Phase 1
Discover
Find tools and habits already in use before writing rules nobody will follow.
- Shadow AI Discovery Survey
- Manager Briefing One-Pager
- Data Classification Quickstart
Method
Discover → Decide → Operate
Most AI policies fail because they start with rules and skip reality. The kit is sequenced the other way: find what’s already in use, make bounded decisions, then run a light operating cadence.
Operational templates only. Not legal, compliance, privacy, security, HR, or professional advice. Review with your stakeholders before adopting.
The three phases
What you open, in order — not a binder dump.
Each phase maps to concrete kit files. You edit examples; you don’t invent a program from a blank page.
Phase 2
Decide
Score risk, then Conditionally approve, restrict, promote later, or reject — Conditional-first, not soft Approve. Checklist + living register keep Approved ≠ unrestricted.
- AI Acceptable-Use Policy
- Risk scoring rubric + tool approval checklist
- Approved AI Tool Register + 6 playbooks
Phase 3
Operate
Give employees plain guidance, an incident path, and a light quarterly review.
- Employee FAQ + Do / Don’t list
- Incident triage + exception / temporary-use form
- Quarterly AI Review Tracker
Practical timeline
Day 1 through day 30 — without a project office.
Illustrative pace for an SMB IT owner or MSP delivery lead. Your environment and stakeholders set the real calendar.
Day 1 — first session
Manager briefing → launch Shadow AI survey → share Employee FAQ draft
Days 2–7 — contain the obvious
Triage survey hits; Conditionally approve one low-risk path (Low ≠ auto-Approve); publish employee-facing approved list
Weeks 2–3 — tool-by-tool answers
Run playbooks for Copilot, public AI, meeting bots, writing/research/coding agents as needed
Week 4 — lock the cadence
Incident path live; schedule first quarterly review; keep the sample calendar as a reference
Time estimates are illustrative, not a guarantee. Sixteen completed sample artifacts show what “done” looks like at each stage.
See sample output on the product page → · Try the free checklist →
Who runs it
Same method. Different ownership.
SMB / internal IT
Business Pack — $79
One organization owns Discover → Decide → Operate end-to-end. Start with Day-1 Quick Start, then the rollout checklist.
MSP / consultant
MSP Pack — $299
You facilitate the same phases as a client engagement — pitch, discovery agenda, scope language, and handoff included.
FAQ
Method questions buyers ask before they buy a kit.
Do we have to finish Discover before any Decide work?
No. Day 1 often overlaps: brief managers, start the survey, and draft the policy in parallel. The rule is don’t publish hard bans before you’ve seen what’s already in use — or people will route around you.
How long does a realistic rollout take?
Many teams can stand up a usable first version in 2–4 weeks part-time. Regulated environments take longer because of stakeholder review — the kit still shortens the drafting work, not the legal calendar.
Is this a GRC platform or certification program?
No. It’s editable templates and workflows. It does not certify SOC 2, HIPAA, ISO, GDPR, or any other framework, and it is not legal or compliance advice.
Should Low-risk tools start as Approved?
Usually no. The kit is Conditional-first: prefer Conditionally approved for first intake / pilots — including Low band. Standing Approved is a later Promote when scope is stable and controls are live. Approved ≠ unrestricted.
What if we only need one or two documents?
Start with the free AI Tool Approval Checklist Lite. If you need a full program (policy + register + employee path + quarterly review), the kit is cheaper than assembling those pieces ad hoc.
Can MSPs run this method for clients?
Yes — the MSP Pack adds pitch, discovery, scope, and handoff materials under a practitioner license for client delivery (not for reselling the source kit as a product).
Launch notice
Get notified when checkout opens.
AI Guardrails Kit — notify me
Local stub → thank-you page. Live email delivery when Gate 2 / 5B is wired.