AI Usage Policy
The procurement-ready AI governance baseline: an AI usage policy, an approved-tools list, an evaluation cadence and a risk register - enough to unblock legal and security sign-off.
Fixed-price entry packageAI Governance Starter PackEUR 3,3001 organization · up to 3 weeks from scopingWhat is includedThe smallest set that unblocks
Policy, approved tools, evaluation cadence, risk register: enough for rollout, no shelf-ware.
Accepted by legal and security
Artifacts written in the shape those teams already sign.
A one-pager managers use
The rules fit on one page, so they get read.
23Minds establishes the minimum viable AI governance baseline for organizations rolling out AI internally.
Show the full summary
The engagement produces an AI usage policy aligned to your industry, an approved-tools list with data-handling rules, an evaluation cadence for AI outputs that touch production, and a basic risk register that legal and security teams accept. The baseline stays small on purpose: the smallest set of artifacts that unblocks AI rollout without creating shelf-ware, with no heavy framework attached.
What makes this service defensible.
- Procurement-ready document set
Written to pass a supplier review, not to decorate a wiki.
- Mapped to your existing risk framework
Register entries slot into what you already run.
- Fixed price per organization
One organization, three weeks.
- Eligible for BUR / KFS co-funding
Consulting services qualify under operator rules in Poland.
The process, phase by phase.
Pick the way in that fits your budget and timing.
Every practice has a free first step, an entry package with a written deliverable and its price listed here, and a full project or retainer quoted after a first call. Once the scope is agreed, the price is fixed, with no hidden costs.
- 1Step 1 · Free
Intro call or self-assessment
60 minutes · 1 engineer · no obligation
FreeTalk to an engineerShow details
- Intro call with an engineer, or the online self-assessment
- A written next step within one business day
- No obligation and no sales deck
- Recommended2Step 2 · Fixed price
AI Governance Starter Pack
1 organization · up to 3 weeks from scoping
EUR 3,300 netFixed price, no hidden costs; extras only from the Not included list.
Ask for this packageShow details
- AI usage policy for one organization
- Approved tools list with evaluation cadence
- Risk register entries for AI use
- One-page cheat sheet for managers
- Not included: Legal opinion, policy enforcement in tooling, company-wide training, full EU AI Act compliance.
- Eligible for BUR / KFS co-funding, subject to operator rules
- 3Step 3 · Project or retainer
Full scope, quoted after a first call
Full scope · phased delivery · quoted per phase
from EUR 14,000 net, quoted after a first callStart the conversationShow details
- Full governance program for the organization
- Policy enforced in tooling
- Training and an audit cadence
The situations that bring teams to this service.
- Engineering wants to use AI tools but legal cannot find a precedent to approve
- Each team writes its own AI usage rules - inconsistent and unenforceable
- Risk register has no entries for AI; auditors flag the gap
Show the other problems (1)
- Evaluation of AI outputs is informal; nobody can prove quality at audit time
- Heads of legal and compliance asked to bless an AI rollout
- CISOs whose engineering teams want to license AI coding assistants
- COOs standing up internal AI use across non-engineering departments
- Public-sector and regulated organizations needing a defensible baseline
Where this goes wrong, and what we do about it.
1. The policy is a document and the behaviour is in the toolsWhat stays with you: rules enforced in configuration rather than prose, and the record of what we tried and whether it was blocked
What happensA usage policy gets written, approved and filed. Asked publicly how their security policies had kept up with AI, teams answered with silence: the question drew no replies at all. Meanwhile people paste code into whatever assistant is open, because the policy never reached the place where the decision happens.
What we do about itWe put the rule where the action is: repository settings, tool configuration, template text in the pull request, an entry in onboarding. Then we test whether the rule holds by trying to break it the way a busy engineer would.
2. The approved-tools list ages the week it is publishedWhat stays with you: approval criteria, a named decision owner with a response time, and an inventory of what is really in use today
What happensA list of permitted tools is agreed in committee. New tools appear faster than the committee meets, so people use what works and stop mentioning it. Within a quarter the list describes a company that no longer exists, and the next audit reads it as fact.
What we do about itWe replace the fixed list with criteria a tool must meet and a named person who can approve one against them in a day. Then we check what is actually in use, so the starting point is reality rather than the register.
3. Governance aimed at the model instead of at the changeWhat stays with you: definition of done for AI-assisted changes, wired into the pull request template and the review checklist
What happensControls get written about AI as a category: which models are allowed, which vendors are approved. The risk is not in the model, it is in the change that reaches production carrying assumptions nobody checked. Governance written one level too high generates paperwork and blocks nothing.
What we do about itWe anchor the controls to the change: what has to be true before an AI-assisted change merges, who signs, and what evidence is kept. Vendor questions stay where they belong, in procurement.
Deliverables, not deliverable-shaped slides.
- Written AI Usage Policy (1 doc, covers staff + contractors)
- Approved Tools List with data-handling rules per tool
- Evaluation cadence playbook (which AI outputs are reviewed, how, by whom)
- Risk register entries for AI use, mapped to your existing risk framework
- Quick-reference one-pager for managers to use day to day
Questions procurement teams ask.
Guides that lead to this service.
Talk to an engineer.
Describe where you are with AI usage policy. A reply within one business day.