Share of AI use on approved tools
Shows whether shadow AI is shrinking. Track it through license usage and repeat surveys.
Protect margin
AI usage policy and governance your team will actually follow
Your staff are almost certainly using AI already. Someone pastes a client email into a free chatbot to tidy the reply. Someone else uses a browser extension to summarize meeting notes. None of it is malicious, but nobody knows what client data has left the building, which tools are approved or who checks the output before it reaches a customer.
Signs you need this
- You do not know which AI tools your staff use or what they paste into them.
- People are paying for personal AI subscriptions and expensing them.
- Clients or insurers have started asking about your AI practices.
- There is no rule about who reviews AI-drafted work before it goes out.
- You use AI anywhere near hiring, lending, insurance, housing or health decisions.
AI governance for a service business does not need a committee or a thick binder. It needs a short policy people can read in five minutes, a list of approved tools with the right settings, a clear rule about what data never goes into AI, and a named person who answers questions. Done well, it makes staff more confident using AI, not less.
How it works
Find out what is in use
Run a short, no-blame survey and review software spend, browser extensions and sign-ins through Microsoft 365 or Google Workspace. The goal is an honest inventory of tools and uses, not catching people out.
Choose approved tools and settings
Pick a small set of business-grade tools, such as Microsoft 365 Copilot, ChatGPT Business or Claude Team, and configure them so business data is not used for model training where those options exist. Turn off or block tools you will not support.
Write a one-page policy
Cover approved tools, data that must never be entered, required human review for anything client-facing, disclosure to clients where appropriate, and who to ask. Plain language beats legal language here.
Train and make it easy
Run a short session with real examples from your own work. Provide approved prompts and templates so the safe path is also the easiest one.
Review on a schedule
Each quarter, the owner of the policy reviews new tools, incidents, client requests and legal changes. Update the tool list and policy, and record what changed and why.
Ways to do it
| Approach | Best fit | Notes |
|---|---|---|
| Settings in tools you already own | Firms on Microsoft 365 or Google Workspace with admin access. | Admin centers can control which AI features are on, who can use them and what data they can reach. Configuring these well is often the most important governance step. |
| Policy template plus training | Small firms that need clear rules quickly. | A one-page policy adapted to your work, plus a one-hour team session, covers most of the risk for a firm under 50 people. Have counsel review it if you work in a regulated field. |
| Fractional governance lead | Firms in law, accounting, health, finance or insurance, or those using AI in consequential decisions. | Someone accountable for tool approval, vendor review, incident handling and keeping up with rules such as Colorado's automated decision-making law and professional guidance. |
| Dedicated AI governance software | Larger organizations with many AI systems and formal audit needs. | Usually more than a 5-150 person service business needs. Consider it only if clients or regulators require formal documentation of many AI systems. |
How we deliver this: AI automation for small business or fractional CTO leadership, scoped in writing and run over 90 days. See pricing or the sample scope.
What we would measure
Staff who completed training
A policy nobody has read protects no one. Aim for everyone who touches client work.
AI-related incidents and near misses
Wrong client data entered, unreviewed output sent. Counting them, without blame, shows where rules need work.
Time to answer a client or insurer AI questionnaire
A clear policy and tool list should turn a stressful request into a short, confident reply.
Risks and how we handle them
| Risk | Mitigation |
|---|---|
| A policy so strict that staff ignore it. | Approve useful tools rather than banning AI, explain the reasons behind each rule and make approved tools easy to reach. |
| Client or regulated data entered into consumer AI tools. | Name the data types that are off-limits, block unapproved tools where practical, and cite the rules that apply, such as HIPAA, ABA Formal Opinion 512, IRS Publication 4557 or the FTC Safeguards Rule. |
| Missing new legal obligations. | Colorado's SB 26-189 replaced SB 24-205 and takes effect January 1, 2027, with Attorney General rules in progress. If AI influences decisions about employment, housing, insurance, lending or health care, get legal advice on what applies to you. |
When not to do this
There is no business that should skip having basic AI rules, but you can skip the heavy version. If you are a small firm with no regulated data and no AI in hiring or customer eligibility decisions, a one-page policy, sensible tool settings and a short training session are enough. Do not buy governance software or form a committee until the size of your AI use justifies it.
