AI tools are becoming increasingly useful for security, risk, governance, policy drafting, document review and general business productivity.
A significant part of my work is in GRC. That has been the centre of gravity of my work for more than a decade, although my earlier career was much more technical. I am no longer a technical lead, but I have deliberately kept close enough to the technology to understand how it works, where the risks sit and how controls operate in practice.
Over the last few years, that has meant deepening my understanding of AI from both a governance and practical implementation perspective.
That has included:
Designing and standing up a private, self-hosted AI/RAG (Retrieval-Augmented Generation) lab using Proxmox, Ubuntu, Qdrant, Ollama, Gradio and Samba for secure document analysis, local model experimentation and controlled client-data segregation.
Working with legal counsel, committees and senior stakeholders on enterprise AI strategy, as well as practical approaches to using AI at the operational and DevOps level.
Seeing first-hand how much more there is to AI governance, accountability and the EU AI Act than the technology alone. That led me to complete Oxford Saïd Business School’s AI Ethics, Regulation and Compliance Programme, which was intense, challenging and highly valuable.
One practical issue I do not see discussed enough is this:
The product experience and the contractual position of AI platforms do not always align.
Some AI platforms actively present work-related use cases during onboarding: consulting, finance, software engineering, sales, marketing, client preparation, document drafting and business analysis. The user experience clearly encourages professional use.
Yet the underlying terms, privacy position, data-retention model and liability framework may still be designed for consumer use, not business or client-confidential work.
That creates an awkward gap.
For a large organisation, the answer is usually clear: use an enterprise or business tier, complete the vendor assessment, agree the data-processing terms, configure retention, manage access, monitor usage and define acceptable use.
For a contractor, sole consultant or small business, the answer is less straightforward.
The enterprise-grade route may be too expensive, require multiple seats or lack the convenience of the consumer chat interface. The consumer product may be affordable and genuinely useful, but may not provide the control posture needed for client material, regulated data, confidential documents or security-sensitive work.
This is particularly important for small consultancies and specialist advisers.
My own company may only have a small number of employees, but the work can involve clients with hundreds, thousands or tens of thousands of users. The size of the supplier does not necessarily reflect the scale, sensitivity or risk profile of the clients and environments it supports.
It also raises practical questions about segregation. If an adviser supports multiple clients, AI use needs to avoid accidental cross-contamination between client contexts. That means thinking carefully about client containerisation: separate workspaces, clear data boundaries, controlled prompts, restricted uploads, retention settings and documented rules for what can and cannot be processed.
AI platform providers need to recognise this middle ground.
Not every legitimate business user is a large enterprise buyer, and not every professional use case fits neatly into a consumer subscription. If AI is to be adopted responsibly, providers need workable options for individuals, sole consultants, small businesses and larger organisations alike.
A low-seat enterprise tier would help close that gap. It would give smaller businesses and specialist advisers access to appropriate contractual terms, data protection commitments, retention controls and workspace segregation without forcing them into large enterprise purchasing models. It could also help larger organisations by making proofs of concept, pilots and controlled departmental adoption easier to govern from the outset.
This is not an argument against using AI. Quite the opposite.
AI can provide real value. It can improve drafting, challenge assumptions, accelerate research, structure thinking and reduce friction in producing professional material. But the governance needs to match the use case.
A sensible approach is to separate use into clear categories:
• Low-risk productivity: generic drafting, public information, brainstorming, templates and anonymised analysis
• Controlled business use: internal documents, non-sensitive business material and reviewed outputs
• Restricted use: client-confidential information, regulated data, personal data, contracts, security findings, audit evidence and NDA-covered material
The mistake is treating all AI usage as the same.
The real question is not simply:
“Can I use this AI tool?”
It is:
“What data am I putting into it, under what terms, with what controls, and could I defend that decision to a client, auditor, regulator or board?”
That is where AI governance needs to become practical rather than theoretical.
Personal commentary. Views are the author’s own.