Say yes to new tools, and know what they do with your data.
We find every AI tool your team uses, set rules for what each one may touch, and enforce them in your Microsoft 365. So when the board or a client asks, you have the answer.
In plain words
Governance you can actually run.
Not a sixty-page policy nobody reads. Four things that let you say who is using what, on which data, and who checked it.
-
01
Find
Every AI tool and feature in use: bought, built, or switched on by a vendor without anyone asking.
-
02
Rate
What data each one touches, where that data goes, and what it costs you if the output is wrong.
-
03
Control
Who may use what, on which data, with what review. Set in your Microsoft 365 tenant, not only on paper.
-
04
Prove
Evidence, staff sign-offs and disclosure text, ready when the board, an auditor or a client asks.
Ready when someone asks
Where the exposure sits
The risk is rarely the tool you bought.
It's the ones nobody wrote down.
-
Personal accounts
Client documents pasted into free AI tools on personal logins, outside anything you control or can see.
-
Features you didn't switch on
Vendors adding AI to the finance system, the payroll provider and the CRM, under terms that changed at the last renewal.
-
Copilot sees what you can see
Copilot follows your file permissions. If SharePoint is shared too widely, it will happily summarise the salary spreadsheet for whoever asks.
-
What your clients allow
Clients now ask what AI touches their data. The answer differs by contract, and it needs to be on file before someone asks.
-
Personal information
POPIA applies to what goes into an AI tool as much as anywhere else, including its limits on decisions made by automated means alone.
-
Output nobody checked
AI-drafted work leaving the building under someone's name, with no review step and no record of what the AI was given.
What we put in place
A record your board can rely on.
Built in the Microsoft 365 tenant you already pay for, kept current, and owned by you. King V asks boards to govern technology, information and AI. This is the smallest way to do that well.
AI register
Every AI system in use, with an owner, its purpose, the data it touches and where that data goes.
Risk ratings and controls
A rating per entry and the controls that apply: approval, human review, data handling, vendor terms, monitoring.
Acceptable-use policy
Short, plain and signed by staff, with an approved tool to use instead, so people stop reaching for personal accounts.
Controls in your tenant
Sensitivity labels, data-loss rules, access reviews and a permissions clean-up before Copilot goes wider.
Client data positions
For each client, what their contract allows AI to touch, so the team knows before they start.
Board and disclosure text
An AI governance summary drawn from the register, ready for the board pack and the integrated report.
How it runs
Start with what's already there.
-
Step 1
Baseline
We find the AI in use, rate it, and read your current policies and client contracts against it. You get the register, the gaps, and a short list of what to fix first.
-
Step 2
Put it in place
Policy written and signed, controls set in your tenant, an approved tool rolled out, and the register handed to the person who will own it.
-
Ongoing
Keep it current
New tools assessed as they arrive, a regular review of the register, and the board summary refreshed each cycle. Or we train your team to run it.
We do this on ourselves.
We run our own business with AI agents, so we keep the same records you'll get. The method you get is the one we use.
See the agents we run- AI register
- Risk register
- Supplier register
- Acceptable-use policy
FAQ
AI governance, answered.
The short version. We'll go deeper on the call.
We only have Copilot. Do we need this?
A smaller version, yes. Copilot can reach whatever each user can reach, so tidying file permissions before a wider rollout is often the first and most useful job.
Will this stop my people using AI?
The opposite. A clear policy with an approved tool is what moves people off personal accounts and gets them using AI where you can see it.
Are you auditors or lawyers?
No. We build the record, the controls and the tooling. How you apply King V and what you disclose are decisions for your board, taken with your legal and assurance advisers.
Does it have to be Microsoft?
We build in Microsoft 365 because most of the businesses we work with already own it. If you run on something else, we'll talk it through.
Find out where AI is already in your business.
We'll run the inventory, show you what's exposed and what's fine, and hand you a register you can keep.