company, an auditor or a bank wants to know what your company does with artificial intelligence and with the data it is trusted with. At that point you need a document, and it cannot be written in an afternoon.
This is that document, built on what your company actually does: which information never leaves, who authorises a new use and within what deadline, and what gets logged. One page your people read, understand and sign.
USD 1,200, two to three weeks. On your side, around eight hours spread across that period.
This is not a technology problem, and it is not fear of the future. It is that there are decisions nobody ever made, and they are being made anyway, one at a time, on each person's desk.
Official usage is zero and actual usage is not. It is in sales drafting proposals, in accounting summarising documents, in HR writing job ads. Because nobody authorised it, nobody set a limit on it either.
A ban with no alternative pushes the use onto personal phones and personal accounts, where the company can see nothing and review nothing. Same usage, less control, no record.
A customer who trusts you with their data, a parent company consolidating, an auditor, a tender that now carries an artificial intelligence clause. Good intentions do not close that point; a written policy does.
It talks about abstract categories and principles. Your staff do not need principles: they need to know whether they can paste this client list into that tool, and who to ask when the answer is not there. A policy that does not answer that governs nothing.
Six pieces, and the first is the one almost nobody does: look at what is already happening before writing any rule at all.
Where artificial intelligence is being used in your company today, including the uses nobody declared. It comes out of the interviews by area, and the questions are framed so people can tell you without feeling they are confessing. Skip this and the policy is written for an imaginary company.
Written to be read by the people who have to follow it: the salesperson, the accounts assistant, the warehouse supervisor. One page, in the language of their trade, that can be handed over and signed. The reasoning goes in a separate document, for whoever asks.
By name, not by category. It does not say "sensitive information": it says which lists, which documents, which fields of which system and whose clients. That is the difference between a rule people can follow and one everybody interprets in their own favour.
A name and a deadline. With no deadline, the approval step becomes the perfect reason to skip it, and you are back where you started with a signed document on top.
What is recorded, where and for how long, so that a year from now you can answer which tool was used for what and with whose information. Proportionate to your size: a log nobody maintains is worse than no log.
So the policy stays alive when I am not around. Whoever wants to use a new tool fills in half a page, and whoever approves has something to decide with. This is what stops the document ageing in the same month it was signed.
A forty-page policy gets approved, filed, and changes nobody's behaviour. The person about to paste a client list into a chat window is not going to open a manual: they will do whatever seems reasonable at that moment. If the rule does not fit in what that person remembers, the rule does not exist.
So the main deliverable is short and written in the language of the people doing the work, not the language of the people auditing it. What does get written out in full is the inventory, the reasoning behind each decision and the approval procedure, because that is what you show when somebody from outside asks.
And there is one more thing a short, well-made policy does: it gives permission. Right now the people who could save two hours with one of these tools either avoid them because they do not know whether they are allowed, or use them quietly. Once it is written down what is allowed, the usage comes into the open and starts getting better, because it can be discussed out loud.
The most important section on the page, because in this field a great deal gets promised that cannot be delivered.
Certification is issued by an accredited body, and whoever writes a management system cannot audit it: anyone offering you both at once is selling smoke. What you get here is a use policy that works from day one, not a certificate and not a route to one.
In Ecuador, where I practise, that comes from a lawyer, and I am not one. Where the matter touches the law, I name it clearly so you can take it to whoever should handle it, rather than burying it inside a technical document.
If your company sells into the European Union or belongs to a European group, there are obligations there of their own that need a specialist lawyer. This policy does not cover them and does not pretend to.
It is addressed where it meets artificial intelligence, which is an important intersection, and the rest is named and referred on. A data protection programme is separate work, with its own scope and its own price.
A guarantee is worth something if it can be claimed. This one rests on a verifiable fact: a question exists in writing, and the answer is either in the document or it is not.
Guarantee of a policy that answers. If you cancel within fourteen days of payment and before receiving the first draft, I return the deposit in full.
And if within ninety days of delivery your company receives a written question from a customer, from its parent company, from an auditor or from a regulator about your use of artificial intelligence or about the data you are trusted with, and the policy as delivered does not contain the answer, I complete it at no cost within the following ten business days.
