// Newsletter
Practical essays on data, AI, and adoption.
No noise. One sharp essay on data, AI, or the work of building systems people trust. That’s it.
Authoring the policy, securing executive and legal sign-off, and standing up the committee that keeps it alive.
People were already using AI tools. Nobody had approved them.
Nobody knew what data was going into the tools, what was coming out, or who was supposed to check it.
Leadership couldn't say yes to new tools with confidence. Legal had no visibility at all.
No approved tool list, no data handling rules, no output validation process.
That's not a technology gap. That's a "if this goes wrong, whose fault is it" gap.
Before writing a word of policy, find out what tools people already use, informally, and why. The audit reveals the real risk surface, not the assumed one.
Approved tools, usage guardrails, data handling rules, prompt documentation, output validation. Five pillars, one document. Built from what the team actually ran into, plus what was already working at other organizations.
Take the draft to executive leadership and legal. Negotiate the parts they push back on. Don't launch until both approve it. A policy nobody signed off on isn't governance, it's a document sitting in a folder.
Write the charter, decide the scope, and build the group that owns this going forward. Not one more policy nobody maintains, but a standing committee with a real cadence and clear authority.
New tool requests go through the committee, not around it.
Usage guardrails and data handling rules are documented, not tribal knowledge.
Output gets validated before anyone treats it as fact. Whoever uses the output owns it. No exceptions.
The committee meets on a set cadence to review what's working and what needs to change.
Adoption without guardrails is what slows it down. A policy gives the organization permission to move faster, not slower.
The work that matters happens after you write it: getting executive and legal to approve it, and building the group that keeps it alive.
Audit before you write. The real risk surface is always different from the assumed one, and the policy has to address what's actually happening.
Whoever uses the AI output owns it. That single rule changes how people engage with the tools. AI doesn't get to be the excuse.
Book a strategic advisory session on governance design, or bring "Building AI Governance in Civil Construction" to your next event.
Book a call →No noise. One sharp essay on data, AI, or the work of building systems people trust. That’s it.
