AI Governance & Safe Adoption Review
Your people are already using AI. The question is what they are putting into it.
In most firms, AI arrived before anyone decided anything. Someone drafts client emails with it. Someone pastes in a contract to summarise. Someone signs up for a free tool with a work address. None of it is malicious, and none of it is written down.
This review finds what is actually in use, works out where your data is going, and gives you an approved way to use AI that your people will follow because it is easier than the workaround. Fixed fee, two to three weeks, and you finish with a policy, a register and a 90-day plan.
Why owners ask for this
Client and staff data
Privacy law already applies to personal data put into an AI tool. Hong Kong’s privacy regulator has published its own model framework for organisations using AI, and Singapore and Australia have equivalent guidance. If a client asks what you do with their information, “we are not sure” is not an answer.
Confidential material
Tenders, pricing, contracts and board papers are exactly what people paste in to save time. Whether that material is stored, or used to train a model, depends on which tool, which plan and which setting.
Clients and auditors are asking
Larger clients, insurers and auditors increasingly put AI on their questionnaires. A written policy and a register turn an awkward question into a one-line answer.
Getting the benefit safely
Banning AI does not work; people use it on their phones instead. The aim is the opposite: an approved way to use it that is safe enough that people can use it more.
What the review covers
-
What is actually in use
A short, no-blame survey and a look at accounts, browser tools and subscriptions. Most firms find more tools than they expected, and a few on personal accounts.
-
Where your data goes
For each tool: what goes in, where it is stored, whether it trains a model, and who can see it. The sensitive workflows — client data, HR, pricing, legal — flagged first.
-
The rules, in plain English
Approved tools, what data may go into each, where a person must check the output before it is used, and who to ask. Short enough that people actually read it.
-
Vendor and settings check
The right plan and settings on the tools you keep, so training is switched off and access is controlled — and a short checklist for judging the next tool someone wants.
-
Training and a 90-day plan
A working session for staff by role, and a prioritised plan: what to switch on, what to switch off, and the two or three uses that will save the most time safely.
What you get
- An AI use policy written for your business, not downloaded
- An AI register — every tool, what it is used for, what data it touches, who owns it
- A risk list with the sensitive workflows marked and what to do about each
- A vendor checklist for the next tool someone asks for
- Staff training, by role, delivered live
- A 90-day plan with owners and dates
Measured at the end the same way as everything else here: tools on the register against tools found, staff trained, sensitive workflows with a person checking the output, and hours saved by the approved uses.
What it is not. This is an operational review, not a legal opinion. Where a question needs a lawyer, I will say so and you will know exactly what to ask them.
What you are not risking
Defined before it starts. Yours when it ends.
A price before any work
Scope, deliverables and a fixed fee agreed in writing first. If the job turns out different, we stop and re-scope. The bill does not run.
Small first, then decide
Larger work runs in stages, each scoped and paid before it begins, so you can stop after any stage. AI work starts as a pilot with a success measure agreed up front.
Your data, your accounts
Systems stay in your name and your admin access stays with you. Your material is not used to train anyone’s model.
A proper handover
Documentation, credentials, settings and a handover session, so it keeps running without me. Ongoing help is available, never a condition.
The HK$888 ThinkSmart Diagnostic is credited in full against a package taken within 30 days. Full terms: Terms, Privacy & AI Policy.
Why me, rather than a template
I build AI systems that run in real businesses, under human sign-off, with every figure labelled as verified or not. That is the same discipline this review puts into your firm. I also know where the tools fall short, because I have had to work around it on live client work.
And because I am not selling a particular AI product, the recommendation is whichever tool fits how you work — including keeping what you already pay for.
Not sure what your people are using?
That is the normal starting point. A short call is enough to scope the review.