1. Demos use fictional data
Public examples run on invented businesses and invented records. Real client information is never used in a demo.
Motley IT Assurance / AI Work
AI GOVERNANCE • PLAIN ENGLISH
How I govern AI
Short, practical rules for using AI in a small business, and the standards I hold my own work to.
60-SECOND WALKTHROUGH
See both tools in about a minute
Narrated by Mike Motley, with captions. Watch on YouTube
Standards I hold my own AI work to
When I build or demonstrate an AI workflow, these are the rules. If you hire me for AI-related work, they apply to your project too.
2. A person approves what leaves the building
AI output is a draft. Anything customer-facing or decision-relevant is reviewed by a human first.
3. Claims must trace back to evidence
Where AI summarizes technical findings, each statement should point to the data it came from. If it cannot, it is removed.
4. No overclaiming
An inventory of settings is not a security test. I do not call a system “secure” or “compliant” on that basis, and I say what was not checked.
5. Least access
AI tools get the minimum access to data they need. Passwords and secrets never go into prompts.
6. Read the vendor terms
Before using a tool with business data I check how long data is kept, where it is stored, and whether it is used to train models.
What data belongs in an AI tool?
A simple three-level rule that most small businesses can adopt today. Adjust it for your industry and any contracts or regulations that apply to you.
| Level | Examples | Rule |
|---|---|---|
| NEVER | Passwords and access keys; payment card numbers; government ID numbers; health records; confidential contracts under NDA | Do not enter into any AI tool. |
| WITH APPROVAL | Customer names and contact details; internal financial figures; employee information; vendor pricing | Only in an approved business-tier tool, only when needed, and only with the owner’s OK. |
| GENERALLY FINE | Published marketing content; public information; generic questions; fictional or anonymized examples | Any approved tool. Still review the output. |
Not legal advice. If your business handles regulated data (for example health or payment data), check the specific rules that apply to you.
Five questions before adopting any AI tool
- What data will it see? Match it to the table above.
- Where does that data go, and how long is it kept? Read the provider’s data and retention terms.
- Is it used to train the provider’s models? Business-tier plans often say no. Confirm in writing in the terms, not in a sales page.
- Who can connect it to our email, files or accounting? Limit that to an administrator.
- Who reviews what it produces? Name the person.
Free AI Acceptable Use Policy template
A short, editable Word document you can adapt in an afternoon: purpose, approved tools, data rules, human review, accounts and access, incident handling, training and review. It uses plain language so staff will actually read it.
This template is a starting point, not legal advice. Have it reviewed against your own contracts, insurance and any regulations that apply to your business.
Where to go next
See where your business stands with the AI Readiness Check, or ask for an independent look at your technology with a Health Check.