Shadow AI use is close to universal. Staff are pasting client information into free chatbots because it makes their job easier, and in most organisations nobody has told them what’s acceptable — which means nobody can tell them they got it wrong, either.
That’s the actual starting position for most AI governance work: not “should we adopt AI” but “what’s already happening, and how do we make it safe and useful instead of invisible”.
We cover both halves.
Readiness. Where AI would genuinely pay off in your operation, ranked by value and feasibility. Which of your processes are good candidates and which are traps. Whether your data is in a state where AI can do anything useful with it — usually the binding constraint, and usually the thing nobody wants to hear.
Governance. An acceptable-use policy written in plain language people will actually follow. Rules on what data can go into which tools. Guidance on human review for anything client-facing or consequential. A register of approved tools and what they’re approved for. Where relevant, alignment with your privacy obligations and, for government and funded organisations, the standards your funders expect.
The output is short and practical: a policy your team can read in five minutes, a tool list, and a prioritised set of opportunities. Not a forty-page framework that gets filed and ignored.