What is AI governance?
AI governance means controlling company AI services, ownership, data access and sign-in. A policy and approval process define how services may be used and reviewed.
Consulting services / ITKoncept
AI governance for business
AI governance means knowing which AI services your business uses, who owns them, what company data they can access and how people sign in: through Entra ID and SSO or personal accounts. An AI policy defines approved use. We map the current setup and help put controls and an approval process in place.
Start with a Microsoft 365 assessmentExample: what an inventory can look like
| AI service | Owner | Users | Company data? | Sign-in | Status |
|---|---|---|---|---|---|
| Microsoft 365 Copilot | IT | 42 | Yes, through Microsoft 365 permissions | Entra ID | Approved |
| Copilot Studio (agents) | IT/Business | 6 | Yes, the agent’s connected sources | Entra ID | Under review |
| ChatGPT Enterprise | Marketing | 12 | Yes, uploaded files and connectors | SSO via Entra ID | Under review |
| Claude / Perplexity with personal accounts | Unknown | Unknown | Unknown | Personal accounts | Being mapped |
| Free AI tools on the web | None | Unknown | Risk of company data being pasted in | No sign-in / personal account | Unapproved |
Approved: authorised for the stated use. Under review: risks and conditions are being assessed. Being mapped: ownership or usage is unknown and needs review. Unapproved: must not be used for company work.
What we do
AI service inventory, including shadow AI: We review enterprise apps, sign-in logs and app consents/OAuth grants in Microsoft Entra ID. These logs only show apps that sign in through Entra. Cloud Discovery in Microsoft Defender for Cloud Apps has a generative AI category. Network data from sources such as Defender for Endpoint can also reveal use of these services, including with personal accounts, on onboarded devices. Coverage depends on licences, configuration and available data.
Identity and access: We configure SSO through Entra ID for approved services that support it. We restrict or block user consent to apps, review Conditional Access and define who may use what.
Data protection: We review Microsoft Purview sensitivity labels, oversharing in SharePoint and OneDrive, and DLP. Microsoft Purview DSPM for AI can provide visibility into AI interactions with sensitive data where supported and configured.
AI policy and approval process: We document approved services, who approves new ones and which data may be used where. We also define how decisions are followed up.
Copilot readiness: We assess identity, permissions and data protection before Copilot rollout. The Microsoft 365 assessment includes Copilot readiness.
How it works
Inventory
We collect services, owners, users, data access and sign-in methods. Unknown details are flagged for further review.
Assessment
Each service is assessed as approved, under review or unapproved. Services with unknown usage remain marked as being mapped until there is enough information.
Actions
We implement agreed changes to SSO, consent settings and sensitivity labels. The AI policy sets out rules and responsibilities.
Follow-up
We review new services, changes in data access and previous decisions on a recurring basis.
We work remotely across Sweden and on site in the Stockholm area.
Common questions
AI governance FAQ
What is shadow AI?
Shadow AI is AI used for work without the company’s knowledge or approval. This can include web tools or services with personal accounts where company data is entered.
How do we see which AI services are being used?
Entra ID shows apps and sign-ins that go through Entra. Defender for Cloud Apps can add Cloud Discovery. Network data from sources such as Defender for Endpoint can also reveal use of these services, including with personal accounts, on onboarded devices. Discussions with the business are also needed. No single log shows all AI use.
Do we need an AI policy?
If AI is used for work, staff need clear rules. The policy should define approved services, permitted data, responsibilities and how new services are reviewed. It needs updating as usage changes.
How does AI governance relate to Copilot?
Copilot is one of the AI services that need governance. Copilot readiness focuses on Microsoft 365, permissions and data protection. AI governance also covers other AI services and personal accounts.
Consulting services / ITKoncept
Related consulting services.
IT architecture and advisory
Understand the current environment, assess options and plan delivery.
Microsoft 365 and Exchange consultant
Migration, operational support and troubleshooting in your environment.
Microsoft 365 Copilot for business
Licence selection, permissions and Copilot rollout. From readiness checks to a pilot and follow-up.
Microsoft 365 assessment
Review of Microsoft 365 security, mail flow and licensing, including Copilot readiness.
Microsoft Teams: rollout, telephony and governance
Rollout, Teams Phone, migration and governance of Teams.
Email security consulting
Map your senders and take control of mail authentication.
Free Microsoft 365 environment review
An initial review with a short written summary.
Next step
Find out how your business uses AI
Start with a Microsoft 365 assessment that includes Copilot readiness. Contact us to map other AI services and develop an AI policy.
Start with a Microsoft 365 assessment