Manage Your AI — Before It Manages You
Know where AI is being used, decide the rules once, and apply them to everyone with a foot in your environment.
AI is already in your business
Most businesses already have AI running somewhere in their operations — sanctioned or not — and very few have governance that keeps pace with it.
It rarely arrives as a project. It arrives as:
- an assistant built into the office suite that someone switched on
- a meeting recorder that joins calls and summarises them
- a chatbot used through a personal account because it is quicker than the approved way
- a coding assistant in a developer’s editor
- an AI feature a software vendor added to a product you already pay for
- an automation or agent connected to email, files or the CRM
Each of these touches your data, and few of them were ever formally approved. Most businesses cannot say — with confidence — which AI tools are in use, who is using them, or what information is going into them.
Policies are lagging the tools
The tools are moving faster than the policies meant to control them, and “we’ll figure it out later” is quickly becoming an expensive plan. Later usually looks like this:
- Data goes where it should not. Client information, contracts, financials or source code pasted into public tools, with no way to retrieve or delete it.
- Outputs are trusted without checking. AI-generated content that is wrong or invented ends up in client work, reports or decisions.
- Decisions are made by default. Vendors switch on AI features and update their terms, and nobody reviews what changed.
- Someone else asks first. Customers, insurers and tender questionnaires increasingly ask how you govern AI. “We don’t have a policy” is a hard answer to give.
- Your obligations do not pause. POPIA and GDPR apply however the data was processed, and personal information pasted into an AI tool is still personal information you are responsible for, and the tool being new is not a defence.
Governance built in early is cheaper than governance retrofitted after an incident or a difficult customer audit.
This is a security issue, not just a policy issue
AI systems bring risks that traditional security controls were not designed for. Hidden instructions in an email, document or web page can steer an AI assistant into doing something its user never intended. AI agents given broad permissions can act well beyond what anyone expected. Models, plug-ins and integrations bring their own supply chain. Sensitive information can leak through prompts, outputs and connected data sources. Each AI tool that connects to your systems is also a new identity with access.
It’s not only your own AI use
Third parties connecting into your environment are almost certainly using AI agents of their own, whether or not you’ve asked them to disclose it. That includes IT providers, software vendors, contractors and any partner with access to your systems or data.
Your contracts probably do not mention it. You may not be told when it changes. If one of their agents acts inside your environment, you are the one who has to explain what happened. That is why the rules for third parties need to be set by you, in advance, and written down.
Where POPIA and GDPR come in
AI does not sit outside data protection law. If personal information goes into an AI tool, comes out of one, or is processed by a third party’s agent on your behalf, POPIA and GDPR (potentially) apply. In practice, that raises a handful of questions most businesses cannot yet answer.
What good governance looks like
Good AI governance is not a sixty-page document. It is a small number of decisions, made once, applied consistently and kept up to date:
- Someone is accountable for AI, and people know who to ask
- There is a current list of the AI in use, sanctioned or otherwise
- Rules on what data can and cannot go into AI tools, including personal information, are clear enough to follow without a lawyer
- New tools and new uses are approved in proportion to their risk, not by default and not by delay
- Suppliers connecting into your environment are held to the same standards
- The whole arrangement is reviewed as the tools and the rules change
How We Can Help
We evaluate the risk and build a governance plan that fits how you actually use AI, and set clear rules for any third party connecting into your environment.
Our methodology
Our methodology is primarily built on the ISO 42001 standard as the “wrapper”, with NIST AI RMF as the “executable”. We found this to be the most effective dual-compliance approach. There are benefits to both, but their approach and outcomes are different. We supplement these frameworks with OWASP’s LLM AI security controls where relevant.
| Framework | Role in our approach | What it gives you |
| ISO/IEC 42001 | The wrapper | A management-system structure for AI: policy, roles, risk assessment, controls, documentation, review and continual improvement. It can be independently audited and certified, so it gives you governance you can demonstrate to customers, insurers and auditors. |
| NIST AI RMF | The executable | A practical way of working, organised around four functions: Govern, Map, Measure and Manage. It tells your people how to identify, assess and treat AI risks in day-to-day practice. It is voluntary and not certifiable, which is why it works best inside a structure. |
| OWASP LLM security controls | The technical layer, where relevant | A widely used catalogue of security risks specific to language-model applications and agents, including prompt injection, sensitive information disclosure and excessive agency. We use it where you build, customise or connect AI into your systems. |
These frameworks are not a substitute for legal compliance, so we map the work to your POPIA and GDPR obligations as we go. That way the governance you build also supports what regulators and customers will expect of you.
Our approach can be scaled down to a simpler approach if that better suits your size and maturity. See “Sized to fit” below.
1. Find out where AI is being used
We start with what is really happening, not what the policy assumes. That includes the tools nobody approved.
2. Assess and tier the risk
Not every use of AI carries the same risk. We assess each one against the data involved, how much autonomy it has, the impact of an error, and any third-party involvement, so effort goes where it matters.
3. Your AI governance plan
This is the core deliverable: a plan that fits how you actually use AI and can grow with you.
4. An AI Acceptable Use Policy built around your business
We’ll draft you an AI Acceptable Use Policy built around your business, not lifted from a template. What your people can and can’t do with AI are shaped by your operations and risk appetite — not a generic policy someone downloaded.
5. Clear rules for third parties
We set the standard for any third party connecting into your environment, so that AI use by suppliers is disclosed, limited and accountable.
6. Secure the AI you build and connect
Where you build, customise or connect AI into your own systems or customer-facing services, we apply OWASP’s LLM security controls.
7. Make it work day to day, and keep it current
Governance that sits in a folder does not help anyone. We help turn the plan into routines your team can follow, and keep it current as the tools, the rules and your business change.
Sized to fit
Governance should match the size and maturity of the business. A ten-person firm does not need the same machinery as a regulated enterprise, but both need the essentials.
| Essentials | Full alignment | |
| Best suited to | Smaller or earlier-stage businesses, or those new to AI governance | Larger or regulated businesses, or those needing to demonstrate compliance externally |
| Includes | AI use register, risk tiering, bespoke AI Acceptable Use Policy with personal information rules, third-party rules, a simple approval process, and key OWASP checks where AI is built or connected | Everything in Essentials, plus an ISO 42001-aligned management system, NIST AI RMF operating practices, a formal gap assessment, and preparation for audit or certification |
| Outcome | Clear rules, visibility and ownership, at a pace your team can sustain | Governance you can evidence to customers, insurers and auditors, with a route to certification if you want one |
Not sure how much AI is already running in your business?
Start with a no obligation conversation. We’ll tell you what needs governing first and what can wait.