AI governance
AI Governance Consulting Sized for $1M–$10M Companies
Your team is already using AI. We help you decide which tools, what data and whose review, then write it down, configure it in the tools and train people on it. No committee required.
What AI governance consulting means for a $1M–$10M company
AI governance is the set of decisions a company makes about which AI tools people may use, what data can go into them, who reviews the output and who answers for the result. At a $5M distributor or a 30-person agency, those decisions need to fit on a few pages and be owned by one person who also has a day job, not a committee.
Operator Intelligence (OI) builds governance at that second scale. We start from how your team uses AI today, not from a framework, and we finish when the rules are configured in the tools: business-tier accounts, admin settings, approved connectors and review steps inside the workflows. Governance is one of the five components of AI enablement, alongside people, process, tools and data.
Right-sized does not mean soft. Client data, credentials, money and anything customer-facing get firm rules. Everything else gets clear defaults, so people can move quickly. The policy itself starts from our free AI acceptable use policy template.
Shadow AI: the first problem AI governance solves
Shadow AI is the use of AI tools at work without the company's approval or visibility, usually on personal accounts. In Microsoft and LinkedIn's 2024 Work Trend Index, 78% of AI users said they bring their own AI tools to work. IBM's Cost of a Data Breach Report 2025 found that one in five organizations studied reported a breach due to shadow AI, and only 37% had policies to manage AI or detect shadow AI.
Banning AI rarely fixes this; it moves use onto phones where nobody can see it. What works is approved tools that are better than the ones people found on their own, plain rules about which data stays out, and an easy way to request a new tool. That is why every Operator Intelligence governance engagement starts with a no-blame inventory of what people actually use. Read more about shadow AI and how to reduce it.
The six parts of right-sized AI governance
Every Operator Intelligence governance engagement covers these six parts.
AI acceptable use policy
A short, plain-language policy on approved tools, data, review, disclosure, incidents and training, adapted from our free template to your industry.
Learn moreApproved-tool register
The AI tools, plan tiers and built-in AI features you allow, what data each may handle and who owns it, with a fast path for new requests.
Data rules
Four data classes (public, internal, confidential and restricted) mapped to the tools allowed to touch each, with examples from your own business.
Human-in-the-loop review
Named reviewers for AI output that reaches clients or the public, and approval before any AI agent sends, pays, publishes or deletes.
Learn moreVendor and connector review
A short checklist for new AI vendors, connectors and MCP servers: data terms, training settings, permissions, logging and revocation.
Learn moreAI governance training
Role-based sessions so everyone knows the rules, managers can approve new uses and admins configure tools safely.
Learn moreEnterprise AI governance vs right-sized AI governance
Enterprise frameworks assume legal, risk and security teams. A lean company needs the same protections with far less overhead.
| Area | Typical enterprise approach | Right-sized approach for $1M–$10M companies |
|---|---|---|
| Ownership | An AI council spanning legal, risk, security and IT | One named policy owner with authority, plus an executive sponsor |
| Policy | Multiple standards, procedures and control libraries | One acceptable use policy of a few pages, reviewed every six months |
| Tool approval | Formal procurement and security review for every tool | An approved-tool register with a short checklist |
| Risk assessment | Model inventories and impact assessments per system | A risk rating per AI workflow: what it touches, what could go wrong, who reviews |
| Agents and connectors | Enterprise identity and access management programs | Least-privilege scopes, read-only by default, writes behind approval, logging on |
| Training | Annual compliance modules | Hands-on, role-based sessions in the tools people actually use |
AI governance sprint: SMB deliverables and typical timeline
Operator Intelligence typically runs governance as a two-week policy sprint, scoped alongside the AI readiness assessment, then builds review gates and training alongside the first pilot. Timelines are typical and depend on team size and counsel's review.