For it to apply: the question arrives in writing and concerns a use that was inside the agreed inventory. A use the company switched on after delivery and did not declare is a new case, and that is what the intake form is for.
This is currently the area of the market with the most smoke in it. Six questions separate useful work from a document to show people.
An inventory built from the top down comes out short and tidy, and the policy ends up written for a company that does not exist. Ask how many areas get interviewed and with whom, and who guarantees that telling the truth about today's practice will not come back on that person.
"Confidential information" is not an instruction: it is an invitation for everyone to decide for themselves. Ask to see an example of that list from other work, redacted if need be, and check whether someone on your team could follow it without asking.
If the procedure has no named owner and no deadline, the first urgent case will be resolved without asking permission. So will the second.
Nobody who writes your management system can then certify it: that audit belongs to an accredited, independent body. Anyone offering to write it and certify it is offering something they cannot deliver, and that is the clearest signal of all.
An AI use policy touches contracts, personal data and sometimes employment law. Ask which part is signed off by a lawyer. If the supplier tells you they cover everything, be careful: they are selling outside their trade.
A policy written around whichever chat product is fashionable expires the moment your company switches supplier, and that happens every few months. It has to be written around uses and around information, not around brand names.
One deliverable with a date, and a review that is quarterly because the work is quarterly.
The inventory of what is already in use, the one-page policy, the list of what never leaves, the approval procedure with an owner and a deadline, the logging criteria and the intake form for new cases. On your side: four to six interviews of 45 minutes, one per area where it is already used, two hours of senior management time to settle what never leaves, and one hour to review the draft. Around eight hours.
Every three months: the new use cases that came in, what changed at the model providers you rely on, the adjustment to the policy and the updated document with its date on it, ready to show. Optional, and taken up after delivery. USD 1,700 for the year paid in advance.
Launch offer: the first three companies to commission the policy get the first quarterly review at no cost. It is not a discount: the price does not move. The review is charged by the quarter and not by the month because that is what the work actually is: a governance document does not generate work every month, it generates work when a new case comes in, when a provider changes its terms, or when an audit is coming. Charging you monthly for something that happens every three months is a retainer of hours under another name, and I would rather not have that fee than have it unearned.
Prices in United States dollars; under my tax regime, RIMPE Negocio Popular, my services are invoiced with VAT at 0 %, so the figure is the final one. Guarantee of a policy that answers: full refund within fourteen days if you cancel before the first draft, and if within ninety days a written question about an inventoried use arrives that the policy does not answer, I complete it at no cost within ten business days. Conditions in the proposal, in the refund policy and in the confidentiality agreement.
If people are using artificial intelligence tools with information that is not theirs, it already applies, whether you are eight people or two hundred. What changes with size is the number of interviews, not the need.
That is the most common case and it changes nothing: official usage is zero and actual usage almost never is. The inventory exists precisely to see that without turning it into a drama, and then you decide what is allowed.
The opposite. What it does is put in writing what is allowed, which is the decision nobody is taking today. Most of the policies I deliver widen the permitted use, with hard limits on the information that cannot leave.
Yes, because it is written around uses and information, not around brands. The specific tool names live in the inventory, which is the part that gets updated, and not in the body of the policy, which is the part meant to last.
Senior management approves it, because deciding what information never leaves is theirs alone. And every person using the tools signs it, with the handover documented, which is what protects you later if something happens.
No. There is no surveillance of individuals here and no monitoring software. What gets defined is which information may leave, who authorises it and what is recorded, and all of that is done with the staff knowing about it.
The one your people actually work in. I work in Spanish and in English, and the version that matters is the one the warehouse supervisor can read without a translator.
Then this is not enough, and I tell you now rather than after invoicing you. A subsidiary of a European group, a bank supplier or an exporter with an audit coming needs something else, of a different size, and it is better handled by someone with accredited standing in that field. The use policy still helps and stands on its own.
No. This line does not depend on your ERP or on any tool of mine. If you are also considering an assistant over your own documents, having the policy written first saves arguments halfway through that project.
09 /
Tell me which areas are already using it, even informally, and whether there is a question from a customer or an auditor waiting for an answer. I reply with a proposal within one business day.
contacto@andresbrinez.comSix years building systems for companies in three countries: Colombia, Ecuador and Australia · Member of the Odoo Community Association