An inventory of the systems your organization runs and how they connect, from your CRM or case management platform to Microsoft 365 or Google Workspace, with the AI features already switched on inside each one flagged. Many organizations discover AI is already operating in tools they’ve had for years, whether or not anyone chose to turn it on.

A map of what data you collect and hold, how it flows through your systems, and what sensitivity level applies, with particular attention to client records, health information, and other protected data. We identify where AI tools may be ingesting, processing, or storing that data, so your data governance starts from what is actually happening rather than what the org chart suggests.

A structured read of where your organization sits today: leadership understanding, staff skills and confidence, governance in place, data and infrastructure readiness, and culture. It gives you an honest baseline, a plain answer to “are we behind?”, and a way to measure progress a year from now.

We read the policies you already have, including acceptable use, data privacy, procurement, records retention, and IT security, and flag where AI creates gaps those policies weren’t written to cover. Often the answer is a targeted amendment rather than a new document; sometimes it’s the reverse. The review tells you which.

A survey and, where useful, interviews or focus groups to learn how staff are actually using AI (including personal accounts and tools that never went through IT), what they’re worried about, and what they need. This is where shadow AI use surfaces, and it is often the finding that gets leadership’s attention. Depending on your organization, we extend it to the board, partners, and the communities your work impacts.

A plain-language summary of the rules that apply to your work, from state legislation like Colorado’s AI Act and emerging bills in other states to federal agency guidance, data protection laws like HIPAA and FERPA where relevant, and international frameworks like the EU AI Act. We pair it with a look at how comparable organizations in your sector are approaching AI governance, so your framework is informed by real practice, not just theory.

We assess current or prospective AI tools and vendors against criteria that matter for mission-driven organizations: bias and equity, transparency and explainability, data practices and privacy protections, accessibility, and alignment with your values and the populations you serve. This includes how vendors collect, store, and use your data, whether your data may be used to train models, what retention and deletion practices are in place, and whether data handling meets the sensitivity requirements of the populations you work with.

We help you determine who should oversee AI decisions and how those decisions connect to your existing leadership, ethics, and program structures. We also develop a practical framework for evaluating AI tools and use cases based on both operational risk and ethical implications, including equity, accessibility, and algorithmic bias. This includes defining data governance roles and responsibilities: who owns data quality for key data domains, who reviews data handling practices before a new AI tool is approved, and how data stewardship connects to your existing compliance and program accountability structures.

Not every AI application carries the same risk. We help you categorize potential use cases by sensitivity level so your governance is rigorous where it matters most and streamlined where it doesn’t, avoiding unnecessary overhead while maintaining accountability where it counts.

We create a phased plan for policy development and adoption that reflects your organization’s capacity, culture, and timeline. This includes defining incident response and risk mitigation protocols so your team knows exactly how to identify, escalate, and respond to AI-related issues before they become crises.

Clear, jargon-free acceptable use guidelines for how staff can and can’t use AI tools in their daily work. Data privacy frameworks that work alongside your data governance policies (see below) to ensure staff understand what data can and can’t be shared with AI tools and under what conditions. Vendor procurement criteria with the right questions to ask about bias, transparency, and data practices. And ethical use principles that anchor AI decisions in your mission, informing how decisions are made, not just what you say about them.

A dedicated framework for how your organization identifies, classifies, manages, and protects data throughout its lifecycle, especially when AI is involved. This covers data classification standards that define sensitivity tiers and handling requirements for different types of information. Data quality standards that establish expectations for accuracy, completeness, and representativeness before data is used in AI systems. Data lifecycle policies that address how data is collected, stored, shared, retained, and deleted, including what happens to data processed by third-party AI tools. Clear data ownership and stewardship responsibilities so there is always an accountable person or team for each critical data domain. And data flow documentation so your organization understands where data goes when it enters an AI system, whether that’s an internal tool or a vendor platform.

Documentation and disclosure practices needed to demonstrate compliance with emerging AI legislation at the state, federal, and international level. We also help you develop public-facing or community-facing transparency reports that communicate how your organization uses AI, what safeguards are in place, and how stakeholders can raise concerns.

If your organization funds, certifies, or sets expectations for others, we help you develop policies for how AI expectations are communicated to funded partners, grantees, or certified organizations, including responsible use standards and reporting requirements that reflect your values.

Interactive workshops and learning sessions that help your team understand AI concepts, recognize risks, and apply your policies in real scenarios. We also offer tailored briefings for boards, executives, and other decision-makers, equipping them with the knowledge to provide meaningful AI oversight without requiring technical expertise.

We test your governance framework on a real use case, walking through the full evaluation, approval, and monitoring process so your team builds confidence and identifies gaps before scaling. This includes testing your data governance practices in action: verifying that data classification, quality checks, and vendor data handling requirements hold up when applied to a real tool and real data. This is often where governance moves from abstract to actionable.

We establish monitoring and review protocols with built-in feedback loops and update cycles that keep your policies current. For organizations that want continued partnership, we offer retainer-based advisory support for policy questions, vendor evaluations, incident response, and regulatory updates as the landscape evolves.