AI consultancy · AI governance

AI governance and AI policy support

Clear rules make it safe to say yes.

We help you put practical AI governance in place, so your people know what is allowed, what is not, and how to raise a concern. We write your AI policy for you, or work with your team to write it together, and then train your staff on it.

Your free call is with Qasim Ahmed, our founder, and you can start with the free AI Readiness Scorecard. For UK organisations, not individuals.

Three colleagues work through a printed policy draft at a meeting table, making notes beside an open laptop

Trusted by

Teams we've worked with to build practical AI capability.

Day Seven has delivered AI enablement work for GXO, SharkNinja, Velociti, Studiospace, Archer Hotel Capital and Yorkshire Cancer Research.

This is company-level experience, not a claim that each organisation bought the particular service described on this page.

What is AI governance, in one paragraph?

Short answer: AI governance decides which AI tools your people may use, for which tasks, with what data, and who is answerable for the output. In most UK businesses it begins with a short AI policy that staff actually read, plus training on real tasks. A formal management system such as ISO/IEC 42001 comes later, when customers, regulators or your own scale require it.

Starting point: most organisations begin with staff training on safe use. See AI training and ISO 42001 training.

What you leave with

What our AI governance support gives you

These are the parts we already offer. The exact mix is agreed in scoping.

An AI policy for your staff

Written by us, or with your team. It covers how your people may use AI, what data stays out, and how to raise a concern.

Practical do's and don'ts

Your policy translated into everyday rules people will follow, covering data, privacy, IP and disclosure.

A governance framework people follow

The governance, responsible-use and adoption frameworks that make AI safe to roll out at scale.

Staff trained on the policy

Training that applies the rules to real tasks, so people practise checking output and handling data rather than just hearing the rules.

ISO/IEC 42001 readiness

Awareness, role-based training and implementation readiness, so your teams know the standard and how it applies to their work.

AI policy on a page

The six things every AI policy has to answer

Keep the core short, then add depth only for higher-risk teams and uses.

More detail is in the employee AI policy guide.

Text version of this diagram

Approved tools: which AI tools people may use.
Data that stays out: what data must never go into them.
Human check: when a person has to check or sign off AI output.
Disclosure: when to tell others AI was used.
Accountability: who is accountable for the result.
Raise a concern: how and to whom people raise a concern.

Scope

Only using ChatGPT and Copilot? Your policy still needs to cover more

Most organisations think of governance as rules for the one or two tools they pay for. In practice, people also use free versions on personal accounts, AI features built into software you already have, and browser add-ons. A policy that names only the paid tools leaves the rest unmanaged.

So the first job is to see what people are really doing today. Unofficial use tells you more than any plan about where AI already saves time and where the exposure is. Asking anonymously, with no blame attached, gets honest answers. With that picture, you can choose which tools to approve and which uses need tighter checks.

Saying no to everything rarely stops AI use. It moves it to accounts you cannot see. Permission with clear conditions is normally the safer choice.

AI risk assessment

Put checks where the risk is

An AI risk assessment can be a short exercise. List where AI is in use, ask what the worst realistic outcome of each use would be, match the checks to that, and look again on a regular cycle.

Everyday internal work, such as tidying your own meeting notes or a rough first draft for colleagues, can go ahead on approved tools. Work that reaches customers, or touches legal, HR or money, gets a person checking it before it is used, plus a data protection check whenever personal data is in the mix.

Generative AI goes wrong in two places: what goes in, meaning the data people paste or upload, and what comes out, meaning confident text that may be wrong. Good governance covers both.

Two tiers, not one rule. Your own tiers are agreed with you.

Text version of this diagram

Lower risk: everyday internal work such as your own meeting notes or a rough first draft for colleagues. Allowed with approved tools, with no confidential data.
Higher risk: anything customer-facing, legal, HR or financial. Human review is mandatory, and personal data means a data protection check first.
Checks increase as the risk of a use increases.

