What the six areas mean
- Governance & Policy: whether there is a written list of approved AI tools and an acceptable-use policy that staff have actually acknowledged.
- Data Protection: whether people know what never goes into a prompt, and whether technical controls back that up on company devices.
- Visibility & Shadow AI: whether you know which AI tools are in use today, including the AI features vendors have switched on inside software you already pay for.
- Secure AI Tooling: whether the business runs on a business-licensed AI plan with single sign-on, data-training opt-out and proper offboarding, instead of personal accounts.
- People & Training: how many staff have had formal AI training, and whether there is a way to capture the time savings they find.
- Leadership & Risk: whether leadership has defined what AI should accomplish, assessed the risks, and planned for when something goes wrong.
Why this matters now
Most AI incidents at small businesses are not sophisticated. A contract gets pasted into a free chatbot for a summary. A patient list goes into a personal account for cleanup. An AI note-taker joins a meeting nobody vetted it for. None of that requires a hacker, and none of it shows up until a client, an auditor or an insurer asks.
At the same time, the businesses that set up AI correctly are saving real hours every week. The gap between the two groups is rarely budget. It's whether anyone wrote the rules down, turned on the controls they already pay for, and trained the team.
What happens when you ask for the written plan
- We review your answers and the tools your business already uses.
- You get a written 90-day plan within one business day: the policy, the controls to switch on, the training, and the order to do them in.
- If you want us to do the work, we tell you the price up front. If not, the plan is still yours.