Common questions
Do we need an AI policy if we are a small business?
Yes, but a short one. Staff are already using AI, and without rules each person makes their own decisions about client data. A one-page policy with approved tools, off-limits data and a review rule takes little time to write and removes most of the guesswork.
What does the Colorado AI law mean for us?
Colorado's SB 26-189 was signed in May 2026 and takes effect January 1, 2027, replacing the earlier SB 24-205. It focuses on automated decision-making technology used in consequential decisions, such as employment, housing, insurance, lending and health care. The Attorney General is finishing rules. If that describes your use of AI, speak with a lawyer about your obligations.
Is ChatGPT safe for confidential client information?
It depends on the plan and settings, not the brand. Business and enterprise plans of the major AI tools offer controls over data use and retention that consumer accounts may not. Check the current terms for the specific plan, configure it properly and still follow your professional duties of confidentiality.
Should we tell clients we use AI?
Many firms do, and some professions expect it. A simple statement that you use approved AI tools for drafting and analysis, with people reviewing all client work, is often enough. Lawyers should review ABA Formal Opinion 512 and their state rules on client communication and consent.
Who should own AI governance?
One named person, usually the operations lead, a partner or a fractional technology lead, with authority to approve tools and update the policy. Committees slow things down in a small firm. That person should report to leadership quarterly on tools, incidents and changes.
By industry
AI usage policy and governance for your industry
Accounting and CPA firms
Write a practical AI policy for your firm covering approved tools, taxpayer data, Pub 4557 and Safeguards Rule duties, and review standards.
See the details →Architecture firms
Practical AI rules for architecture firms: renderings, specs, client data and professional liability, written so staff will follow them.
See the details →Financial advisory firms
A practical AI policy your CCO can stand behind: approved tools, client data rules, recordkeeping, supervision and training.
See the details →Law firms
Write a practical AI use policy for your firm covering approved tools, confidentiality, supervision and billing in line with ABA Opinion 512.
See the details →Medical and specialty clinics
Set clear, HIPAA-aware rules for ambient scribes, chatbots and AI drafting in your clinic, with vendor checks and training.
See the details →Nonprofit organizations
Write a practical nonprofit AI policy: approved tools, what donor and client data stays out, and how drafts are reviewed. Talk with InTheory.
See the details →Tax preparation offices
Write a practical AI use policy for your tax office that fits your WISP, Pub 4557 and Section 7216, so staff know which tools are allowed.
See the details →Guides
Questions to ask a fractional CTOAI consultant red flagsGetting staff to adopt new toolsMicrosoft Copilot for small businessCybersecurity basics to fix before adopting AIA SaaS audit checklist for service businesses
Questions
What does an AI consultant do?How do I use AI in my business?How do you train employees on AI?Is ChatGPT safe for confidential information?What is shadow AI?
Glossary
Agentic AIHuman-in-the-loopAI governanceShadow AIAI acceptable use policyAutomated decision-making technology (ADMT)AI guardrailsAPI key
Other solutions
KPI and pipeline dashboardsSoftware stack auditDocument intake and data extractionInvoicing and collections follow-upInternal knowledge assistantJob scheduling and dispatchHiring and staff onboardingSystems integrationContract and document review supportCompliance documentationTechnology vendor selection
Next step
Bring one expensive workflow. Leave with a clear next step.
In 30 minutes we look at one recurring workflow, what it costs you today and whether there is a credible case to improve it. If there is not, we will say so.
Book a 30-minute workflow review
Not ready to talk? Take the 3-minute check
30 minutes with Phil or Martin. No technical brief, no pitch deck. Phil or Martin replies personally, usually within one business day.