AI governance for organizations of 50 to 500

One safe, consistent way for your whole company to use AI.

I find out how your team really uses AI, then write guidance that meets the regulations that apply to you and that people actually follow.

Book a 30-minute call See how it works

The questionSample rule

“Can I paste this interview transcript into Claude to pull out themes?”

Rule 4.2 · Client research

Yes, in the company workspace, once names and identifying details are out.

If the client contract says no AI, the answer is no. If you’re not sure what the contract says, check with your project lead before you start.

What every rule in your guidelines looks like: a plain answer, the condition, and who to ask.

Your team is already using AI. The question is whether the business can see it.

In most organizations, AI use has grown faster than anyone’s documentation of it, and much of it isn’t happening where the business can see it. In a 2026 survey of office professionals at companies with $500 million or more in revenue, two-thirds said they’d used AI tools at work despite believing company policy didn’t allow it, and 88% had shared work information with public tools like ChatGPT, Claude or Gemini (PagerDuty, June 2026). When that information is client material (34% said they’d entered customer data), the exposure belongs to the company, whoever typed it in.

None of that means anyone has done something wrong. It means the business doesn’t have one consistent way of working yet, and that’s a very fixable problem.

Why heavier rules don’t solve it

A large international institution published an AI policy it was proud of. Getting a $100-to-$200-a-month tool approved took a use-case proposal, a senior sponsor, a working group review and an architecture board, and clearance could take a year.

So staff bought their own subscriptions and did the work there, which means the institution’s work now sits on accounts it doesn’t control (and it may not own what its people built). Workarounds like this are common even where a policy exists: in the PagerDuty survey referenced above, 86% of office professionals said their organization has an AI policy, yet two-thirds had used AI tools they believed the policy didn’t allow. A policy people can follow is a policy that gets followed; that’s the design principle behind everything here, and it’s why the work starts from how your team already uses AI rather than from a template.

How it works

Rules that work in the day-to-day moments

Every rule gets tested against an ordinary working moment: someone on deadline with a question and no time to look it up. If the rule can’t help them then, it gets rewritten, because that’s the rule people will work around. Each one answers four questions.

Q1Can I do this?

Q2What should I be careful about?

Q3When do I need help?

Q4It isn’t covered. How do I think about it?

01
Start from how AI is used today
A short survey and a handful of interviews show what your people use, what they use it for and on whose account. It isn’t an audit of individuals, and people tend to be candid once they can see that.
02
Read what applies to you
Your client contracts and your regulatory exposure, read against that real use. The EU AI Act, Colorado, Illinois, Texas and the NIST AI RMF come in only where they reach you (if you use automated tools in hiring or other significant decisions about people in Colorado, new duties begin January 1, 2027).
03
Write the rules in your organization’s language
Every engagement opens with a brief on your disciplines and your domain, so a design research team gets examples about interview transcripts and funder reports, and a bank gets examples about loan files and vendor models. The rigor underneath is the same; the examples are yours.
04
Train for judgment
Literacy training built from your team’s real work, where people practice the decisions they’ll face, including the ones no rule covers. There’s no click-to-attest.
05
Keep it current
Six kinds of change trigger a review between annual cycles (a new tool or vendor feature, a new use of client data, a change in client contract terms, a material model change, an incident or near miss, and a regulatory change), so the rules move when your work does.

What changes for the business

BeforeAfterA client’s AI questionnaire sends people scrambling.You send the policy and the risk register, and they hold up.People use AI quietly, on their own accounts.They use it openly, on accounts the company owns.AI-drafted work goes to clients without anyone checking it.Every AI-assisted deliverable has a named reviewer, because whoever signs it owns it.Your insurance renewal asks about AI, and nobody’s sure how to answer.You answer from a current inventory and policy, and you know which exclusions to raise with your broker.

Where this was built

The approach was first built somewhere the stakes were high.

I built the AI governance framework for an international design research consultancy that works under GDPR, with and about socially vulnerable communities, for global health funders (so client and participant data couldn’t go anywhere near an AI tool without clear rules). The work included a staff survey, guidelines that now sit in the company handbook, and literacy training written for people who already use these tools well. Their EU counsel reviewed it and said it went beyond what was needed.

