SUPERWISE services

AI governance and controls

For teams that need policies, ownership, controls, and reporting that people can actually operate.
$20,000 to $50,0004 to 8 weeks
Talk to us about this

Outputs you keep

AI acceptable-use policy

AI use-case inventory

Risk and controls register

Approval and change workflow

What you get

Working outputs, not a presentation about them

Give everyone one workable set of rules for using AI, with named owners and evidence leaders can review.

AI acceptable-use policy

A plain-language policy covering approved uses, prohibited data, human review, exceptions, and employee responsibilities. Publish one answer for staff and update it as tools, risks, and business needs change.

AI use-case inventory

A working register of the AI uses in scope, their purpose, owners, data, users, and current approval state. Know what is operating, find unowned uses, and decide which use cases need review first.

Risk and controls register

A record for up to five use cases that connects identified risks to preventive, runtime, and follow-up controls and their evidence. Review whether controls are working and show why a use case was approved, restricted, or stopped.

Approval and change workflow

An intake, review, exception, and change process with decision criteria and required records. Move requests to a documented decision without inventing a new process for each tool or project.

RACI and escalation path

A responsibility map naming who recommends, approves, operates, reviews, and receives escalations. Route routine decisions and urgent issues to the right person without ambiguity.

Leadership reporting pack

A board and executive template for use-case status, material risks, exceptions, control performance, and decisions due. Run a consistent oversight meeting and retain a record of leadership review.

Governance operating guide

The review calendar, meeting inputs, evidence checklist, document owners, and instructions for maintaining the framework. Keep the program operating after handover instead of leaving the policy as a one-time document.

Outcomes

What will we have at the end?

People know what is allowed

Staff can tell which AI uses are approved, what data they may use, and when they must stop and ask for a decision.

Every decision has an owner

Business, technology, legal, and compliance teams have a clear approval path instead of passing responsibility between functions.

Leadership can see the risk

Executives and the board receive a repeatable view of active use cases, exceptions, control status, and decisions that need attention.

Examples

What could this look like in our business?

These are examples of suitable work, not claims about past client engagements.

Example: staff already use ChatGPT or Claude

Set acceptable-use rules for public AI tools, define prohibited data, and give staff a clear route for requesting an exception.

Example: a client asks for your AI policy

Produce an approved policy, ownership model, and current control register that your team can use to answer the request.

Example: the board wants AI oversight

Create a reporting pack that shows the use-case inventory, material risks, exceptions, control status, and decisions due.

Example: a regulated workflow is moving beyond a pilot

Map its risks and controls, name the approvers, define the evidence to retain, and test the change and escalation process.

Example: departments buy AI tools separately

Introduce one intake and approval workflow so new tools are reviewed against the same risk questions before use.

Success measures

How do we know it worked?

We agree the measures at kickoff and use them in the final decision.

Measures agreed at kickoff

  • Every in-scope use case has a named business owner and an approval state.
  • The team can complete the intake, approval, exception, and escalation workflow using a real use case.
  • Each in-scope risk is connected to an owner, a control, and the evidence used to review it.
  • Staff can find the approved-use and prohibited-data rules without relying on an informal answer.
  • Leadership can run a review from the reporting pack and identify the decisions due.

Your team

What does our team need to give?

Plan for about 6 to 10 hours across the client team in a typical week, with more time during workflow testing and final approval.

Executive sponsor

Sets the business objective, resolves ownership questions, and approves the final operating model.About 1 hour per week

Governance or compliance owner

Coordinates documents, workshops, reviews, and the people who will operate the process.About 3 to 5 hours per week

Business and technical owners

Explain the selected use cases, data, systems, risks, and current controls, then test the workflow.About 1 to 2 hours per owner during relevant weeks

Legal adviser

Determines which laws, duties, and contractual requirements apply and reviews policy language where needed.About 1 hour during policy and framework reviews

Duration

A build path your team can see

4 to 8 weeks

Week 1

Confirm use cases, obligations, owners, and the current approval process.

Weeks 2–4

Draft policy, controls, risk records, and operating roles.

Weeks 5–8

Test the workflow, train owners, and deliver board-ready reporting.

Data and security

Is our data safe?

How the engagement handles data

  • We agree the systems, documents, and use cases in scope before access is provided, and use client-controlled access wherever possible.
  • We ask for the minimum access needed and do not need production credentials when documents, interviews, or a limited environment answer the question.
  • The governance design states what activity and decision evidence must be retained; the client decides its legal retention requirements with its advisers.
  • Sentinel can apply configured policies and record metadata for supported AI tools, but it does not record prompt or response content and does not cover every browser, device, or AI interaction.
  • The SUPERWISE platform is not covered by a BAA, so protected health information must be kept out of it.

Ownership

What do we own when it is over?

You own the policy set, inventory, registers, workflows, templates, decisions, and operating guide we create for you. If you stop working with us, those files and records remain yours, and your named owners can continue the process without a SUPERWISE services contract.

After the engagement

What happens after?

We close the engagement with a handover and the review calendar in your operating guide. Teams that need to test readiness against a named framework usually move to AI compliance readiness. Teams that want ongoing control operation and reporting can scope managed AI operations under a separate service agreement.

Draft pricing for review

Know the range before the first call

We confirm a fixed scope and price after a scoping call.

TierPrice rangeDurationIncluded in a line
Service$20,000 to $50,0004 to 8 weeksAI policy and approval workflow

Not included

  • Certification, attestation, or a guarantee that the organization complies with a law or framework
  • Legal advice or a determination of which legal requirements apply
  • External audit, certification-body, or regulator fees
  • Software and product subscriptions
  • Ongoing operation of approvals, controls, registers, or reporting after handover
  • More than five use cases or additional business units unless they are added to the scope

Fit

Know whether this is the right starting point

Teams of 50 to 500 people putting AI into regular use

Good fit if

  • For teams that need policies, ownership, controls, and reporting that people can actually operate.
  • Teams of 50 to 500 people putting AI into regular use
  • You want a defined handover your team keeps.

Who delivers and proof

Delivered by the SUPERWISE services team

We do not yet publish a case study for this exact governance engagement. The nearest published example is Renova Health, where SUPERWISE supports managed AI operations; the services team also runs managed AI operations for Boca Raton Regional Hospital. Those examples show ongoing operational work, not a claim that either organization bought this governance package.

AI governance and controls questions

What to expect before you start

The service path

Where this fits

Learn about the decisions

Kits for this work

Get the full kit: policy, quick-reference, and rollout checklist

Free practical kitStart the policy discussion with an editable working template. Download the ten-section policy, one-page employee quick-reference, and rollout checklist.

Score one workflow on evidence

Free practical kitScore whether one workflow has evidence behind its controls. Real governance or theater: a 10-point scorecard. Ten controls from NIST, ISO/IEC 42001, and the EU AI Act, each scored 0, 1, or 2 on records from the last 90 days. Includes a five-minute evidence test, three public cases where the written rule failed, and a fix list for every zero. Nine pages, PDF.

Products this service puts to work

SUPERWISE Sentinel

Sentinel can apply approved rules when staff use supported AI tools.

Talk to us

Tell us about AI governance and controls

A few details help the services team route your request.

Talk to us about thisTake the free Quick Scan