AI Risk and Governance

Know what your AI is doing with your data before someone else asks.

Overview

What this is

Most of what an organization thinks is a technology gap is a governance problem and a process problem wearing a software costume. Six months after the purchase, the problems are still there, now with a line item attached. AI risk works the same way. The tool is rarely the problem. What the tool can reach, what data it retains, and whether anyone is watching, that is the problem.

I map what your AI tools can access, where your exposure actually sits, and what needs to change first. Then I give you a governance framework you can hand to a funder, a client, or a regulator when they ask how AI usage is controlled. Because eventually one of them will ask, and the quiet in the room when nobody has an answer is expensive.

Assessment

What I assess

Which AI tools are in active use and what systems and data each one can reach
Where sensitive data flows into tools that were never evaluated for retention or compliance
What a funder, auditor, or client would find if they reviewed your AI usage tomorrow
Where your current policy, if you have one, does not match what your team actually does
What has to change now, what can wait, and what is already fine

How I Work

Three Steps

How I work

Map the real exposure

I look at what is actually running, not the tidy version in a policy document. The gap between the two is where the risk lives.

Build governance that fits the team

A policy nobody follows is worse than no policy, because it creates the illusion of control. I write governance your team can actually work inside.

Sequence the fixes

Not everything is urgent. You get a prioritized plan: what to close immediately, what to improve over time, and what to leave alone.

Field Notes

Why it matters

Why I build structured data instead of hoping

If your system runs on free-text fields and manual re-entry, your data is only as reliable as your busiest person's hardest day. I once asked a client, gently, whether every entry of the word homicide would always be spelled correctly at the pace their team works. It will not be. That question is why I build structured data and real controls instead of hoping the pace never catches up with the person. Governance is the same discipline applied to AI: assume the busy day, and build so it does not break you.

Sometimes the honest answer is do not migrate

A client was being pushed toward replacing a working communications platform, with competitors pitching real savings. I ran the full evaluation anyway. The switching cost, the number porting risk, the retraining, and the feature gaps wiped out the savings entirely. The recommendation was to stay and spend the budget on the actual bottleneck. The boring system that works usually outlasts the shiny replacement someone read about online. I show you the real risk of the migration next to the real risk of what you already own, and I am willing to lose the engagement over the answer.

The Audit

Where this starts

The AI Readiness Audit

For organizations that need the assessment before anything else, the AI Readiness Audit is where this starts. Four to six weeks, a fixed fee of $12,500, the principal on every hour. A full inventory of what your AI can reach, a draft usage policy, and a prioritized roadmap you own regardless of what you do next.

AI Readiness Audit

FAQ

If your team uses AI and handles anything sensitive, yes. Not because a policy is virtuous, but because the day a funder or client asks how you govern AI, a real answer is the difference between a quick conversation and a long one.

Governance grounded in recognized security and privacy standards, adapted to the size and reality of your organization. The point is a framework your team can actually operate, not a binder that sits on a shelf.

Yes. The report is built to be referenceable by compliance officers, funders, and auditors. Several clients use it for exactly that.

Then you found out before someone else did, which is the entire point. The roadmap tells you what to close first and how fast it needs to happen.

If your team uses AI and no one has checked the risk, that is the gap this closes.

Start with a fixed-scope assessment