Make AI safe to use with your company data.

A permission audit belongs before rollout because AI assistants follow your existing permissions exactly. If a salary spreadsheet was shared with the whole company in 2021 and forgotten, Copilot, Gemini or a connected ChatGPT or Claude workspace can find it the first time someone asks. Fixing it first costs far less than explaining it afterward.

The audit covers six areas: over-shared content, sensitive files that need labels, data that should be blocked from leaving, what staff may do with AI, which unapproved AI tools are already in use, and whether the vendors behind the approved ones have an agreement that protects you.

• Permission exposure.SharePoint, OneDrive, Google Drive and Teams checked for company-wide links, anonymous links and old guest accounts.
• Sensitivity labels.Microsoft Purview labels on the files that matter, applied automatically where the pattern is reliable.
• Data loss prevention.Rules that stop specific data from leaving, tested against real files.
• AI use policy.A short, readable policy that tells staff what may go into which AI tool.
• Shadow AI discovery.The unapproved AI tools in use, found through DNS, browser extensions and sign-in logs.
• Vendor review.For each AI tool you keep: whether a data processing agreement exists, where data is stored, and whether your content can train their models.

Shadow AI is any AI tool your staff use without company approval, and at most small businesses it is now the larger risk because no agreement covers it. Verizon's 2026 Data Breach Investigations Report found AI use on work devices rose from 15 to 45 percent of workers in a year, 67 percent of that use runs through personal accounts, and the average company has unapproved AI browser extensions on more than 15 percent of its users.

So a policy written only for Copilot covers a small share of the AI use in your business. Ours covers ChatGPT, Claude, Gemini, Perplexity and the writing and coding tools people install for themselves. Discovery comes first, because a policy has to match what people actually do.

AI governance audits are a fixed fee, quoted under the typical published fee of about $4,950 for the same scope. Larger or messier environments cost more, and you hear which one you are before work starts. Cleanup is quoted after the audit, once the size of the problem is known.

Several major carriers added AI exclusions to standard technology errors and omissions policies during 2026. If your business uses AI tools, confirm in writing whether your policy still responds. We are not insurance advisors, but a documented governance position makes that conversation with your broker much easier.