Identity / Sub-service 06
AI usage review:
your staff already use AI. Make it a tool you control.
Most firms haven't formally adopted AI, and their people are already using ChatGPT, Claude and Gemini on personal accounts. We find out what's in use, check what data is going into it, draft the rules, and set up whichever tool your team prefers on a business plan you control.
Service detail
From personal accounts to a sanctioned AI tool
Written for the people who have to answer for it: internal IT, the controller, and the compliance lead. We work vendor-neutral and set up the tool that fits your people. Scoped on a call.
What the review covers
- ›Discovery — which AI tools staff use, and how many people use each (Defender for Cloud Apps, firewall, proxy or browser data)
- ›Data-exposure check — what is likely going into those tools, and what your DLP can and cannot catch today
- ›AI acceptable-use policy draft, with an approved-tool shortlist (operational, not legal advice)
- ›Tool selection and setup plan — a business tier you control, single sign-on, admin controls, and a migration path off personal accounts
Why now
- ›Staff are using AI at work whether or not the company has signed up for it
- ›A personal AI account is a contract between the employee and the vendor; the company has no admin console for it
- ›Consumer and business tiers differ on training, retention and BAA eligibility
- ›A policy nobody can enforce is just a memo. Each rule needs a matching control
Tools we set up
- ›Claude Team and Enterprise
- ›ChatGPT Business and Enterprise
- ›Microsoft 365 Copilot and Copilot Chat
- ›Google Gemini for Workspace
- ›Whichever tool your people already prefer, if it has a business tier that meets your requirements
FAQ
Common questions about the AI usage review.
What is an AI usage review?
It is an engagement for firms whose staff are already using AI tools such as ChatGPT, Claude, Gemini or Copilot, often on personal accounts, before the company has formally adopted any of them. It covers four things: discovery of which AI tools are in use and by how many people; a data-exposure check of what is likely going into them and what your DLP can and cannot catch; an AI acceptable-use policy draft with an approved-tool shortlist; and a tool selection and setup plan to move staff onto a business tier the company controls.
Do you only recommend Microsoft Copilot?
No. We set up the tool that fits how your people actually work, whether that is Claude, ChatGPT, Copilot, Gemini or a mix. Most of our clients run on Microsoft 365, so discovery and data-loss controls usually use Microsoft tools they already license, but the AI tool itself is your choice. We compare business tiers on data handling, admin controls, single sign-on and, where relevant, BAA availability.
Is the acceptable-use policy legal advice?
No. We draft the operational policy: approved tools, what data may and may not go into them, how access is granted and removed, and which controls enforce each rule. Your counsel, HR and, where it applies, your privacy officer own the final wording and any legal determinations.
Our staff are already using personal ChatGPT or Claude accounts. Is it too late?
No. That is the most common starting point we see, and the reason this review exists. Banning AI outright rarely holds; people move to their phones. The practical goal is to find out what is in use, give staff a sanctioned tool that is at least as good, and put written rules and technical controls around it.
How much does it cost?
It is scoped on a call. The effort depends on headcount, which tools are already in use, what discovery data you have (firewall, proxy, Defender for Cloud Apps), and whether regulated data such as PHI or CUI is involved.
Who reads the output?
Internal IT gets the discovery findings and the setup plan. The controller, compliance lead or COO gets the data-exposure summary and the policy draft. Leadership gets a short written recommendation on which tool to sanction and why.
Further reading
- → Is Claude HIPAA compliant? Plan by plan — which Claude plans a BAA can cover, and what a personal account does with work data.
- → Copilot readiness assessment — if the sanctioned tool is Microsoft 365 Copilot, the permissions work comes first.
- → Virtual CISO & fractional CIO — if nobody inside owns security leadership, AI risk included, a fixed-scope vCISO engagement can cover that.
Scoped on a call.
Tell us roughly how many people you have, which AI tools you think are in use, and whether regulated data is involved. We'll come back with scope and timing.