15 yearsin global operations, contracts and vendor relationships

M.Ed.trained in experiential learning, so training changes what people do

US, Finland and Indialived and worked in all three, with teams around the world

Daily AI userwhich is why the rules respect the people who use it

Hi, I’m Jen!

I’m an operations person at heart. Hand me something sprawling and half-working and I’ll want to know how it should work, and then I’ll want it to be beautiful.

I came to governance through international relations and education, which taught me the thing most policies miss: a rule doesn’t work because someone wrote it down. It works when the person reading it understands what it means for them, in their job and their context.

I live in New York, I’ve lived and worked in Finland and India, and I work with teams around the world. I use these tools every day, and I find this work fascinating, which helps, because the ground keeps moving.

Ways to work together

Engagements run from a diagnostic through a full governance build, with ongoing support after, so the guidance keeps up as the tools change. Every engagement is a fixed fee, agreed in writing before any work begins. The figures below are where each one starts, and what moves yours is mostly the size of your organization, how many entities and countries it spans, and how heavily regulated the work is, so you’ll know where you land before you commit to anything.

Start here if you’re not sure

Diagnostic

$18,000

Survey, AI inventory, applicability memo and a prioritized findings report. The full fee credits toward the Build if you start within 60 days.

Where most organizations land

Build

from $60,000

The full governance: survey and interviews, AI inventory, applicability memo, risk register, a policy written in your language, literacy training for your team, and a leadership report with a forward plan.

For several units or jurisdictions

Enterprise

from $95,000

For organizations with several entities, operations in more than one country, or heavy regulatory exposure. Your fee is set after a short scoping conversation, and it’s final once it’s in writing.

Literacy Training Day

One day of scenario-based AI literacy training, built from your team’s real work.

$12,000

Jen in Residence

Year-round access when a new tool, contract clause or question shows up, reviews when a trigger fires, and an annual review and update.

from $6,500/mo

If your counsel reviews the risk register and finds a material gap in the obligations mapping, I’ll revise it until they sign off, at no additional fee.

Questions people ask

Before you book

What is AI governance for a company our size?

It’s the set of decisions, documents and habits that let an organization use AI consistently and safely: which tools are approved, what data can go into them, who owns the risk, and how new questions get answered. For a team of 50 to 500 it should fit in a policy people can read in one sitting, backed by a risk register leadership can stand behind.

Do we need an AI policy if we’re not in the EU?

Possibly. The EU AI Act can reach organizations outside the EU when their AI systems or outputs are used there, and several US states now have their own rules (Colorado’s rules on automated decisions about people, including hiring, take effect January 1, 2027). Client contracts are often the bigger driver, since more of them now ask how suppliers govern AI. The Diagnostic tells you which of these apply to you.

What’s the difference between the Diagnostic and the Build?

The Diagnostic tells you where you stand: how AI is used today, what applies to you and where the real risk sits, in a prioritized findings report. The Build turns that into the full governance: policy, risk register, rules in your language and training for your team. The Diagnostic fee credits in full toward the Build if you start within 60 days.

Why might my price differ from the one on this page?

Because the page can only show where a typical engagement starts. A 40-person firm with one office and a 900-person organization working in four countries are different amounts of work, and charging them the same would be unfair to both. You’ll have your exact number in writing before anything begins, and it doesn’t change once you’ve agreed to it.

Will governance slow our team down?

It shouldn’t, and if it does, it isn’t finished. The work starts from the tools and habits your team already has, and every rule is written to be followed in the moment someone needs it. When the approved path is also the easy one, people take it, which is what keeps company work on company accounts.

Does our AI use affect our insurance?

It can. ISO, which writes standard policy language many insurers use, now offers a generative AI exclusion for general liability policies (form CG 40 47, January 2026 edition), and it’s beginning to appear on renewals (Gallagher). What that means for you depends on your policies, so the Diagnostic maps how your team uses AI and flags the questions to take to your broker.

Do you work with organizations outside New York?

Yes. I’m based in New York and work with teams around the world, remotely or in person as the work requires.

Tell me what’s happening.

If AI use at your organization has outgrown your documentation of it, I’d love to hear about it. Thirty minutes is usually enough for me to tell you what I think needs to happen, including when the honest answer is that you don’t need me yet.

Book a 30-minute call

Rock on,
Jen