← All programs Program · AI Governance & Security

AI governance for firms whose people are already using AI

Guardrails around ChatGPT, Copilot, Claude, and the AI built into the tools you already pay for, put in place before a client, auditor, or incident asks how you control it.

Schedule a Strategic Discussion Common questions
Principal-led advisory, backed by KJ Technology's team since 1998 Serving the New York tri-state area

When firms call us about AI governance

  • A client, insurer, or regulator asked how you control AI use, and there wasn't a good answer.
  • Staff are pasting client documents into ChatGPT or another personal AI account.
  • You turned on Copilot or another AI feature and aren't sure what it can see.
  • Partners disagree on whether AI is allowed, so everyone is quietly making their own rules.
  • A due diligence or vendor questionnaire asked for your AI use policy.
  • You want people using AI more, not less, and need clear lines to make that safe.

How the program works

Every program starts with a defined first step, so you know the scope, timeline, and deliverables before anything begins.

Start with: A review of how your firm uses AI today

Typical length: 2–3 weeks

  • An inventory of the AI tools actually in use, including the ones nobody approved
  • An approved-tool list, and data boundaries: what must never go into any AI tool
  • Secure AI workspace setup: Claude, Copilot, or ChatGPT business plans configured with the right data controls, admin settings, and access
  • High-risk uses mapped to a named human owner, with human review on client-facing work
  • A written AI use policy, an incident path, and staff acknowledgment
  • Staff AI training, so people use the approved tools well and know where the lines are

Then

Quarterly governance reviews, settings checks as vendors change their defaults, and training as tools and people change. Each review ends with a one-page governance snapshot for leadership.

Discuss this program →

What AI governance means for a firm your size

For most firms, AI governance isn't a committee or a framework document. It's a short set of clear answers: which tools are approved, what client information never goes in, who reviews AI-assisted work before it reaches a client, and what happens when something goes wrong.

The risk usually isn't the AI itself. It's staff using personal accounts that may keep or train on what they paste, business tools left on default settings, and no record of who decided what. Governance closes those gaps so people can use AI with confidence instead of guessing.

Client work

What the work looks like

What each client needed, and what we did about it.
AI Solutions + AI Governance

Recovering billable time, with every timekeeper in control

The need: revenue the firm had already earned but never billed, because calls, emails, documents, and internal chat didn't make it onto a timesheet.

The design turns that activity into suggested time entries in each timekeeper's own account. Each person reviews and approves their own entries, which then flow to billing, so the firm recovers the revenue and everyone stays in control of their own time. A privacy charter and a buy-versus-build comparison come first, and a small pilot ends at a go/no-go decision.

AI Solutions

From internal AI experiments to numbers finance can rely on

The need: commission reporting that finance could trust, from AI tools the team had already started building on its own.

We defined the production architecture, access, and sensitive-data boundaries; worked with the accounting system's consultants on read-only data access; and scoped a pilot that is tested against known-good results, with human review, before anyone relies on it.

Advisory

Security on the agenda every quarter

The need: keep security a leadership decision, not an IT task that only comes up after something goes wrong.

Our managed clients get a quarterly strategic business review that covers security risks and actions alongside projects and roadmap, so security is a standing leadership topic, not an annual scramble.

Firms where client trust is the business

Financial services

An AI use policy written for advisers, approved tools configured so client data stays protected, and a record of who reviews AI-assisted client communications.

Family offices & private clients

Clear rules for AI use across the office and the family, with business tools configured so private information stays private.

Law firms & professional services

An AI use policy written for lawyers and staff, approved tools with confidentiality-appropriate settings, and review of AI-assisted work product.

Common questions

Do we need an AI use policy if we're a small firm?

If anyone at the firm uses AI with client or company information, yes. It doesn't need to be long. A clear one-to-two-page policy, an approved-tool list, and a short training session cover most of the risk for a small firm.

Will governance slow our people down?

It shouldn't. The goal is clear lines (approved tools, what never goes in, who reviews what), so people can move faster with confidence.

Should we just block ChatGPT?

Blocking rarely works: people switch to their phones or personal accounts, and the firm loses visibility. It's usually safer to approve a business-grade tool, configure it properly, and make the lines clear.

Is our data used to train AI models?

It depends on the product and the plan. Many consumer plans may use conversations to improve models unless that's switched off; business plans generally don't by default. Checking and setting this is part of every engagement.

Which AI tool should we standardize on?

It depends on what you already run and what your people need. Firms on Microsoft 365 often start with Copilot; others choose ChatGPT or Claude business plans. We compare them against your data, workflows, and budget, and we don't resell any of them.

How long does it take?

The first review usually takes two to three weeks, and you'll have a written policy, approved tools, and a plan at the end of it.

Other programs

Cybersecurity & Governance

A written information security program, incident response plan, and continuity plan that satisfy regulators, insurers, and demanding clients, and fit how your firm actually works.

AI Solutions

Micro-SaaS client solutions: purpose-built tools for one workflow your team does by hand every week, designed with privacy and human review from the first conversation.

Principal-Led Advisory

Fractional AI and technology leadership for firms that don't need a full-time CTO, senior backup for internal IT teams, and one-on-one AI coaching for leaders.

How does your firm score on AI governance?

The AI Governance Checklist for Firm Leaders: eight questions we ask in the first week of every review. Three minutes to your score and the gaps worth closing first. We'll email you the link.

Also free: cybersecurity and compliance assessments →

Talk through where AI and security fit in your firm.

Thirty minutes with a principal, not a sales pitch. We'll map the opportunity and the guardrails together, and tell you honestly what a sensible first step looks like.

Book a 30-Minute Discussion

Prefer email? info@kjtechnology.com

Or tell us a little first, and we'll come prepared.

Add industry, firm size, and timeline (optional)