LEXLEKS
AI Policy & Controls
Lex is Latin for a law: a written rule that applies to everyone. Our policy is short enough to follow, and backed by settings in your tools so the rule holds when nobody is checking.
A written AI use policy your staff can follow, and the settings that enforce it.
$4,500, fixed, for organizations up to 500 staff. Builds on a shadow AI review if you have one; we run a short discovery if you do not.
Is this for you?
- Companies with no written AI policy, or one nobody follows
- Teams that want approved AI tools for staff instead of a ban that is ignored
- Organizations that need to show customers or auditors how AI use is governed
The problem
A policy nobody reads protects nobody.
Many AI policies are long, legalistic, or ban everything, and staff work around them. Others exist only as an email from IT.
What works is short: approved tools, data that never goes in, and who to ask, with the settings in your tools doing the enforcing.
How we work
One page of rules, backed by settings.
We draft the policy from your shadow AI review, or a short discovery, and review it with your leadership. The approved-tools list gives staff a safe default on business accounts.
Then we configure the controls you already own with your administrator: business accounts, training off, retention limits, single sign-on, and blocking where you decide. A 30-minute briefing explains it all to staff.
Typical controls
What usually gets configured.
Typical controls in common office suites and identity providers.
- Accounts
Business accounts
Approved tools on business plans with admin control.
- Vendor settings
Training off
Training on your data switched off where the vendor allows it.
- Identity
Single sign-on
Access through your identity provider, ended when people leave.
- Retention
Retention limits
Conversation retention set to the shortest workable period.
- Blocking
Unapproved tools
Blocked or warned at the browser or network, where you decide.
- Features
Built-in AI features
AI features in existing software reviewed and set deliberately.
What you receive
A one-page AI use policy
Approved tools, data that never goes in, who to ask, and how exceptions are approved, in plain language.
An approved-tools list
Which AI tools staff may use, on which account type, for which data.
Control configuration
Settings in the tools you already have: business accounts, data retention off, sign-in through your identity provider, and blocking where agreed.
A staff briefing
A 30-minute session, recorded, explaining the policy and the approved tools.
How it works
Review
Start from your shadow AI review, or a short discovery of tools and data.
Draft
A one-page policy and approved-tools list, reviewed with your leadership.
Configure
Controls set in your existing tools, with your administrator.
Brief
A 30-minute staff briefing, and a check that the controls work.
What done means
A policy staff know, and settings that hold.
Each item is checked before the engagement closes.
- Policy approved
- By your leadership, in one page.
- Controls set
- Each agreed control configured and checked.
- Staff briefed
- The briefing delivered and recorded.
- Owners named
- A record of each control and who owns it.
Common concerns
What leaders ask before they sign.
- Not legal advice
- Have counsel review the policy where regulation or contracts apply.
- Bans
- Blocking is your decision. Approving good tools usually works better.
Who does what
Who authorizes, who tests, and who fixes.
Your team
- Approve the policy and tools list
- Provide an administrator
- Host the staff briefing
Custos
- Draft the policy
- Configure and check controls
- Brief staff
- Record each control
Afterward
Where clients go next.
Most take one of these routes. You choose, and nothing starts without your approval.
Keep watch
Monitoring checks the controls monthly for drift.
Test what you build
If you build AI, a red-team assessment covers that track.
Before you start
What to have ready.
- Your shadow AI review, if you have one
- An administrator for your office suite and identity provider
- A date for the staff briefing
Related services
What is included
Fixed scope, agreed in writing.
- Your leadership approves the policy and the approved-tools list.
- Each agreed control is configured and checked with your administrator.
- The staff briefing is delivered and recorded.
- A short record lists every control, where it is set, and who owns it.
Request AI policy and controls
Tell us where AI use stands today.
We reply with the scope, the timeline, and an engagement letter at the fixed fee.
- An engineer reads every request
- A reply by email within two business days of receipt
- No obligation until scope and price are agreed
Not ready to scope this? Ask a security engineer first: a free 20-minute call on where your AI risk is.
Where this fits
- Check Shadow AI check
- Review Shadow AI Review
- Control AI Policy & Controls
- Monitor AI Security Monitoring
Not ready yet? Shadow AI Review. After this: AI Security Monitoring.
Questions
Is this legal advice?
No. The policy is an operational document. Have counsel review it where regulation or contracts apply.
Will you block AI tools?
Only where you decide to. Most companies get better results by approving good tools than by banning all of them.