Saying yes safely

Encourage AI use without losing control

The pattern that works: a short list of approved tools, plain data rules, room to experiment on everyday tasks, and the tight controls kept for the uses that need them.

Somewhere safe to experiment, such as a small pilot group or a short build sprint, using test material rather than confidential data.
A clear route for new ideas, so people know who to ask and how quickly they will hear back. Slow approvals push people back to personal accounts.
One named owner for AI decisions. You may not need a committee, but someone has to be able to say yes or no.

Then roll it out with training: a short briefing for all staff on the core rules, and role-specific sessions for higher-risk teams such as HR, legal and finance. See AI adoption support for how that becomes a habit.

A presenter gives a short briefing on safe AI use to colleagues seated in a loose semicircle in an open-plan office

ISO/IEC 42001

Getting ready for ISO/IEC 42001

Many organisations start with a short employee AI policy before working towards ISO/IEC 42001. When customers or regulators ask for formal assurance, we provide awareness, role-based training and implementation readiness, so that when your certification body arrives, your teams know the standard and how it applies to their work.

What we are not: Day Seven is a training and enablement partner, not a certification body. Formal certification is issued by accredited certification bodies following an independent audit. Full detail is on ISO 42001 training.

Who it is for

For organisations that want rules people follow

AI governance support is for UK organisations, not individuals: leadership teams, HR, legal and compliance leads, and IT or data leads who need a policy staff will actually read. We plug into in-house HR, L&D and IT teams rather than replacing them.

We work in person at your offices or live online.

How it works: talk, plan, deliver, embed

1
Talk. A free call with Qasim Ahmed, our founder, about your tools, your data and what people already use.
2
Plan. We agree what we will do, who is involved and how we will measure it, with pricing tailored to your business.
3
Deliver. We write the policy with you or for you, set the do's and don'ts, and train your staff on it.
4
Embed. Follow-up so the change sticks.

Pairs with

Where AI governance fits with the rest of Day Seven

ISO 42001 training

Awareness and role-based training on the standard.

AI training

Hands-on sessions that apply your rules to real tasks.

Employee AI policy guide

What to include, with sources.

AI adoption

Turn the rules into everyday habits.

AI agents

Agents built with review and limits.

AI consultancy

Strategy, adoption, agents and governance together.

Frequently asked questions

An AI governance policy should say which AI tools are approved, what data must never go into them, when a person has to check or sign off AI output, when to tell others AI was used, who is accountable, and how to raise a concern. Keep the core short, and add depth only for higher-risk teams and uses. Our employee AI policy guide covers it in more detail.

The structure that sits around your AI policy: who owns AI decisions, how new tools and uses get approved, how risk is rated, and how often the rules are reviewed. We help organisations write the governance, responsible-use and adoption frameworks that make AI safe to roll out at scale.

Yes. We can write your AI policy for you, or help your team write it, and then train your staff on what it means for their work.

Yes. It should cover every AI tool in use, including free versions on personal accounts and AI built into software you already have. Listing only the tools you pay for leaves the rest outside the rules.

Usually not. A ban tends to move AI use onto personal accounts you cannot see. Approving a few tools with plain data rules is normally the safer route.

No law sets a review date. Review it on a regular cycle, plus a check each time a new tool or a major new use is approved.

Many organisations start with a short employee AI policy before working towards ISO/IEC 42001.

No. Day Seven is a training and enablement partner, not a certification body. Formal certification to ISO/IEC 42001 is issued by accredited certification bodies following an independent audit. What we do is prepare your people and organisation, awareness, role-based training and implementation readiness, so that when your certification body arrives, your teams know the standard and how it applies to their work.

Pricing is tailored to your business. Book a free call with us and we will talk through what you need.

Want clear rules for AI in your business? Pricing is tailored to your business.

More from Day Seven

This is part of our AI consultancy. See also AI strategy, AI adoption, AI agents, AI training and the free AI Readiness Scorecard.