Staff already pasting client data into consumer chat tools
The behavior is happening whether or not there is a policy. Governance names an approved tool, blocks the rest, and explains why in a paragraph rather than a memo.
AI Governance
Governance here means writing down what people may and may not put into these tools, where the data goes, and who is accountable when an answer is wrong. It is a short document that staff read, not a framework with five maturity stages and a curve.
The work is mostly about specifics. A policy that says to use AI responsibly changes nobody's behavior. A policy that says which client documents may be pasted into which tool, and names the approved alternative for the rest, does.
This is not a certification and we do not sell it as one. Gray Sand holds no ISO 42001 audit and offers no legal opinion. What you get is the policy, the data handling rules, the review process, and the technical guardrails that back them up.
// what you get
What's included.
- An acceptable use policy written in language your staff will read
- Data handling rules: what may be sent to which tool, and what may not
- Technical guardrails that enforce the rules rather than relying on memory
- A review process for approving new tools, with a named owner
- Vendor and model due diligence on what you already use
- Incident handling for the day a wrong answer reaches a customer
// where it fits
The situations this is usually bought for.
A regulated client asking what your AI policy is
A procurement questionnaire arrives with eleven questions about AI use. Having real answers written down is the difference between winning the contract and stalling.
Nobody owns the decision to approve a new tool
Tools get adopted by whoever found them. A short approval path with a named owner stops the sprawl without stopping the useful ones.
// built
Where this shows up in our own work.
Medtech websiteelasticcare.com
Elastic Care
A site for a regulated cardiac monitoring company. Every product claim is checked against the rules at save time, and nothing publishes without regulatory sign-off, so marketing can move without putting a clearance at risk.
In build. Not public yet.
// usually bought with
- AI Readiness and RoadmapFind out which parts of your operation AI pays for, and in what order to build them.
- AI Adoption and Change ManagementLicenses are not usage. Change the work, and the tools get used.
- AI IntegrationConnect AI to the systems you already run, so answers come from your own records.
// say hello
Tell us what you are trying to fix.
Discovery calls are free and usually last 30 minutes. We listen first, and we will tell you honestly if ai governance is the wrong thing to spend money on.