AI Governance in 30 to 60 Days: A Practical Plan for Louisiana Businesses

Your team is already using AI. Someone is asking ChatGPT to clean up an email, someone else has Copilot summarizing meeting notes, and a third person found a free tool that writes proposals. None of that is a problem on its own. The problem is that most businesses have no written rules for it, no idea which tools are in use, and no way to show an insurer, auditor or client how AI is being governed.

The good news: getting AI under control does not take a year-long project. For most small and mid-sized businesses, it takes 30 to 60 days, depending on team size and how many AI tools are already in use. Here is how we approach it.

Who this is for

This plan is built for businesses whose staff already use ChatGPT, Copilot, Claude or Gemini without written rules. It matters most if you handle client data, answer to a cyber insurance carrier or auditor, or work with an IT provider that does not address AI at all.

Phase 1: Discover

You cannot govern what you cannot see. The first step is an AI readiness assessment and a shadow AI scan, which show exactly which AI tools your team uses and what data touches them. Most owners are surprised by the answer. Unapproved tools are unmanaged risk, and this phase puts them on the table.

Phase 2: Decide

Next comes data classification: drawing a clear line on what may and may never go into an AI tool. That line is built around your clients, your contracts and your compliance obligations. As a starting point, these should never go into a prompt: passwords, Social Security numbers, card numbers, patient or client records, payroll and unreleased financials.

Phase 3: Document

With the line drawn, it gets written down. Your team receives a plain-language AI acceptable-use policy that every employee reads and signs: what is allowed, what is not, and who to ask. Alongside it, we complete a security review of the AI vendors your business relies on, including whether they train on your data and how long they keep it.

Phase 4: Train and prove

A policy only works if people follow it. The final phase is safe-use training for your staff, plus an evidence pack you can hand to insurers, auditors and clients when they ask how you govern AI. That pack is increasingly the question carriers and clients are asking.

Ten settings you can check this week

While the full program runs, there are practical settings any business can check right now:

• Use approved AI tools on business accounts the company owns and manages.
• Turn off model training on your data, and confirm it on business tiers.
• Require multi-factor authentication and single sign-on on every AI account.
• Define in writing what never goes into a prompt.
• Put a plain-language AI use policy in writing and have every employee sign it.
• Have a person review AI output before it reaches a client, a contract or a financial decision.
• Control which systems an AI tool can reach, and clean up file access before connecting it.
• Lock down company-wide settings in the admin console so they apply to everyone.
• Verify the request, not the voice: confirm any request for money or passwords by calling back on a number you already have.
• Back it all with 24/7 monitoring and response from people who act on alerts.

Free download: AI Security Best Practices

We put those ten settings, with why each matters and the risk of skipping it, into a one-page guide for owners and managers. Download AI Security Best Practices from our free resource library.

Where to start

Every engagement starts the same way: with a clear picture of where you stand today. Take the free Cyber and AI Risk Assessment. It takes about five minutes, and a member of our team reviews every report personally before it goes out.