VantagePutting Governance Around AI Tools Already in Use
A professional services firm discovers its teams are using AI tools with client data and no rules. An AI risk assessment and a governance framework mapped to the NIST AI RMF would let the firm decide which tools to keep and answer its clients' questions with evidence.
This playbook at a glance
Professional Services- 2steps in the first 30 days
- 2after day 30
- 3decision points
- 3deliverables at the end
The trigger
The situation a company is in when this conversation starts.A professional services firm learns, from a client's security questionnaire, that it has no answer to the question 'which AI tools do your staff use, and what data goes into them?' An informal survey finds several tools in use across teams, some with client material, and AI features quietly switched on inside software the firm already licenses. Leadership does not want to ban the tools; they want to know the risk and set rules they can defend.
The first 30 days
How Summit would run the work, in order.An AI risk assessment covering the tools in use, the data flowing into them, the vendor terms that govern that data, and the AI features embedded in existing software.
A governance framework mapped to the NIST AI Risk Management Framework's Govern, Map, Measure, and Manage functions, sized for a firm without a dedicated risk team.
After day 30
An acceptable-use policy that names approved tools and the data classes each may receive, with a simple path for staff to request new tools.
A vendor AI review checklist for the firm's own procurement, and prepared answers for client questionnaires.
The decision points
The calls your leadership makes along the way. Summit brings the evidence and a recommendation; the decision stays yours.- Which tools stay, and which are retired because they cannot meet the firm's data terms.
- Which data classes each approved tool may receive.
- Who owns AI governance, and whether it becomes a standing item in the quarterly risk review.
What you’d have at the end
Deliverables written to be used, not filed.- The AI risk assessment report with a tool-by-tool inventory, data flow, and risk rating.
- An AI governance framework and acceptable-use policy ready for the firm's leadership to adopt, with an owner and a review cycle.
- A client-facing statement of the firm's AI governance and a questionnaire answer bank for the partners.
The service behind it
AI Risk & Security AdvisoryThis playbook draws on Summit’s AI Risk & Security Advisory service. Every engagement is scoped to the company in front of us, so the order and the length can change.
How an engagement runs: the 5 stages
- First call
- Scope
- Discovery and baseline
- Analysis and plan
- Readout and handover
More playbooks
- Playbook
Security Due Diligence Ahead of a Healthcare Add-On
Private Equity · Pre-AcquisitionA private equity firm evaluating a healthcare technology add-on needs a clear picture of inherited cyber risk before closing. Summit would run a structured two-week assessment, translate what it finds into deal terms, and set up a 90-day remediation plan for after close.
ServiceM&A AdvisoryRead the playbook - Playbook
Getting to a Readiness Target Ahead of an Enterprise Contract
HealthTech · ComplianceA growing healthcare technology company needs to meet HIPAA obligations to win a major enterprise contract. Acting as Virtual CISO, Summit would build and lead the security program toward its readiness target, on a plan built around a one-quarter deadline.
ServiceVirtual CISO LeadershipRead the playbook - Playbook
Standing Up Governance Without Slowing the Business
High-Growth · GovernanceA high-growth financial services firm has outpaced its informal security practices. Stepping in as Virtual CISO, Summit would establish governance, incident response, and leadership reporting structures sized so they don't slow product delivery.
ServiceVirtual CISO LeadershipRead the playbook