Staff are using AI with no rules
People found the tools themselves, and the useful ones spread by word of mouth. Nobody wrote down what is allowed.
Output quality varies by whoever produced it.Responsible AI governance setup
Scale AI with rules your team can actually follow
Your staff know what they may and may not do with AI, and you can prove it to an auditor. You receive the policy, the risk tiers, the approval paths, the data boundaries, the review rules and the incident process, written for the people who have to follow them.
Where the exposure comes from
AI risk grows with adoption, and adoption is already happening
By the time governance is raised at leadership level, AI is usually in daily use in three or four teams. Six patterns show up in the gap between the two.
Client data is going into prompts
The fastest way to get a good answer is to paste the real document in, so that is what happens.
Data leaves your control, and you cannot say where it went.Approval authority is undefined
No one has said which AI-assisted decisions need a person to sign off and which do not.
Work ships that nobody agreed to.Tools and models have multiplied
Different teams pay for different assistants, on different terms, holding different data.
No accountability for what runs where.There is no incident path
When AI produces something wrong in front of a client, the response is improvised by whoever notices.
Problems get found late and fixed twice.You cannot prove any of this to an auditor
The controls may exist in practice, and none of them are written down in a form anyone outside the team can read.
A due-diligence questionnaire stalls the deal.What you receive
Nine documents your team runs on and your auditor accepts
These are working documents, not a policy binder. Your staff read them to know what to do, and you hand them to a client or a regulator who asks how AI is controlled here.
- AI Acceptable Use Policy
- What your staff may and may not do with AI, written so the people it applies to can follow it without a training session.
- AI Use-Case Register
- Every approved and proposed AI use in the organization, in one list, with an owner against each.
- Risk Classification Matrix
- Tiered risk with the controls that match each tier, so a low-risk use is not held to the same gate as a client-facing one.
- Vendor and Model Register
- Which tools and models are approved, what data each may see, and what you agreed to when you signed up.
- Human Review Rules
- The points where a person has to approve or correct output before it goes anywhere, named by role.
- AI Security Checklist
- The baseline technical and operational controls, in a form your IT function can action.
- Incident Response Process
- What happens when AI causes harm or a near miss: who is told, who decides, what gets recorded.
- Governance Maturity Baseline
- Where you stand today, measured, so the next review has something to compare against.
- Executive Governance Report
- A leadership view of posture and gaps, in the format you would put in front of a board or a client asking hard questions.
Price and duration
Two ways in, depending on how much AI is already running
Where you land follows the number of teams using AI, how sensitive the data is, and whether anything client-facing is already live.
Conformance audit
$2,500 to $5,000
About 3 weeks
A review of AI use already happening in your business, against a defined control set. Take this when you need to know your exposure before deciding what to fix.
- AI Use-Case Register
- Risk Classification Matrix
- Governance Maturity Baseline
- Executive Governance Report
Guardrails retrofit
$5,000 to $15,000
4 to 8 weeks
The full governance baseline, built and handed over. Take this when AI is already in use across teams and the rules have to exist before it spreads further.
- Everything in the audit
- AI Acceptable Use Policy
- Vendor and Model Register
- Human Review Rules and incident process
Governance is also built into every AI-enabled or agentic system we deliver, so the risk classification and guardrails that a FusionBuild engagement needs are already inside its price. Buy this separately when AI is running in your business ahead of anything we built.
Proof
Two engagements where the rules came first
AI enablement for an investment management firm
A regulated firm rolled AI out across research, compliance and client engagement. Governance and regulatory requirements specific to financial services shaped the rollout rather than following it.
3-phase adoption model 6 months to full rollout
Read the case study AI sales intelligence for a safety products distributor
Three agents went into a live sales territory. The review points where a person has to check the output were designed before the agents were built.
Human-in-loop governance model 3 agents built and deployed
Read the case study Fit
Whether governance is your next spend
Start here if
- Your teams are already using AI and you want rules before it spreads further
- You handle client, personal or regulated data and AI is touching it
- Something AI-assisted is going in front of clients
- A client or insurer has started asking how you control AI
- You need a defensible position before signing off build investment
Start somewhere else if
- Nobody is using AI yet and the question is where it would help. Go to FusionMap.
- We are building the system, in which case the controls come with it. See FusionBuild.
- Your people understand the rules and cannot apply them to real work. Go to AI Systems Mastery.
- You want a free read on where you stand first. Take the AI readiness assessment.
After the baseline
Where governance work usually leads
Rules on their own change little. What follows depends on whether the constraint turns out to be the system, the people, or the scope of what you are trying to run.
Scale AI without scaling the risk
Bring what your teams are already doing with AI. We will tell you which parts need a rule this quarter and which can wait.