FAQs
Have Questions?
What does AI governance cover?
AI governance covers acceptable use policy, sanctioned tool selection, shadow AI discovery, data protection inside AI platforms, vendor and contract review for AI services, employee training, and ongoing monitoring of usage. The work spans Microsoft Copilot, ChatGPT Enterprise, Google Gemini, and the many other AI tools employees encounter through browsers and integrations.
How do you discover shadow AI usage?
Shadow AI discovery uses browser telemetry, identity provider logs, network traffic analysis, expense reports, and conversations with department leads. Each signal source surfaces different tools. The combined inventory is meaningfully more complete than relying on any single source. The output gets reviewed with HR and legal stakeholders before user-level details surface.
What is wrong with employees using free ChatGPT?
The free version of ChatGPT trains on conversation data by default and offers limited contractual protections. Sensitive customer data, intellectual property, or confidential documents pasted into the free tier become part of the training corpus or risk inadvertent disclosure. Enterprise tiers and Microsoft Copilot with commercial data protection address this, but only for sanctioned tools the business has contracted for.
Do we need a formal AI policy if we are small?
Yes. The risk does not scale with company size. A 30-person CPA firm in Houston has the same exposure if employees paste client tax information into free AI tools as a 3,000-person firm would. The policy can be brief, but having a written, employee-acknowledged acceptable use document closes both the legal and the practical gap.
How does AI governance relate to compliance frameworks?
Most major frameworks now address AI directly or through related controls. NIST has the AI Risk Management Framework. ISO has 42001 for AI management systems. SOC 2, HIPAA, and PCI DSS all surface AI obligations through their existing data protection requirements. AI governance work makes those obligations operational rather than theoretical.
