What's in the package
1. Acceptable use policy
Two to four pages in plain English. Covers:
- Approved purposes. What AI can be used for in your business.
- Prohibited uses. Final decisions about people, unreviewed legal or medical advice, impersonation, anything that would mislead a customer.
- Human review. Which outputs always need a person to check before they leave the building.
- Disclosure. When customers or clients should be told AI was involved.
- Accountability. The person who sends the work owns the work, AI-assisted or not.
2. Approved tools list
Which AI tools are allowed, on which plan, for which data. A short table your team can check in ten seconds. Free consumer accounts are usually off the list for any work data.
3. Data classification
Three or four simple categories, with examples from your business:
| Category | Examples | AI rule (typical) |
|---|---|---|
| Public | Website copy, published prices, marketing materials | Any approved tool |
| Internal | SOPs, internal emails, meeting notes | Approved business-plan tools only |
| Confidential | Client files, contracts, financials, employee records | Approved tools with specific settings, named users only |
| Restricted | Health information, Social Security numbers, payment card data, privileged legal material | Only tools covered by the required agreements, or not at all |
The rules in the right-hand column are examples. Yours depend on your industry, your contracts and your tools.
4. Client-data rules
What your client contracts and engagement letters already promise about their data, and what that means for AI use. Some client contracts restrict third-party processing. We flag the ones we find so your attorney can review them.
5. Vendor review checklist
A one-page checklist for any new AI tool: does it train on your data, how long does it keep it, where is it stored, can you delete it, who at the vendor can see it. Used before anyone signs up for something new.
6. Training tie-in
A 45–60 minute session for the whole team on the policy, with real examples from your business. Policies people haven't been trained on don't get followed. This can fold into a broader AI training workshop.
7. Review schedule
AI tools change several times a year. We set a review cadence, usually every six months, and a simple process for adding new tools.
Regulated industries
Some industries have rules that shape what the policy must say. We write to those rules, cite them and leave the legal interpretation to your attorney or compliance advisor.
Healthcare. Under HIPAA, a covered entity must get "satisfactory assurances, in the form of a contract or other written arrangement" before disclosing protected health information to a business associate (HHS). In practice, that means a business associate agreement (BAA) with any AI vendor that handles patient information. If the vendor won't sign one, patient data stays out.
Law firms. The American Bar Association's Formal Opinion 512 (July 29, 2024) addresses lawyers' use of generative AI under the duties of competence, confidentiality, communication and reasonable fees (ABA). Your policy should reflect it, along with any guidance from your state bar.
Accounting, insurance and financial services. Professional standards and client contracts often limit how client data is processed. We document those limits and build the tool list around them.
How it runs
- Discovery (week 1). A short survey of what AI tools people already use, a review of your client contracts' data clauses (with your team) and a conversation about your risk tolerance.
- Draft (week 1–2). Policy, tools list, classification and checklist, written for your business.
- Review. You and your attorney review. We revise.
- Rollout. Team training session and a one-page summary for the break room or intranet.
If you're also rolling out Copilot or Gemini, we align the policy with the permissions and settings in your tenant so the rules and the technical controls match.
What it costs
Most Kansas City policy and governance packages land between $2,000 and $5,000. About two weeks of elapsed time. A single-location business with no regulated data sits at the low end. A healthcare practice or law firm with client-contract review sits at the high end.
Full pricing here.
Frequently asked questions
Can't we just download a template?
You can. A template gets you a starting point. It won't know which tools your team already uses, what your client contracts say or which of your documents are sensitive. The package covers those gaps and the training that gets people to follow it. Many clients start with a template and bring us in when they hit the specifics.
Should we just ban AI?
Bans rarely work. People keep using AI on personal devices and free accounts, where you have no visibility and no control over data. A clear policy with approved business-grade tools moves that usage somewhere you can see and manage. If some data must never touch AI, the policy says so plainly.
Are you giving us legal advice?
No. We're not attorneys. We write the operational policy, the tools list and the controls, and we cite the regulations and professional guidance that apply to your industry. Your attorney or compliance advisor should review the final version. A clear, specific draft makes that review faster and cheaper.
How often should the policy be updated?
Every six months is a reasonable default, plus whenever you add a new AI tool or a vendor changes its data terms. AI vendors update plans and terms often. A fractional AI lead retainer can handle the reviews, or we set up a simple checklist your office manager can run.
What if someone breaks the policy?
The policy defines what happens, in proportion to the harm: retraining for a minor slip, escalation for client data in an unapproved tool. Most violations are honest mistakes from people who didn't know the rule. That's why training is part of the package, and why we write the policy in plain language.
Does this cover what happens to our data inside AI tools?
Yes. The vendor review checklist covers training use, retention, storage location and deletion for each approved tool. It also records which data categories each tool is approved for. We check the current terms during the engagement, since vendors change them.
Get your AI rules in writing
On a free 30-minute call, we'll ask what your team uses today and what data you handle, and tell you what your policy needs to cover.