A policy people will follow
Acceptable use written for how your teams actually work, so it gets read once and then obeyed, rather than filed.
365 Cloud Advisors
Responsible AI & Governance
Move faster without losing control.
AI introduces new questions around privacy, security, accuracy, accountability and access to business information. We establish practical governance that enables innovation while protecting the business.
This is for organizations where AI use has already started informally, and the exposure has been accumulating quietly ever since.
The question is not whether your people are using AI. It is whether you know.
Governance has a reputation as the department of no, which is why it gets skipped until something goes wrong. Done properly it does the opposite: it is what lets you say yes quickly, because the boundaries are already agreed and somebody does not have to improvise a decision under pressure.
In practice the exposure is rarely the dramatic scenario people imagine. It is a spreadsheet of customer data pasted into a consumer chatbot. It is an integration with write access nobody reviewed. It is an agent that has quietly had permission to post transactions for four months because that was easiest to configure at the time.
The work is unglamorous and specific: what is allowed, who decides, what AI may touch, where a human must approve, and how you would reconstruct what happened if you had to explain it to an auditor or a customer.
Responsible AI policy and acceptable use
Shadow AI assessment
Data protection and role-based access
Agent permissions and human-in-the-loop controls
AI auditing and output evaluation
Vendor risk and employee education
What you get
Deliverables, not a deck of slides.
An acceptable use policy people will actually read
Short, specific and written in the language of your business — what is fine, what needs approval, what is never acceptable, and who to ask.
A shadow AI picture
Which tools are already in use and what data has been going into them. Almost always more than leadership expects, and better established calmly than during an incident.
A permission and access model
What AI systems and agents may read, what they may write, and how that maps to the roles you already have rather than a parallel scheme nobody maintains.
Human approval checkpoints, by consequence
Where a person must sign off before anything commits — chosen by what happens if it is wrong, not by how confident the output sounds.
An audit and evaluation approach
How AI outputs get checked, how often, by whom, and what the logs need to contain to reconstruct a decision later.
Vendor and model risk criteria
The questions to ask before adopting the next tool, so each decision does not start from scratch.
How it works
Where this sits in the route.
Step 1
Assess
Understand your business, systems, processes and AI readiness.
Step 2
Govern
Implement responsible AI with security, permissions and human oversight.
Step 3
Automate
Deploy AI agents where they deliver measurable value.
Step 4
Optimize
Improve performance, cost, accuracy and environmental impact.
Common questions
The things people actually ask.
Is this going to slow our teams down?
The opposite, if it is done properly. Most delay in AI adoption comes from nobody being sure whether something is allowed, so it sits waiting for a decision. Agreed boundaries remove that wait for the majority of cases.
We are a small business. Is governance overkill?
The scale of the document should match the scale of the organization — for many businesses this is a few pages, not a framework. But the exposure does not scale down: one pasted customer list is the same problem at any headcount.
Do we need this before we start using AI?
Ideally alongside, not before. Waiting for perfect governance is its own failure mode. The practical sequence is to establish the boundaries that matter most, start on something low risk, and extend the governance as the use expands.
Related reading
Written on this, at length.
AI Architecture
Building an AI Integration Layer Around Business Central
Connecting an AI model to Business Central takes an afternoon. Connecting it correctly takes an architect — and you find out which one you did in the incident report.
AI Strategy
Microsoft Copilot vs. Custom AI: Which Is Right for Your Business Central Environment?
The answer is usually both — for different runs. The mistake is buying one pair of skis and expecting them to handle the whole mountain.
AI + Business Central
How to Use AI to Get More Value From Microsoft Dynamics 365 Business Central
Business Central already logs every turn you made. The interesting question is what it takes to make it tell you why you keep catching an edge in the same spot.
Start here
Not sure this is the right run for you?
The Trailhead Assessment is a short set of questions about your systems, data and processes. It ends with a practical map of what to modernize, what to automate, and what to leave alone.