AI Governance
AI governance and company usage-policy consulting
AI governance and enterprise usage guidelines assist enterprises in managing tool selection, data input, output verification, and exception handling. Vosurein starts from actual use and responsible personnel, plans operational rules, application reviews, and maintenance methods for employees, enabling the system to integrate with daily work.
For Your Business
Who this service is for and when to start
When employees are already using generative AI, departments are separately procuring tools, or the company is preparing to connect AI to customer data and formal processes, the usage guidelines can be reviewed first. Even if the model is not developed in-house, it is necessary to know where work data is sent, who can access it, and how the outputs are used.
Customer questions about AI management, misdirected data or incorrect content can prompt a review. You do not need to cover every tool at once. Start with known uses and higher-impact tasks, then continue to complete the inventory.
The Challenge
Common challenges faced by businesses
If the guideline only states "no input of confidential data," employees may still be unable to determine whether customer correspondence, quotes, or internal meeting records can be used. The system needs to link to the company's existing data classification and provide work contexts that allow judgment.
Written rules may not match system settings. A policy might require role-based access while the tool uses a shared account with broad permissions, or require human review without naming a reviewer or a way to return work for correction. Policy owners and technical contacts need to resolve these gaps together.
Vendors, models, and use cases will also change. Tools initially approved may need re-evaluation after adding new data sources or performing external functions. Without change notifications and maintenance responsibilities, the inventory soon will not reflect the actual usage status.
Our Approach
Methods and applicable requirements
Organize Governance Work Using a Risk Framework
NIST AI RMF Core Includes four functions: Govern, Map, Measure, and Manage, which help organizations arrange governance, understand contexts, assess and handle risks. It is a voluntary framework, not generally mandatory by law or certification requirements. This service selects implementable tasks based on corporate use and does not treat all recommendations as obligations.
For generative AI, you can also refer to NIST's 2024 publication, Generative AI Profile, to review risks involving unreliable generated content, information security and data. Choose specific controls based on the tools, data and impact of their use.
Turn usage boundaries into practical rules
We recommend distinguishing permitted uses, uses requiring approval and prohibited uses. Specify data conditions, allowed accounts, review responsibilities and incident contacts. These risk categories are an internal management arrangement, not the categories of a particular law. The people responsible for legal or contractual requirements must confirm those separately.
Relationship with ISO/IEC 42001
ISO/IEC 42001:2023 specifies how organisations establish, implement, maintain and continually improve an AI management system. This service may start with acceptable-use rules or review procedures. Full implementation requires a separate agreement on the management system scope and plan. Completing a policy does not constitute a complete management system or third-party certification.
Process
Consulting scope and process
Inventory of tools and uses
Organize tools, account types, the departments that use them, data sources, and responsible persons. Interview actual usage scenarios, mark any unconfirmed uses or terms, and avoid using only the approved procurement list as a representation of the entire scope of use.
Risk and rule design
Discuss the level of review according to data sensitivity, user groups, and the impact of errors. Include supplier evaluation, data input, output review, and deactivation conditions in the standards, and link them with existing information security and document management practices.
Practise approval requests and incident response
Use real work scenarios to test whether requests, approvals, reviews and incident reports can be handled in practice. For incorrect outputs, misdirected data or unexpected tool actions, agree who pauses the activity, notifies others, keeps records and handles follow-up.
Implementation and continuous review
Organize common employee issues and administrator operations, confirm the personnel responsible for maintaining the list and changes that require re-evaluation. Revise rules based on trial feedback, and arrange subsequent training and review work.
Preparation
What documents do companies need to prepare?
- Tools and uses: Tools used, account plans, departments, purposes, and responsible contacts.
- Data and permissions: Data types, access methods, input restrictions, and current permission settings.
- Policies and contracts: Existing information security standards, procurement terms, and customer agreement requirements.
- Incidents and division of labor: Known issues, reviewers, reporting contacts, and maintenance responsibilities.
Project Planning
Estimating time and cost
Evaluation factors include the number of departments and tools, completeness of supplier documentation, impact of use, and the extent to which existing systems can be reused. Clarifying principles for employee use alone differs from the workload that involves multi-system execution permissions, customer service, and incident drills.
Agree separate scopes for management system design, staff training, technical testing, system changes, legal advice and third-party certification. Assign an owner to maintain the policies. Changes to model capabilities, data sources or terms of service may require another review.
FAQ
Frequently asked questions
Do employees still need governance if they only use ready-made AI tools?
You can first establish basic usage rules. The key points are to confirm authorized accounts, data, purposes, and reviewers, and to set up issue reporting. The depth of governance can be adjusted according to usage scope and impact, and it is not necessary to build a complete management system from the start.
Is NIST AI RMF a mandatory regulation?
No. It is a voluntarily adopted risk management framework and can serve as a reference for corporate practice design. Individual legal, industry, or contractual requirements should be checked separately; a reference framework cannot be equated with legal compliance conclusions.
Does an AI use policy establish conformity with ISO/IEC 42001?
No. ISO/IEC 42001 concerns a complete AI management system; an AI use policy may be just one part of it. If implementation or certification against the standard is needed, agree the scope and preparation work separately.
How to determine which data can be input into AI?
First, evaluate based on corporate data classification, usage authorization, contracts, and tool terms, then formulate rules that employees can follow. Removing names may not be sufficient, as other fields may still identify individuals or disclose confidential information.
If using a corporate paid account, is it unnecessary to check data terms?
It still must be checked. Different products, plans, and settings may have different data processing conditions, so saving, usage purposes, access, and management methods should be verified. Work data should not be assumed uploadable simply because it is 'paid'.
How do we check that staff can apply the rules?
Conduct scenario drills for application, review, and anomaly reporting to ensure employees know the next steps. When access isolation or tool permissions are involved, technical personnel need to verify settings; document review cannot replace system testing.
How should AI output errors or data misdelivery be handled?
Follow corporate incident procedures to first limit ongoing impact, notify responsible contacts, and keep necessary records, then confirm data, recipients, and follow-up actions. Specific reporting obligations and external explanations should be determined according to the nature of the incident and applicable requirements.
How often should AI usage specifications be updated?
A regular review can be agreed upon, with conditions set for triggering changes. When important new purposes, data sources, tool functions, or incidents arise, a re-evaluation is advisable. Frequency depends on corporate usage and should not follow an unsupported uniform timeframe.
Related
Related services and enquiries
Please provide the current tools, using departments, main data types, and management problems you hope to solve, to facilitate discussion and guidance scope.Consult with Vosurein
Content checked: . Applicable versions and requirements depend on the company’s circumstances.
Let's Talk
Start a conversation about your needs.
Tell us how the work is done today and when you hope to finish,
so we can agree the scope and way of working together.
Blog
Sustainability and AI insights
Start with understanding,
and see where change can lead.