| When (typical) | Deliverables |
|---|---|
| Week 1 | A no-blame inventory of current AI use from a survey plus admin data; four data classes set with leadership, using client contracts, NDAs and industry rules for the restricted list; a draft approved-tool register |
| Week 2 | An AI acceptable use policy adapted from our template; vendor review of the tools already in use; admin settings on approved tools: business tiers, single sign-on and training on company data off where the plan allows |
| Counsel review | Your attorney reviews the policy before adoption, and we incorporate the changes |
| Weeks 3–6, with the first pilot | An owner, risk rating, logging and approval gate for each AI automation and agent; role-based training; signed acknowledgments |
| Every six months | Policy, register and vendor review, plus a check on new AI features switched on in existing tools |
AI inventory template: what to record for each tool and workflow
An AI inventory is the register that every other governance decision depends on. One row per AI tool, built-in AI feature, automation or agent; a spreadsheet is enough at this size.
| Field | What to record | Example |
|---|---|---|
| Tool or workflow | Name, vendor and plan tier | Claude Team; n8n invoice workflow |
| Owner | The person accountable for it | Operations manager |
| Users | Teams or roles that use it | Sales team, 8 people |
| Use case | The tasks it supports | Drafting proposals |
| Data touched | The highest data class it handles | Confidential: client pricing |
| Access | Connectors, scopes, and read or write | CRM read-only |
| Human review | Who checks output before it's used | Account lead approves |
| Account type | Company plan or personal account | Moving off personal accounts |
| Risk rating | Low, medium or high, with the reason | Medium: client-facing drafts |
| Status | Approved, pending or retired, and the next review date | Approved; review in six months |
AI vendor review checklist
Run every new AI vendor, connector and MCP server through this AI vendor review checklist before company data goes in. Most answers are in the vendor's trust center, terms or admin console.
- What data the tool receives, and whether it trains models on it by default
- Whether training on your data can be switched off on your plan
- Where data is stored, for how long, and how deletion works
- A business plan with a data processing agreement
- Security evidence such as a SOC 2 Type II report or ISO/IEC 27001 certificate
- Which AI model providers and other sub-processors it sends data to
- Single sign-on and admin controls to add and remove users
- Connector and MCP scopes: read versus write, least privilege
- Audit logs you can see
- Incident notification terms in the contract
- How access is revoked and keys rotated when you stop using it
- A named internal owner and a review date
AI governance training: what each role needs to know
AI governance training works when it is short, role-specific and done inside the approved tools. A deck on responsible AI principles does not tell an account manager whether a client contract can go into Claude. Operator Intelligence teaches governance as part of hands-on AI training for teams, in three layers:
- Everyone: the data classes with real examples, the approved tools, how to review AI output and how to report a mistake without blame
- Managers: how to evaluate a new AI use case and when output needs a second reviewer
- Admins and builders: plan settings, connector and MCP permissions, API key storage, logging and revoking access
Sessions end with people working in approved, configured workspaces. Where those need building first, AI workspace setup configures them under your admin's controls.
Governing AI agents, automations and MCP connectors
Most AI policies cover chat. Few cover AI that takes actions, such as sending email, updating CRM records or changing a website, where a mistake goes out without a person typing it. Operator Intelligence applies five rules to every agent, automation and connector we build or review:
- One owner who watches the logs and can pause the workflow
- Least privilege: read-only to start, write access only for a documented need
- Approval before risky actions: spending, customer contact, publishing and deleting wait for a person
- Logging on for every run and tool call
- A way out: keys rotate and access is revoked when a project ends
Platforms increasingly support this. Anthropic lets Claude organization admins restrict actions within each MCP connector, such as allowing reads while blocking writes. In our ROAM Luggage build, Claude changes a Shopify development theme and a team member reviews and publishes; see the ROAM Luggage case study.
NIST AI RMF, ISO/IEC 42001, the EU AI Act and where counsel comes in
A lean company rarely needs to adopt an AI framework wholesale, but three are worth knowing:
- NIST AI Risk Management Framework (AI RMF 1.0): a voluntary framework from the US National Institute of Standards and Technology, released January 26, 2023, built on four functions: Govern, Map, Measure and Manage. A Generative AI Profile (NIST-AI-600-1) followed on July 26, 2024. We borrow its vocabulary for each workflow's risk rating.
