AI use and governance review
Scope and price are agreed in writing before work starts.
Employees already use AI, but the approved tools, permitted data and review responsibilities are unclear. We build an inventory from surveys, interviews and available records, then prepare a risk register, acceptable-use rules and an approval process. We state the coverage and what remains unknown.
When you need this service
- Staff use AI tools without clear rules.
- You do not know what data goes into them.
- You want to launch an AI tool or agent and need to decide on what terms.
The benefit for your organisation
- Teams have a workable way to use AI and to decide which data and outputs are acceptable.
- You know what your teams use and which risks need a decision.
- People know what is allowed, and you can show it when asked.
For whom
Organisations where staff already use AI tools — approved or not — on business or personal data.
Typical trigger: A leak or a prevented incident, a customer question about AI use, a policy request from management, or preparation for the AI Act’s transparency and literacy duties.
What you receive
- Inventory of AI use (survey, interviews, records)
- Acceptable-use rules, approval process and risk register
- AI governance rules, responsibilities and disclosures appropriate to each use
| Task | Data involved | Owner | Review needed |
|---|---|---|---|
| Drafting client e-mails | Business contact data | Sales lead | Acceptable-use rule; no special-category data |
| Summarising supplier contracts | Confidential commercial terms | Legal | Approved tool only; check the contractual and technical conditions for data retention |
| Shortlisting job applicants | Personal data of candidates | HR | Legal assessment before use — check against the AI Act’s listed high-risk uses |
Starting price
from €5 900
The price covers the stated base scope. Additional work is agreed in advance.
Timeline and your input
3–4 weeks
A management sponsor, access to staff for a short survey and interviews, and the records you hold (licences, tickets, logs). Coverage depends on these sources; we state what was checked. Typical timeline 3–4 weeks.
What the price includes
- 1 legal entity
- Up to 5 AI systems or tools inventoried
- Up to 100 staff in the shadow-AI survey
Agreed separately: Legal classification of specific high-risk uses beyond the extras listed; technical controls; training programmes.
Detailed terms
Base-scope price. The exact price is fixed in writing before work starts. It changes only when the agreed number of entities, systems, domains, contracts, documents, interviews, languages or depth of review falls outside the base scope. No additional work is charged without prior agreement.
- +€700 per additional AI system
- +€1 400 per system requiring high-risk classification work (instead of, not in addition to, the +€700)
A “system” is a tool together with a specific use of it; we agree what counts before quoting. A high-risk use among the base five is not re-charged automatically — the additional analysis is scoped and quoted separately. This is not the price of full high-risk compliance for a system.
What you prepare after we agree scope: known AI tools and uses, and a contact for the interviews. A brief description is enough for the first conversation. Do not send passwords or health information through the form. Documents and technical information needed for the agreed work are exchanged through a secure channel arranged in advance.
We prepare the agreed materials and document the scope, findings and limitations. Decisions by regulators, auditors or clients remain theirs to make.
Sample output
Demonstration example — not a real client.
| Use | Data | Decision |
|---|---|---|
| Drafting emails with a general chat assistant | No personal or confidential data | Allowed with rules |
| Summarising contracts | Confidential data | Only with the approved company tool |
| Pre-screening job applicants | Personal data | Paused pending a risk assessment |
Module: pre-launch check of an AI tool or agent
You have a specific project and need to decide whether to launch it. We check the permitted data and actions, the tool’s or agent’s access rights, when human approval is needed, what is logged and how it behaves in test scenarios. The result is a list of launch conditions. Quoted separately.
For a question about employee use, read what to document for ChatGPT and customer data, including the decision sheet and a redaction example.