Straight answers about AI control

A policy establishes expectations. It can define acceptable behavior, prohibit certain activities, require human review and remind employees to protect confidential information. What it cannot do is operate.

A policy does not show you where AI is already in use, identify which tools employees have opened on personal accounts, prevent sensitive information from being entered into the wrong platform, or verify that anyone followed the rules. Treat an AI policy as the beginning of the process, not the end.

Rarely, because the ban is usually unenforceable and frequently already untrue. AI arrives embedded in software you already licensed, added by vendors and carriers through updates nobody separately purchased, and adopted informally by employees on personal accounts.

A prohibition you cannot verify produces the worst of both outcomes: none of the benefit, and no visibility into the use that continues anyway. Controlled non-adoption is a legitimate posture - but it has to be enforced and evidenced, not just declared.

Only when the reviewer knows what wrong looks like. An AI answer can be polished, professional and almost correct - omitting the one endorsement that changes the conclusion, or relying on a superseded source. The reviewer approves because nothing looks obviously wrong. A person was involved; you did not have control.

The structural version of this failure is worse: if the AI determines when human review is required, control has been handed to the thing being controlled.

That is the normal starting position, and it is the first thing we fix. The AI Inventory covers embedded features in software you already licensed, vendor and carrier assistants, deliberately adopted tools, and informal use on personal accounts.

Nobody is penalized for what the inventory finds. An organization that cannot identify where AI operates cannot credibly claim to control it - so establishing the picture is the work, not a test you pass or fail.

Seven components, each an artifact you can hold, hand to an underwriter, or produce in response to a question: the AI Inventory, the Decision-Point Map, the Authorization Register, Policies & Authority Rules, Controls & Guardrails, the Evidence & Exception System, and Continuous Engagement - plus the Four Walls Environment, the enforced boundary, scoped separately.

Together they form the AI Control System. It is built to be demonstrated, not described.

Usually not. Commercial technology already exists for identity and access, managed devices, browser restriction, data-loss prevention, monitoring, logging and alerting - and most organizations already own more of it than they use.

The work is coordinating those tools around your own AI rules and risk decisions. Where additional technology is genuinely required, it is quoted separately and transparently, and it is never a product we sell you.

It should do the opposite. The instinct to review everything is what makes governance collapse under its own weight; the alternative is to review what matters, with oversight matched to risk.

The controls are also built so the approved path is the convenient one. If following the rule is harder than breaking it, the rule loses - so we build the compliant route into the environment rather than relying on willpower.

You do. The inventory, the decision-point map, the register, the policies and the evidence trail are yours, in your systems, in editable form. They remain useful and defensible whether or not we continue working together.

With a complimentary AI risk pre-assessment discussion - a structured conversation about where AI already operates in your business and where control is missing. No written assessment, no recommendations, no obligation and no cost.

If it makes sense to continue, the AI Risk & Controls Assessment produces the current-state review, the initial inventory and decision-point map, the gap analysis and the engagement scope. From there, the managed engagement builds and launches the system.

Pricing scales by size, users, locations, AI tools in use, workflow complexity and implementation requirements - so a published figure would be wrong for most readers. We quote against your actual scope after the fit call.

The assessment fee is credited in full against a managed engagement commenced within 30 days, and at 50% between days 31 and 90. Third-party technology, IT and security services, legal services, travel and taxes are excluded unless expressly included.

The assessment is measured in weeks, not months, and the managed engagement is scoped against what the assessment finds. Governance is not installed and finished, though - models change, vendors ship updates, regulations move and staff turn over.

That is why Continuous Engagement is a component rather than an upsell. Maturity runs visibility, then consistency, then optimization. The objective is demonstrable improvement, not a certificate.

Security asks whether the wrong people can get in. This asks whether the right people, using approved tools correctly, can still produce an indefensible outcome - and where in the workflow that happens.

The two overlap in the enforcement layer and complement each other everywhere else. A clean penetration test tells you nothing about whether an AI summary dropped the endorsement that mattered.

No. Training and competency are required components, but organizational certification also requires implementation and verification of operational controls.

No. Certification verifies that the organization has implemented a defined system for governing, reviewing, documenting and responding to AI activity.

Not necessarily. Requirements are proportionate and tailored to the organization’s size, services, risk profile and AI use. Some controls may be procedural, while others may require technical enforcement.

The planned certification term is 12 months, subject to renewal, material-change requirements and reassessment after a significant AI-related incident.

Any accreditation, endorsement, recognition, continuing-education approval or formal partnership will be identified by name only after it has been granted.

No. Our experience spans insurance, healthcare, real estate, legal, restoration and technology, among others.

The model applies to any organization where advice, documentation and judgment carry consequence. Coverage for an AI-related loss frequently turns on how a claim is pleaded rather than on the technology, and that is true in every sector.

It gives you something to bring to the conversation. An organization that can show approved tools, controlled data, risk-based review, verification, logging, exceptions and continuous improvement is better prepared for the questions underwriters, brokers, clients, regulators and courts are likely to ask.

As the market matures, documented controls may carry direct economic value in the way cyber-hygiene and telematics controls already do. That remains an emerging possibility rather than established market practice, and we will always describe it that way.

No. We are not a law firm and we do not provide legal advice, regulatory opinions or coverage determinations. Nothing we produce is a substitute for counsel, and questions about what a specific policy covers belong with your broker of record and your attorney.

What we build is operational: where AI is used, what it may do, who decides, what gets verified, and what evidence exists. That work supports your legal and compliance advisers rather than replacing them.

You keep everything - the artifacts, the procedures and the evidence trail, all editable and all yours. Many organizations continue with a Continuous Engagement subscription for ongoing advisory, exception guidance, training and periodic re-authorization as tools and rules change.

Others take it in-house. Both are legitimate outcomes, and we would rather build something durable than something dependent.