Services
Explore
Free AI assessmentAnswer 15 questions about one process and see where AI could help.
Start an assessmentAI risk, policy and governance
A facilitated half-day session in which your leadership team maps how AI is used in the business and drafts an AI policy, an initial risk register and a vendor vetting framework for the responsible owners to review afterwards.
- Format
- Live online
- Length
- 09:30 to 13:45
- For
- Leadership teams
- Where
- Online, live
- Price
- Quoted for your team
How it runs
How the session runs
The session moves through four parts, each building on the last, and starts from how AI is used in your business today.
- 01Part 1
Risk identification
Working through your current and planned AI use, the team identifies risks across data, compliance, operations and reputation and records them in the register.
- 02Part 2
Policy drafting
Using a structured template, your team drafts and reviews the core of your AI policy during the session. The facilitator questions gaps and unclear wording as they come up.
- 03Part 3
Vendor and tool review
We work through the AI tools your business uses, apply the vendor vetting framework to each and agree next steps where concerns come up.
- 04Part 4
EU AI Act and next steps
A focused review of where your AI use may fall within emerging regulation, followed by a prioritised action plan owned by the leadership team.
Walk Away
What your team takes away
The session produces draft governance documents built from how your business uses AI today. Each one is a starting point for the people responsible to review, complete and approve.
A draft policy covering acceptable use of AI tools, data handling rules, client confidentiality obligations, output review requirements and the process for approving new tools. The team drafts and discusses it during the session, then reviews it before distribution, with legal advice where needed.
A register of the AI risks the team identifies during the session, scored by likelihood and impact, with a proposed owner and mitigation for each. It is a working document to review and extend as your use of AI changes.
Criteria and questions for evaluating an AI tool before your business adopts it: data processing terms, storage location, whether customer data is used to train models, sub-processor disclosure and contract terms. It applies to tools already in use and to new ones.
A plain-language document for employees covering which AI tools are approved, what data can be used with each, which outputs need a person's review and how to raise a concern. The guide is written for staff, and the policy is written for leadership.
A summary of where your current and planned AI use may sit within the EU AI Act's risk categories. This is most likely to matter if your business offers products or services in the EU, or uses AI in hiring, customer decisions or regulated activities that affect people there. This is not legal advice. It shows where legal advice may be needed.
Who For
Who it is for
The session suits leadership teams whose businesses already use AI and now need to manage that use.
Leadership teams that have introduced AI tools and are now working out how to govern them
Businesses in regulated sectors (financial services, healthcare, legal, HR) where AI use raises compliance questions
Businesses that hold client or personal data in CRM records, documents and support conversations and want to understand how AI tools affect their data protection obligations
Leadership teams that clients, partners or insurers have asked about AI use, and that do not yet have written answers
Businesses planning wider AI use that want a policy agreed before rollout
Agenda
Sample agenda
The session runs from 09:30 to 13:45. We adapt the agenda to your sector and the pre-session questionnaire.
- AI usage mapping30 mins
We start by mapping the AI tools in use across the business: who uses each one, what data it processes, what it produces and whether it was formally approved or adopted informally.
- Risk identification and scoring60 mins
Working from the usage map, the team identifies risks under six headings: data and privacy, client confidentiality, regulatory compliance, output quality and liability, staff misuse and reputation. Each risk is scored by likelihood and impact and given an initial mitigation, which gives you a draft risk register by the end of the block.
- Break15 mins
- AI policy drafting75 mins
Using a structured template, the team drafts the core sections of your AI policy: acceptable use, prohibited uses, data handling rules by type of tool, client confidentiality, output review and the approval process for new tools. The facilitator questions gaps and unclear wording as the draft develops. The session ends with a first draft for the responsible owners to review.
- Vendor vetting and tool review40 mins
We apply the vendor vetting framework to the AI tools in use: data processing agreements, storage location, whether customer data is used to train models, sub-processor disclosure and contract terms. Where concerns come up, we agree a next step, such as a question for the vendor, a contract change or a restriction on use.
- EU AI Act review and close35 mins
A structured look at where your current and planned AI use may fall within the EU AI Act's prohibited, high-risk or limited-risk categories. We note which uses need further review, possibly with legal advice, and close with a prioritised action list. We send a summary of the policy draft, risk register and vendor review after the session.
Included
What is included
Each AI risk, policy and governance session includes the following.
Sent before the session. Each member of the leadership team lists the AI tools they know are in use, the data each one handles and any concerns. We use the answers to build the usage map that opens the session.
A Reformat Labs consultant runs the policy drafting live and questions gaps and unclear wording as the team writes.
The first draft of your AI policy, produced during the session and sent in an editable format afterwards. Your team reviews it, with legal review where your circumstances need it, before distributing it to staff.
A register of the risks identified in the session, scored by likelihood and impact, with a proposed owner and mitigation for each, in a format you can maintain as your AI use changes.
A framework for evaluating AI tools before adoption, with a checklist of questions for vendors and a template for recording the answers. It applies to tools already in use and to future evaluations.
A plain-language guide for employees, based on the policy draft and written for people outside the leadership team. It covers approved tools, data rules, review requirements and how to raise a concern.
A call 30 days after the session to review progress on the action list, answer questions raised while putting the policy in place and update the risk register.
Team
Who runs the session
A Reformat Labs consultant leads the session, and the risk register, policy decisions and vendor review are documented as the session runs.
Runs the session, leads the risk discussion and policy drafting, and explains how AI tools handle data and what to look for in vendor agreements.
Maintains the risk register, records policy decisions as they are made and captures the outcome of the vendor review, so the drafts are written during the session.
Quotes
Quotes
Faqs
FAQs
Questions leadership teams ask before they book.
Do we need legal counsel on the call?
It is not required. The session produces a draft policy and risk register that your legal adviser can review afterwards. If your situation is complex, for example in financial services, healthcare or anything involving automated decisions about people, we recommend legal review of the drafts before you distribute them.
We're a small business. Do we really need a formal AI policy?
If your team uses AI tools with client data, personal data or commercially sensitive information, a written policy is worth having. It sets out what staff may and may not do, gives you a written answer when a client asks, and gives you a consistent way to evaluate new tools.
We already have a data protection policy. Does that cover AI?
Check it against the questions AI tools raise. A data protection policy written before your team used AI tools may not cover whether a provider uses your data to train its models, who checks the accuracy of AI output, what staff may use AI for, or how to evaluate AI vendors. The AI policy drafted in the session sits alongside your data protection documents.
What does the EU AI Act require us to do?
That depends on how you use AI. The Act sets requirements by risk category. Uses such as internal drafting and summarising generally sit in the lower categories, while uses in hiring, credit decisions or critical infrastructure carry heavier obligations. In the session we map your uses to the categories and note where legal advice is needed.
Which AI tools does the vendor review cover?
The tools listed in the pre-session questionnaire. These often include ChatGPT, Claude, Gemini or Copilot, plus sector-specific or workflow tools. The framework is written so you can use it on other tools in future.
Who should attend from our side?
The people who own AI decisions: usually the managing director or chief executive, the person responsible for data protection, and one or two operational leads who know how AI tools are used day to day. Someone from finance or legal is useful if you work in a regulated sector.
What does the session cost?
The cost depends on the size of the team attending. Send an enquiry and we will reply with a quote.
Talk to us
Enquire about this workshop
Tell us about your team and your preferred dates.