ChatGPT, Copilot, Gemini, AI note-takers, and AI features that switched themselves on inside software you already pay for. Your staff are using AI today, and most organizations cannot say where, with what data, or who agreed to it.
The question will come from a customer's security review, a regulator or a mistake made in public. It has to be answered with a list and a decision, not a policy written the week before.
AI governance is not one problem. It is five, and a one-page acceptable use policy solves part of one.
1. You do not know what AI is in use. Shadow AI, personal accounts and AI features inside existing tools never reach a list.
2. There are no rules for your data. Nobody has said what may go into a public tool, what needs an approved one, and what must never leave the building.
3. AI vendors are not checked. Nobody has asked whether a vendor trains on your data, how long it keeps it, or which models power the service.
4. Nobody assesses the risk before it goes live. AI is deployed before anyone looks at accuracy, bias, oversight or what happens when it is wrong.
5. Nobody owns it, and nobody can prove oversight. No charter, no committee, no monitoring, no incident process and no evidence that a human is in control.
START HERE, FREE
Thirty-three questions across seven areas and twenty minutes. The AI Governance Quick Assessment reports a maturity level for each area and overall, from Unstructured to Optimized, and your overall level can be at most one above your weakest area, because a strong policy with no inventory is not a working system. It deliberately gives no compliance percentage.
Measures: all five parts.
Solves: none of them, on purpose. It tells you where to start.
AI GOVERNANCE STARTER KIT, $9
Eight practical tools you can put in place in an afternoon.
Solves part 1. A registration form for every new AI use and an inventory that lists what you have.
Solves part 2. An acceptable use quick guide with a data rules table for public tools, approved enterprise tools and internal AI.
Starts part 3. Vendor questions that surface the four things that matter most: training on your data, retention, deletion and which models power the service. Scoring them is in the Toolkit.
Starts part 4. A quick risk assessment that rates each use High, Medium or Low from eight questions, and an approval checklist. A full risk assessment is in the Toolkit.
Still open: part 5. Nothing here establishes ownership or oversight yet.
AI GOVERNANCE MANAGEMENT TOOLKIT, $39 AT LAUNCH
The flagship AI product: an implementation guide written as operating practice, following a 150-person firm from not knowing what AI it used to running governance, and a workbook that calculates a risk tier for every AI system.
Solves parts 1 and 2, with a 33-field inventory that flags shadow AI and regulated data in a public tool, and a full acceptable use policy.
Solves part 3. A scored vendor assessment of 27 AI-specific questions that flags vendors training on your data.
Solves part 4. A risk assessment across 27 risks, from security and privacy to bias and human oversight, an approval workflow that flags deployment before approval, and an AI risk register.
Starts part 5. Incident management, a monitoring log and a 24-figure dashboard. There is no charter, owner or oversight standard yet.
AI GOVERNANCE PROGRAM-IN-A-BOX, $99
All nineteen program components, organized by the NIST AI RMF functions, with a guide that maps each one to its file or workbook tab.
Solves parts 1 to 4, with the full program workbook: inventory, use cases, risk, vendors, approvals, impact assessments, evaluation, incidents, changes and exceptions.
Solves part 5. A charter and policy, an AI Impact Assessment, a Testing and Evaluation Plan across eleven categories from accuracy and bias to hallucination and prompt injection, a Human Oversight Standard by tier and decision type, including AI agents, monitoring, an evidence register, an annual review and a 90-day roadmap.
AI GOVERNANCE MANAGEMENT SYSTEM, $299 AT LAUNCH
For organizations that need to show not just a program, but a system that reviews and corrects itself, the way ISO/IEC 42001 describes.
Solves all five parts, organized by Govern, Map, Measure and Manage, and adds the management-system discipline: AI principles, a committee terms of reference, a decision authority matrix, a configurable RACI, a legal and regulatory register, AI literacy, internal review, management review and corrective action.
Shows what good looks like. A fully populated system for a fictional 160-person firm, with a prohibited tool, a vendor that trains on payroll data and a prompt injection incident, and a framework crosswalk to the NIST AI RMF, ISO/IEC 42001 concepts and the NIST Generative AI Profile.
Built around the NIST AI RMF and informed by ISO/IEC 42001. An implementation aid, not a certification or conformity assessment.
Even a complete management system needs someone to run it: to chair the committee, say no to a tool the business wants, and decide what happens when the AI is wrong. If you want that person, the practice provides senior security leadership on retainer.
Take the free assessment first. If you are Unstructured, start with the Starter Kit. If you are Emerging, go straight to the Toolkit. If leadership wants an owned, written program, choose the Program, and if customers or regulators expect a system that reviews itself, the Management System.
Yes. Right after checkout, each tier offers the next one at a discount that credits what you already paid.
No product can do that on its own. These are built around the NIST AI RMF and informed by ISO/IEC 42001, and they give you the records and decisions those frameworks expect. They do not certify you.
