# AI Risk and Governance Know what your AI is doing with your data before someone else asks. --- ## What this is Most of what an organization thinks is a technology gap is a governance problem and a process problem wearing a software costume. Six months after the purchase, the problems are still there, now with a line item attached. AI risk works the same way. The tool is rarely the problem. What the tool can reach, what data it retains, and whether anyone is watching, that is the problem. I map what your AI tools can access, where your exposure actually sits, and what needs to change first. Then I give you a governance framework you can hand to a funder, a client, or a regulator when they ask how AI usage is controlled. Because eventually one of them will ask, and the quiet in the room when nobody has an answer is expensive. --- ## What I assess - Which AI tools are in active use and what systems and data each one can reach - Where sensitive data flows into tools that were never evaluated for retention or compliance - What a funder, auditor, or client would find if they reviewed your AI usage tomorrow - Where your current policy, if you have one, does not match what your team actually does - What has to change now, what can wait, and what is already fine --- ## How I work ### Map the real exposure I look at what is actually running, not the tidy version in a policy document. The gap between the two is where the risk lives. ### Build governance that fits the team A policy nobody follows is worse than no policy, because it creates the illusion of control. I write governance your team can actually work inside. ### Sequence the fixes Not everything is urgent. You get a prioritized plan: what to close immediately, what to improve over time, and what to leave alone. --- ## Why I build structured data instead of hoping If your system runs on free-text fields and manual re-entry, your data is only as reliable as your busiest person's hardest day. I once asked a client, gently, whether every entry of the word homicide would always be spelled correctly at the pace their team works. It will not be. That question is why I build structured data and real controls instead of hoping the pace never catches up with the person. Governance is the same discipline applied to AI: assume the busy day, and build so it does not break you. --- ## Sometimes the honest answer is do not migrate A client was being pushed toward replacing a working communications platform, with competitors pitching real savings. I ran the full evaluation anyway. The switching cost, the number porting risk, the retraining, and the feature gaps wiped out the savings entirely. The recommendation was to stay and spend the budget on the actual bottleneck. The boring system that works usually outlasts the shiny replacement someone read about online. I show you the real risk of the migration next to the real risk of what you already own, and I am willing to lose the engagement over the answer. --- ## The AI Readiness Audit For organizations that need the assessment before anything else, the AI Readiness Audit is where this starts. Four to six weeks, a fixed fee of $12,500, the principal on every hour. A full inventory of what your AI can reach, a draft usage policy, and a prioritized roadmap you own regardless of what you do next. [AI Readiness Audit](/ai-readiness-audit) --- ## FAQ ### Do we really need an AI usage policy? If your team uses AI and handles anything sensitive, yes. Not because a policy is virtuous, but because the day a funder or client asks how you govern AI, a real answer is the difference between a quick conversation and a long one. ### What frameworks do you use? Governance grounded in recognized security and privacy standards, adapted to the size and reality of your organization. The point is a framework your team can actually operate, not a binder that sits on a shelf. ### Can we use the assessment for compliance or grant reporting? Yes. The report is built to be referenceable by compliance officers, funders, and auditors. Several clients use it for exactly that. ### What if we find out our AI usage is already a problem? Then you found out before someone else did, which is the entire point. The roadmap tells you what to close first and how fast it needs to happen. --- ## If your team uses AI and no one has checked the risk, that is the gap this closes. [Start with a fixed-scope assessment](/ai-readiness-audit)