Rules before incidents
Who signs off on AI output before it reaches a client? Caydev writes the AI usage policy that answers that question, along with which tools are approved, what data can touch them, and where a person reviews the work.
The problem
Staff are already using ChatGPT, Claude, or other AI tools on client data, contracts, and financials that nobody has classified or approved. It is rarely deliberate. Someone found a tool that made the work faster, and the habit spread before anyone wrote a rule.
The gap is not the technology. It is that nobody owns the risk until something goes wrong, and by then the question being asked is who approved it. Governance is how you answer that question in advance, in writing, before a client asks it for you.
A usable AI policy answers the questions your team is already asking quietly, in terms specific enough to act on.
Which AI tools staff may use for work, which accounts they must use, and how a new tool gets reviewed before someone starts putting company information into it.
What information can be shared with an AI tool and what cannot. Client data, contracts, financials, and personal information each get a stated boundary rather than an assumption.
Which decisions an AI tool may support, which it may draft, and which require a named person to sign off before anything leaves the building.
Where a person checks AI output before it reaches a client, a regulator, or a public channel, and what that reviewer is accountable for.
What gets logged when AI is used in client work, so the business can answer questions about how a piece of output was produced.
One document your team can actually read, written for the way your business operates rather than copied from a template built for somewhere else.
The deliverable
The output is a working document, not a compliance artefact filed and forgotten. It is written around how your business operates, so the approved path is also the practical one.
We establish which AI tools are already in use across the team, on what information, and with whose approval. Most businesses find more than they expected.
Leadership decides what data can touch which tools, and where a person has to review output before it goes out. Caydev frames the options and the trade-offs.
The decisions become a single written document with approved tools, data rules, approval points, and review steps, in language the whole team can follow.
We brief the team, answer the practical questions, and agree how the policy gets revisited as tools and business needs change.
AI governance is the set of rules that says which AI tools your business approves, what information those tools may be given, who signs off before AI output is used in client work, and how that use is recorded. It turns informal habits into a written policy people can follow.
Shadow AI is staff using AI tools that nobody approved, on data nobody classified. It is rarely malicious. People adopt a tool because it helps them work faster, and nobody owns the risk until something goes wrong.
The size of the business matters less than the sensitivity of the information. If your team handles client data, contracts, or financials, a written boundary is worth having before an incident forces the conversation.
No. Caydev builds the operational policy: approved tools, data handling, approval points, and human review. Where a decision needs a legal or regulatory opinion, we flag it so your counsel or compliance function can take it. We do not offer legal advice or compliance guarantees.
That is not the aim. A policy that only says no gets ignored, which recreates the original problem. The point is to make the approved path the easy path, so people can use AI on the work where it helps without guessing about the boundaries.
Governance is one of the areas a readiness assessment examines. If your main concern is uncontrolled AI use today, the governance engagement addresses it directly. If you also want a prioritized view of where AI could help, the readiness assessment is the wider piece of work.
Get the approved tools, the data boundaries, and the sign-off points written down while the decision is still yours to make.