AI POLICY CONSULTING
We audit how your company really uses AI, write an internal AI policy built for your tools, your clients, and your contracts, and embed the rules into daily work, not a PDF nobody reads.
Three ways companies usually get an AI policy. Three ways it fails.
Security questionnaires ask how the rules apply to your tools and your client data. A template downloaded from the internet has no answer to give them.
When no one knows what is allowed, people either stop using AI or start hiding it. You lose the speed or you lose the control, and sometimes both at once.
Clients and regulators increasingly want proof that controls operate: approvals, briefings, review logs. A signed PDF on its own produces none of it.
Three stages, one outcome: rules that match reality and hold in daily work.
We map how your company actually uses AI today, before a single rule is written. Guesswork gets replaced with a clear picture of what is really happening.
We draft a policy built for your company: your tools, your clients, your contracts. Not a template with your logo on the cover.
Rules only matter where the work happens. We integrate the policy into your processes and stay until it holds on its own.
The policy maps to these so security reviews and tenders get direct answers. We write them in plain language, not legalese.
Not every framework applies to every company. The audit identifies which ones actually touch your business.
Four steps. The first costs you just half an hour.
Thirty minutes. Which AI tools are in play, what your clients are asking of you, and whether a policy is the right next step at all.
We map tools, accounts, workflows, and client contracts, then summarize findings and gaps before any drafting starts.
We write the policy, your leadership reviews in short iterations, and we adjust until the rules match how you actually deliver.
We embed the rules into your processes, brief the team, and leave you the policy with its review schedule.
In their own words: what changed once the rules were real.
Right after the workshop I got a question from one of our lead devs - "Ok now, great workshop - should we change something in our dev work or was it only for our knowledge? Probably tomorrow we will continue working the same way". The best outcome from this workshop was aggregating the knowledge and creating an AI policy for all our dev team to follow. This policy was created specifically for our custom AI usage to be confident from a business perspective and to be protecting our clients from AI threats. After the seminar it took us only 2-3 days to meet and discuss with Stihia experts what AI policy to create and half a day to propagate it to all company members. Great and efficient work. Definitely would recommend.
Education makes the rules stick. A named owner keeps them alive.
Hands-on training that turns policy from text into habit, and keeps the team current as the risks change.
A named owner who keeps the policy applied, reviews new tools, and answers client security reviews for you.
The whole path (educate, govern, sustain) in one engagement, for teams moving to AI-first delivery.
Usually yes, as a dedicated document or an addendum. AI tools raise questions a generic security policy never answers: which tools are approved, what can go into a prompt, who may ship AI output to a client. We fit the AI policy alongside your existing documents, not instead of them.
The opposite. The rules exist so people can use AI without guessing. A clear approved-tools registry and a fast approval flow mean more AI, safely, not less.
A template does not know your tools, your contracts, or your clients. Most of the value is in the audit and the implementation, not the text, which is exactly where a template has nothing to offer.
Depending on how you build and use AI, parts apply, for example the AI-literacy obligation and transparency duties. Regardless of strict applicability, your clients and their procurement teams are already asking these questions. A written policy answers them in one place instead of case by case.
Common in outsourcing. Your policy defines how the team discovers, follows, and escalates conflicts between client rules and your own. We bake that into the employee responsibilities section, so a clash never gets quietly ignored.
Typically a few weeks from kickoff to a signed policy, depending on review cycles. The audit runs about one to two weeks; drafting and implementation follow. We agree timing on the intro call so nothing drifts.
We provide English and Bulgarian natively, often both in the same engagement. Other languages are available on request. We also align the policy with the local laws of the country you operate in.
Yes. A written policy is the first thing they ask for; together with training records and a named owner, a security review gets answers instead of scrambling. That is where the fractional officer and the workshop come in.
Fixed price, scoped after the intro call. It depends on company size, the number of client contracts to map, and how much of the implementation you want us to run. You see the price before you commit to anything.
Start with a half-hour call. Tell us which AI tools your team uses and what your clients ask of you, and we will tell you honestly whether policy work is the right first step.