Skip to content
TrustLed AIBook a consultation
Home / Impact / Case study
AI Governance AdvisoryPolicyPrivate sector

Shaping an Acceptable AI Use Policy for a Growing Private Sector Firm

Customers had started asking how the firm governed AI, and nobody had a written answer. TrustLed AI helped leadership put one in place: a clear policy, a simple route for approving new tools and a staff launch that made the rules easy to follow.

1Board-approved Acceptable AI Use Policy
3Tier model for approving AI tools
[00]Staff briefed at launch

Overview

The firm had grown quickly, and so had its use of AI. Teams were drafting proposals with writing assistants, recording client calls with AI transcription tools and using code assistants to speed up development. Each tool had been adopted by an individual or a team, and leadership had no single view of what was in use.

The trigger for action came from outside. Larger customers began adding AI questions to their supplier due diligence, asking how the firm controlled its use of AI and protected their data. Leadership wanted a policy that would answer those questions with confidence and still let staff benefit from tools that were saving them real time.

The challenge

  • Client contracts with confidentiality terms that unmanaged AI use could breach
  • Customer due diligence questionnaires asking about AI governance, with no documented response
  • Staff using personal AI accounts for work, outside the firm's security controls
  • No named owner for decisions about which AI tools the business could adopt
  • Uncertainty about how data protection law applied to personal data processed by AI tools

Our approach

Franklin Okeke led the engagement for TrustLed AI. We began by listening: interviews with each department head and a short anonymous staff survey gave us an honest picture of which tools people used, for what tasks and with what kinds of data. We then assessed the risks against the firm's contractual commitments, applicable data protection law and the controls set out in ISO/IEC 42001.

From those findings we drafted an Acceptable AI Use Policy written in plain language, built around four pillars:

Three-tier tool modelEvery tool sits in one tier: approved, approved with conditions or not permitted.
Data rulesClient, personal and commercial data each carry clear limits on which tools may process them.
AccountabilityA named policy owner, a request route for new tools and review requirements for AI-assisted client work.
Disclosure and incidentsWhen to tell clients AI was used, and how staff report a mistake or data exposure.

Before finalising, we tested the draft with managers in a workshop built on real scenarios from their own teams. Their feedback sharpened the wording and removed steps that would have slowed people down.

How we delivered

  1. 01

    Discover

    Interviews and a staff survey mapped every AI tool in use and the data each one touched.

  2. 02

    Assess

    We weighed each use against client contracts, data protection law and ISO/IEC 42001 controls.

  3. 03

    Draft and test

    We wrote the policy and refined it with managers using scenarios from their own work.

  4. 04

    Launch and embed

    The board approved the policy, and we briefed staff with a one-page quick guide.

Results

The firm now has a board-approved Acceptable AI Use Policy, a named owner for AI decisions and a simple route for approving new tools. Staff know which tools they can use and what data must stay out of them, and work that once ran through personal accounts has moved onto approved tools.

When customers ask how the firm governs AI, the commercial team can now share a documented policy and explain the controls behind it. An annual review keeps the policy in step with new tools and regulation.

[Short quote from the client's managing director or operations lead.]

[Title, private sector firm]

Need an AI use policy your team will follow?

We can help you write one, test it and launch it with your staff.

Book a consultation