Skip to content
Civware

Rules for AI that keep upas its use grows

Governance is the set of policies, reviews and controls that decide who can use AI, for what, and with which data. We help you set it up in proportion to your risk, so it helps teams move instead of stopping them.

Group
Plan
First step
A policy and review setup
Usual owner
COO, CTO or risk lead
You decide
How strict each review is

When it fits

Worth doing once AI is used in more than one place, or touches customers or personal data.

  1. 01

    People already use AI tools at work, and there's no shared rule on what's allowed.

  2. 02

    Customers, auditors or your board are asking how AI decisions are reviewed.

  3. 03

    Each new AI idea gets stuck because nobody knows who can approve it.

What we build

  1. 01A short AI use policy, written for staff rather than lawyers.
  2. 02A review process that sorts each new use by risk and sends it to the right approver.
  3. 03A register of every AI system: its owner, data, purpose and review date.
  4. 04Controls for higher-risk uses: approvals, logging and regular checks.
  5. 05Guidance on which data must never go into AI tools.
  6. 06A light review cycle, so the rules change as your use of AI does.

How it works

Every new use of AI passes the same short review. Low-risk uses can be approved quickly, and the few that carry real risk get a closer look.

  1. 01Four questions: what data, who it affects, what it can change, who owns it.
  2. 02The answers set the level of review, from a quick approval to a senior review.
  3. 03Every decision is recorded in the AI register.
How a new use of AI is approvedA new use of AI goes through one risk review that asks what data it uses, who it affects, what it can change and who owns it. The answers send it to a low, medium or high level of approval, and every decision is recorded in the AI register.FIG. 01HOW A NEW AI USE IS APPROVEDNEW AI USERISK REVIEWWhat data it usesWho it affectsWhat it can changeWho owns itLOWApproveMEDIUMApprove withcontrolsHIGHSeniorreviewAI REGISTERevery use, its owner and review date
Fig. 01 How a new use of AI is approved. The review is the same for every idea; the answers decide how closely it's checked.

Safeguards

Governance has its own ways of failing. These are the ones we design against.

Rules so strict people work around them
Reviews are sized to the risk, so low-risk uses are approved quickly and people have a reason to ask.
A policy nobody reads
It's short, written in plain words, and backed by examples of what's allowed.
A register that goes out of date
Each entry has an owner and a review date, and reminders go out before it lapses.
Rules that lag behind new tools
The policy is reviewed on a set cycle, and new tools go through the same short review.

How to start

First engagement · Governance setup

A working policy, review and register

It delivers:

  • An AI use policy and guidance for staff
  • A risk review with named approvers
  • An AI register, filled in for the tools you already use
  • A plan for reviewing it as your use grows
Price
Fixed, agreed before we start
Length
Usually 3 to 4 weeks
Decision pointYou decide how strict each level of review should be, and who approves at each one.
Book a call

Planning your first AI build too? This fits well alongside a Readiness Assessment.

Questions

Do you follow a particular framework?

We can align the setup with a recognized framework if your auditors or customers expect one, and we'll agree which before we start.

Is this only for regulated industries?

No. Any organization using AI with customer or personal data benefits from knowing who approved what, and why.

Will this slow our teams down?

It's designed not to. Low-risk uses get a quick answer, and teams know exactly what to send for the rest.

Does this replace legal advice?

No. We set up the working process. Your legal team or counsel should review the policy itself.

Tell us one job you'd like AI to do

We'll tell you honestly whether AI is the right fit, and what a sensible first step looks like.

One job is enough to start.

We use your details to reply to you, as described in our privacy policy.