AI governance your team will actually follow.
An AI acceptable-use policy written for your business, tools configured so customer data stays where it belongs, and training that makes the rules stick. Built by an engineer who ran AI adoption inside a Fortune 50 bank, where governance is an audit, not a promise.
Is this you?
AI governance work usually starts when one of these lands on a desk.
- Employees are already using ChatGPT, Copilot or Gemini at work and there is no policy about what they can paste into it.
- A customer, insurer, auditor or regulator has asked how your business uses AI, and there is no written answer.
- You handle data that other people trust you with: patient records, financials, contracts, case files, personal information.
- Leadership wants the productivity gains but is worried about a leak, a hallucinated answer sent to a client, or an IP problem.
- You banned AI tools, and you suspect people are using them anyway on their phones.
- You are rolling out AI to a team and want to get the rules right the first time. Read more →
What you get.
Governance that lives in a binder does nothing. Every deliverable here is designed to be used.
An AI acceptable-use policy for your business
Plain language, a few pages, specific to your tools and your data. Which tools are approved, what kinds of information may and may not go into them, who signs off on new uses, and what to do when something goes wrong. Aligned with the obligations you already have, and reviewed with your counsel or compliance lead where you have one.
Tools configured so the policy holds
Enterprise or business tiers set up on terms where your data is not used for training, retention and logging configured, access tied to your existing accounts, and the consumer versions turned off where they should be. The policy says what is allowed; the configuration makes the wrong thing hard to do.
Training and a review cadence
Short, role-specific sessions on what the policy means for each job, with real examples from your work. A simple inventory of AI uses in the business, and a periodic review so the policy keeps up as tools change and new uses appear.
How an engagement runs.
Every engagement is led hands-on from the first call through delivery, never handed down to a bench. Data handling is put in writing before any work starts.
Inventory
What AI tools are in use today, officially and otherwise, what data touches them, and what obligations already apply to that data. This is usually eye-opening.
Policy draft
A draft acceptable-use policy in plain language, written around your actual tools and data categories, reviewed with your leadership and, where relevant, your counsel or compliance function.
Controls
Approved tools set up on business terms and configured to match the policy. Sanctioned options for the jobs people were using unsanctioned tools for.
Rollout and review
Training by role, the policy published where people will find it, and a review date on the calendar. Optional ongoing review as the tools and the business change.
Why Keller Tech for this.
Governance under audit, not in theory
The AI rollout Keller Tech led at a Fortune 50 bank covered 40 engineers in an environment where data governance is examined, not assumed. The acceptable-use policy, review integration and training from that work are the pattern used here.
Written by someone who knows what the tools do with data
Policies written without engineering knowledge either forbid everything or miss the real risks. Keller Tech builds on these models and integrates them for a living, so the policy reflects how the tools actually handle your information.
The same standard we hold ourselves to
Subtext, one of our own apps, reads people’s most personal messages, and it was built so that reading stays private. Client work is held to the same bar.
Common questions.
Does a small business really need an AI policy?
If anyone in the business uses AI tools with customer, employee or financial information, yes. The policy does not have to be long. A few clear pages about which tools are approved and what may go into them prevents most of the incidents that happen, and gives you a real answer when a customer or insurer asks.
What should an AI acceptable-use policy cover?
Which tools are approved and on what accounts; which categories of data may never be entered into an AI tool; how AI-generated output is checked before it reaches a client or a decision; who approves new uses; what to do after a mistake; and how often the policy is reviewed. It should be specific to your business, not a generic template.
Should we just ban AI tools?
Usually not. Bans tend to push use onto personal accounts and phones, where you have no visibility and no protection. Giving people a sanctioned tool on business terms, with clear rules, is safer than a ban and gets you the productivity gains.
Does this cover HIPAA, GLBA, CMMC or other compliance requirements?
Keller Tech is an engineering practice, not a law firm, and does not give legal advice. What we do is align your AI use with the obligations you already have and work alongside your counsel or compliance lead, so the policy and the tool configuration support those requirements rather than undermine them.
Which frameworks do you work from?
Where a framework is useful, the NIST AI Risk Management Framework and ISO/IEC 42001 are the usual reference points, scaled down to what a small or midsize business can actually operate. Most businesses do not need a certification; they need a clear policy, correctly configured tools, and people who know the rules.
Can you also help us get value out of AI, not just control it?
Yes, and the two go together. Governance work often pairs with an assessment of where AI is worth using in your business. See AI consulting for how that works.
Work with Keller Tech.
Based on the Mississippi Gulf Coast, working with local businesses and remote teams anywhere. The fastest path is a short email.
Get the AI rules right before something goes wrong.
Tell us what tools your team uses and what kind of data you handle. You will get a straight answer about what you need.
Biloxi, MS 39530 · Remote