Use AI without handing your data to someone else
Your team is already pasting client data into public AI tools. We put the policy, access controls and vendor review in place that let you say yes to AI safely, sized for your business rather than for an enterprise compliance department.
- Right for you if
- AI is already in use and nobody is accountable for it.
- Outcome
- A defensible answer when a client or regulator asks how you govern AI.
- Timeline
- 3–4 weeks.
- Pricing
- Fixed fee, scoped after a discovery call.
Why this keeps going wrong
AI governance is no longer something you get to plan in advance. Client due-diligence questionnaires now ask about AI controls, insurers have started asking too, and UAE data protection law applies to the third-party tools your staff use.
Bans do not work. People route around them with personal accounts. What works is a sanctioned route good enough that nobody needs the unsanctioned one, plus enough monitoring to know the difference.
Signs this is you
- You could not list the AI tools in use if a client asked tomorrow.
- A client questionnaire or insurance renewal asked about AI and you improvised.
- Staff use personal accounts for work involving client information.
- You handle regulated, financial or health data with no written AI position.
- There has already been a near-miss.
What happens, week by week.
- Week 1
Establish what is actually in use
An anonymous survey plus network and SaaS discovery.
You get: An inventory of tools, users, data categories and exposure.
- Week 2
Write the policy with the people it governs
A small working group. It stays under ten pages. If a rule cannot be explained in a sentence, it will not be followed.
You get: A signed-off AI usage policy and a one-page version for staff.
- Weeks 2–3
Review vendors and configure them properly
Data location, retention, training on inputs, contract terms, security.
You get: An approved-tool list with settings applied, and a rejected list with reasons.
- Weeks 3–4
Controls, monitoring and a review rhythm
Least-privilege access, guardrails against accidental pasting, usage visibility, a review calendar, and wording for client questionnaires.
You get: Controls, monitoring, a review calendar and client-facing answers.
What you walk away with.
AI usage policy
Under ten pages, plus a one-page summary.
Access & data controls
Least-privilege access and data loss guardrails.
Vendor review
Approved and rejected tools, with reasons.
Monitoring & review cycle
Usage visibility and a scheduled review.
Included
- Tool discovery
- Signed-off policy with one-page summary
- Vendor review
- Configuration of approved tools (retention, training opt-out, access scope)
- Least-privilege design
- Monitoring and review cycle
- Wording for client questionnaires and insurers
- A live training session for staff, not a PDF
Not included
- Legal advice
- ISO 27001 or SOC 2 certification (the work is compatible with both)
- Penetration testing
- Acting as your outsourced DPO
How you'll know it worked.
- Tools discovered vs. known
- Share of staff who acknowledged the policy
- Approved tools configured for retention and training opt-out
- Time to answer a client AI questionnaire, from "we will get back to you" to same day
Where this fits best.
From our insights.
The UAE PDPL deadline is 1 January 2027. What it means if you use AI
If your staff paste customer data into AI tools, that is processing under the federal data protection law. Here is what to have in place before the grace period ends.
Can your team legally use ChatGPT in the UAE?
Short answer: yes. Longer answer: how they use it matters a great deal.
Onshore, DIFC or ADGM: which AI rules actually apply to you
Where your company is registered decides which data protection regime you answer to. Here is a plain-language map.
Questions we hear a lot
Are we too small for this?
Exposure scales with how sensitive your data is, not with headcount.
Our staff will not like being monitored.
Monitoring is at tool and data-category level. It is not keystroke surveillance.
What if you find something serious in week one?
We stop and deal with it first.
Does this give us ISO 27001 or SOC 2?
No. Anyone who says a four-week engagement does is overselling. It is compatible with both.
How does this stay current when tools change monthly?
The policy is written around data categories and behaviours. The approved-tool list is the part that moves.
Start with a conversation, not a proposal.
Thirty minutes with someone who has built this before. If we're not the right fit, we'll say so and point you to who is.