Guides to governing AI, with the sources linked.
Written for the people who have to do the work: IT, security, legal and compliance. Each guide is dated, and every statement about a law or a product links to its primary source.
Free tools and reference
- AI policy generator
A complete AI acceptable use policy from eight questions.
- AI questionnaire answers
What evidence each AI question in a questionnaire needs.
- AI tool fact pages
Does it train on your data? 37 tools, sourced and dated.
How to answer the AI questions in customer security questionnaires
A customer’s vendor questionnaire has grown a new section. It asks whether you use AI, on what data, under which policy, and how you would know if an employee pasted their contract into a chatbot. Here is how to answer it truthfully and well.
- Practice
What to put on an AI trust page (and what to leave off)
Security pages grew up answering questions about encryption and uptime. Customers now ask a different set: which AI tools do you use, does our data go into them, and who decided that was acceptable. A short public page can answer most of them before the questionnaire is sent.
6 min read · Reviewed - Practice
Rolling out AI rules employees will actually follow
Most AI policies fail after they are written. They are approved, saved to a shared drive and never read by the people they bind. A rollout is the difference between a policy that exists and a policy that changes what happens on a Tuesday afternoon.
6 min read · Reviewed - Practice
Keeping an AI incident register: what to record
Sooner or later someone will paste something they should not have into an AI tool, or an AI system will tell a customer something untrue. What you can show afterwards depends on what you wrote down at the time. A register is a small habit that pays for itself the first time it is needed.
6 min read · Reviewed - Practice
Shadow AI: how to find the AI tools your employees already use
Every organization that looks finds more AI tools in use than it approved. The useful questions are how to look, what each method can and cannot see, and what to do with the answer.
5 min read · Reviewed - Practice
How to find unused ChatGPT, Copilot and Claude seats
AI seats are bought in round numbers and assigned in a hurry. A year later some are used every day, some were opened twice, and some belong to people who left. Here is how to tell them apart before the renewal.
7 min read · Reviewed - Practice
MCP servers at work: what they can reach and how to inventory them
An AI assistant that can only talk is one kind of risk. An assistant wired to your file system, your repositories and your database is another. The wiring is done by employees, in configuration files nobody reviews.
7 min read · Reviewed - Practice
Monitoring employee AI use without surveillance: a privacy-first approach
Organizations need to know which AI tools are in use. They do not need to know what anyone typed. The gap between those two is where a monitoring programme succeeds or becomes surveillance.
6 min read · Reviewed - Regulation
Employee AI monitoring notices: what New York, Connecticut and Delaware require
Recording which AI tools employees use is a form of electronic monitoring. Three US states have statutes that require employers to say so in writing, and they differ in ways that matter: when, to whom, where it is posted and what happens if you do not.
7 min read · Reviewed - Practice
How to write an AI acceptable use policy
Most AI policies fail in one of two ways: they ban everything and are ignored, or they say "use AI responsibly" and decide nothing. A useful policy names tools, data and decisions.
6 min read · Reviewed - Practice
AI inventory: what auditors expect
Every AI governance framework begins by asking what AI you have. An inventory that satisfies an auditor is less about the list than about what you can show for each line.
5 min read · Reviewed - Regulation
EU AI Act Article 50: what deployers must do from 2 August 2026
The transparency obligations of the EU AI Act are the first part of the Act that reaches almost every company using generative AI. Here is what they require and how to get ready without overbuilding.
5 min read · Reviewed - Regulation
Colorado SB 26-189 explained: what replaced the Colorado AI Act
Colorado rewrote its landmark AI law before it took effect. The new statute asks for less paperwork and more transparency toward the people affected by automated decisions.
5 min read · Reviewed - Frameworks
NIST AI RMF vs ISO/IEC 42001: which to use, and how they fit together
The two most-cited AI governance frameworks are often presented as alternatives. They are different kinds of document, and most organizations end up using both.
5 min read · Reviewed
These guides are written for orientation and are not legal advice. Laws change; each guide shows when it was last reviewed, and links to the official texts so you can check the current position.
See what is in use before you decide anything.
Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.