- ISO/IEC 42001:2023: the international standard for an AI management system (AIMS), published in December 2023. It sets requirements for establishing, running and continually improving AI governance in organizations of any size that develop, provide or use AI. Certification is voluntary and done by independent certification bodies; few lean companies need it, but its structure of policy, roles, risk assessment and review is a useful checklist.
- EU AI Act: applies in stages. Its AI literacy provision (Article 4) has applied since February 2, 2025. The Digital Omnibus amendments, in force since July 27, 2026, rewrote Article 4 as a duty to support AI literacy and moved most stand-alone high-risk obligations to December 2, 2027.
Industry rules can matter as much; law firms, for example, map AI use to professional conduct rules (see AI for law firms). Operator Intelligence is not a law firm, and nothing here is legal advice. Work with counsel for legal obligations; we build the operational side and work alongside your attorney.
Frequently asked questions
How much does AI governance consulting cost?
Cost depends on how many teams, tools and AI workflows are in scope, your industry's requirements and how much training is included. We quote governance as a defined project, often alongside the AI readiness assessment. See how we price.
How long does it take to put AI governance in place?
A typical policy sprint takes two weeks: inventory, data rules, the approved-tool register, the policy draft and admin settings. Counsel then reviews the policy, and review gates and training are built alongside the first pilot, which typically ships in four to six weeks.
Should we ban ChatGPT and other consumer AI tools?
Bans are hard to enforce and push AI use onto personal accounts you can't see. A more workable rule approves business or enterprise tiers for company data and limits consumer tools to public information.
Do we need AI governance if we're a 20-person company?
Yes, if anyone uses AI for company work. At that size governance can be a few pages and one training session, but someone still has to decide which tools are approved and which data stays out. Companies that want a senior owner for those calls can add a fractional chief AI officer.
Is this legal or compliance advice?
No. Operator Intelligence is not a law firm. We build the operational side of AI governance and recommend that counsel review your policy and any regulatory obligations, such as the EU AI Act or industry rules.
Can you review AI tools and agents another vendor built?
Yes. We check what each one can access and change, where its logs go and who approves its actions, then recommend tightening permissions, adding review gates or retiring it.
Put AI governance in place without slowing your team down
Book a scoping call and we'll review how your team uses AI today and what right-sized governance looks like for you. Or start with the free AI readiness assessment.
Book a scoping callSources
- Microsoft and LinkedIn, 2024 Work Trend Index (2024): 78% of AI users bring their own AI tools to work (BYOAI)
- IBM, Cost of a Data Breach Report 2025 (press release, July 30, 2025) (2025): One in five organizations reported a breach due to shadow AI; only 37% have policies to manage AI or detect shadow AI
- NIST (2023–2024): NIST AI RMF 1.0 released January 26, 2023, for voluntary use; four functions Govern, Map, Measure, Manage; Generative AI Profile (NIST-AI-600-1) released July 26, 2024
- Law & Technology (lawandtechnology.eu) (2026): EU AI Act Article 4 applicable from February 2, 2025; Digital Omnibus (Regulation (EU) 2026/1744) published July 24, 2026, in force July 27, 2026, rewrote Article 4 as a duty to support AI literacy
- Orrick (2026): Digital Omnibus moves Annex III (stand-alone) high-risk obligations from August 2, 2026 to December 2, 2027
- Anthropic (claude.com blog, Making Claude Cowork ready for enterprise, April 9, 2026) (2026): Claude admins can restrict which actions are available within each MCP connector, e.g. allowing reads while blocking writes
- ISO (2023): ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system; published 2023-12; specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS); for organizations of any size involved in developing, providing or using AI-based products or services
- ISO (ISO/IEC 42001 explained) (accessed 2026): Certification for ISO/IEC 42001 is voluntary; ISO does not certify organizations; certification is carried out by independent certification bodies
Related
AI acceptable use policy template
A free policy you can adapt this week.
What is shadow AI?
Unapproved AI use and how to reduce it.
AI training & fluency
Training that ends with configured AI tools.
MCP integrations
Connecting AI to your systems with scoped access.
AI enablement services
The full AI enablement program.
AI upskilling and AI champions program
Governance habits taught across the company over 90 days.
Executive AI workshop
Leadership sets AI priorities and guardrails together.