AI Governance Starter
A practical starting point for organizations adopting Copilot, public AI tools, private assistants or automated agents.
List current AI use
Ask what employees already use before writing policy. Shadow AI often exists before leadership begins a formal program.
Classify sensitive data
Decide what information should never be entered into unapproved tools and what data may be used only in approved enterprise platforms.
Choose approved tools
Define which accounts, vendors or AI platforms are approved and who owns licensing and administration.
Review permissions
AI tools can expose existing oversharing. Review SharePoint, OneDrive, application and data permissions before broad deployment.
Define human approval
Identify actions or outputs that require a person to review before sending, publishing, changing systems or affecting customers.
Document and monitor
Keep the use case, data sources, integrations, limitations and owners clear enough that the workflow can be audited or paused.
Use the guide as a conversation starter
The goal is not to make every reader a specialist. It is to make the next technical conversation more informed.
Need help applying this to your environment?
We can review the current state with you and turn the relevant findings into a practical plan.