Business agreements
With OpenAI, Anthropic, Google or Microsoft, ensuring your data isn't used to train the models.
An AI strategy that stands up in practice
Most companies already use AI – often without anyone deciding how. We help you choose where it can make a difference and set the ground rules before problems arise.
An AI policy your team can actually understand
An AI policy doesn't need to be long. We write it in a page or two, with practical examples, so it's easy to follow day to day rather than read once and forgotten. It answers four questions.
01Which tools are approved?
We list the AI tools your team can use and the accounts they should use them with. Business agreements rather than personal subscriptions, so your data isn't used to train the models.
- Approved tools and accounts
- Business agreements, not personal subscriptions
- How to request a new tool
02What can they be used for?
Which tasks suit AI, and which always need human review – such as copy sent to a client or decisions that affect an individual.
- Examples of appropriate use
- What always needs review
- Transparency with clients
03What data must never be entered?
Personal data, trade secrets and anything else that must stay within the company. The policy gives practical examples, so no one has to interpret legal language.
- Practical examples for each type of data
- Aligned with GDPR
- What to do if something goes wrong
04Who do you ask if you're unsure?
A named person or team that answers questions and keeps the policy up to date as tools change.
- A clear point of contact
- Updates as tools change
- Part of onboarding for new staff
AI security: where does your data end up?
The right permissions
AI only sees what it needs, and the same rules that apply to your staff apply to AI.
Storage and region
We choose where data is processed and stored. Several providers now offer storage within the EU.
Documentation
What data is processed, where and why – so you have answers when clients or auditors ask.
How we develop an AI strategy
A few weeks, not six months. The result is a plan you can start putting into practice straight away.
- 01
Current situation
Which AI tools are already in use, by whom and with what data? There's often more AI in use than management realises, sometimes through personal accounts. We interview key people, review licences and systems, and identify the tasks that currently take up the most time.
- 02
Priorities
We assess tasks by their potential value, risk and implementation complexity, then choose where you should start. The best starting point is rarely the most ambitious idea. It's a time-consuming task with clear rules where mistakes can be spotted. Everything else goes on a prioritised list.
- 03
Ground rules
Approved tools, what they can be used for and what data must never be entered – all brought together in an AI policy. We review the agreements for the tools you want to use: where data is stored and whether it's used for training. The policy is written so your team can understand it, with practical examples of what's acceptable and what isn't.
- 04
First pilot
A practical plan for your first solution, with measurable targets: time per case, response time or the proportion of cases handled without manual work. The pilot is small enough to get started quickly, but realistic enough to show whether the idea works. We'd be happy to build it, but the plan works with another provider too.
The AI Act in practice
The EU AI Act sets requirements based on risk. For most companies, it's about knowledge and transparency, not bans. We review the AI systems you use and the rules that apply, then help you put everything in place – working with your legal adviser where needed.
AI tools
If you use AI, your staff must have sufficient knowledge of it. This requirement has applied since February 2025.
Chatbots
Anyone interacting with AI must be told, and AI-generated content must be identifiable.
Sensitive decisions
AI used in recruitment, credit assessments and similar areas is classed as high-risk. Stricter requirements apply and are being phased in.
Prohibited uses
Some uses have been banned since February 2025, such as social scoring and exploiting people's vulnerabilities.
GDPR and AI
Whenever AI processes personal data, GDPR applies as usual. That means having a lawful basis for processing, a data processing agreement with the provider, and collecting no more data than you need. If there is a high risk to data subjects, a data protection impact assessment is also required.
We build solutions that keep personal data away from AI when it isn't needed, and document the rest.
What is an AI strategy?
An AI strategy comes down to a few decisions: where to use AI first, which tools and rules to use, and how to tell whether it's making a difference. It doesn't need to be long. It should make it easy to say yes to the right things and no to the rest.
Most companies already use AI – often without anyone deciding how. So the strategy starts by finding out what's already in use, and fits into your digital strategy as a whole.
Frequently asked questions about AI strategy and security
Can't find the answer? Book an AI review or call us on 070-953 53 99.
AI review
30 minutes, one of your workflows
We look at a task that currently takes up time and give you an honest recommendation: AI, conventional automation or no change at all.
- A brief written proposal for next steps afterwards
- Meet the people who will build your solution
- Free of charge
