AI Policy Framework
A plain-language policy suite covering acceptable use, data handling, vendor evaluation and employee guidelines. Built to satisfy leadership, legal and auditors while staying usable for the people who follow it every day.
AI policy and governance
AI policy and governance for small and mid-sized businesses
Your team is already using AI. Now it needs rules everyone understands.
We write a plain-language AI acceptable use policy, set the data guardrails, and build oversight sized for a small or mid-sized business. Your team knows what is allowed, your data stays protected, and your board and counsel can stand behind it.
The problem
Shadow AI is already in your building
Shadow AI (employees using AI tools without approval) means quotes, customer emails and spreadsheets going into tools nobody vetted. Most of our audits uncover unapproved tools handling company data on day one.
Banning AI doesn’t work; people use it anyway, just out of sight. A clear policy does. It tells your team which tools are approved, what data never goes in, and who to ask.
What’s included
Policy, guardrails and oversight in one package
AI Governance
Oversight that keeps AI use accountable, transparent and aligned with your values: governance committees, review processes and risk controls sized to your organization.
Guardrails we put in place
- Data privacy
- Security
- Vendor review
- Human oversight
- Acceptable use
- Bias testing
- Accountability
Our approach
Guardrails before tools
Guardrails go in place before an AI tool touches real work, so everyone knows how it will be evaluated, approved, monitored and used.
That prevents rushed decisions, reduces legal and operational risk, protects sensitive information, and makes AI consistent with your goals. It is the ounce of prevention. When something has already gone wrong, we bring the pound of cure.
In practice
Governance that held up
Living governance for a security-sensitive packaging business
Controls were almost nonexistent despite sensitive products. Leadership now has governance and protections matched to the sensitivity of what they make.
From gridlock to a defensible AI toolkit
Procurement standards, documented risk assessments and active controls on every adopted tool, managed by Janis Consulting.
FAQ
AI policy questions
Our employees already use ChatGPT. Is that a problem?
Only if no one knows what data goes into it. A Shadow AI survey shows which tools are in use and what is at risk, and a clear acceptable use policy is usually the first fix.
What goes in an AI acceptable use policy?
Which AI tools are approved, what data never goes into them, how new tools get reviewed, when a person must check AI output, and who employees ask when they are unsure. Plain language, short enough to read.
Is ChatGPT safe for company data?
It depends on the account type, its settings and what your team pastes in. Your policy should name the approved tools and accounts, and spell out which customer, pricing and personnel data stays out.
Who should own AI governance in a small business?
One accountable leader. Without an owner, policies go stale and exceptions pile up. That is the role of a Fractional Chief AI Officer.
From Insights
Further reading on AI policy and risk
Open Weight models: Who should decide what we can use
Fear drives a lot of AI policy. Joshua Janis looks at open-weight AI models and asks who should decide which AI tools the public is allowed to use.
Agentic Hacking
AI models escaped a sandboxed test, reached the internet, and breached Hugging Face to cheat an evaluation. What it means and how governance can help.
The Fable 5 saga explained for the layman
The Fable 5 model release and the US government's shutdown of it, explained in plain language, and why it is a pivotal AI governance story.
Find out what AI your team is already using
Start with the free Shadow AI Checklist, or go straight to the audit for the full picture.