When your people use AI tools
AI Usage Oversight
We show you the AI in use across your business, help you control the risky parts, and give your board an AI policy and a quarterly report, without you building a team to do it.
Our services
Two managed services, one route as your use of AI grows.
Most organisations start by getting control of the AI their people already use. When AI starts doing real work in your systems, or your customers start instructing it directly, each step up needs a decision, an owner and evidence behind it. We run a service for each, and everything you build in the first carries into the second.
When AI starts doing the work
The AI governance service
When agents act in your business systems, or AI reaches your customers, we run the governance with you, independent of whoever builds the AI and alongside your risk and audit teams. You get the evidence your board, clients, insurers and regulators will ask for: a named owner, a decision and evidence behind every step up.
Which fits you
It depends on how far your AI already goes.
The walkthrough tells you which fits, and we say so if you need neither yet. The three stages in full →
Stage 1 · AI helps your people work
Start with AI Usage Oversight
People use AI tools, but no AI acts in your systems on its own or deals with your customers.
Stage 2 · AI does the work
Move to the governance service
An agent acts in your systems, or soon will. Come straight from an AI review (a short, fixed piece of work showing what AI is in use and where the risks sit), or move up from AI Usage Oversight.
Stage 3 · AI becomes your business
Add customer-facing controls
Customers or outsiders instruct your AI, or it decides outcomes for them. Each of those uses gets outcome monitoring, a record that explains its decisions, and a rehearsed incident plan, without moving your whole organisation up a level.
AI Usage Oversight
See the AI your people use, and control the risky parts.
It answers three questions many leadership teams can’t answer today.
- What AI is in use across the business, and in which teams?
- Which of it puts client data, systems or reputation at risk?
- Is our AI policy actually followed on people’s devices, and what are we paying for AI we don’t use?
You make the decisions and your IT switches the rules on. AI use is reported by tool and team rather than by individual, we recommend it isn’t used for performance management, and we help you tell staff what is recorded before anything starts. We find the AI in use, advise you and keep the evidence.
The AI in use, found
The AI tools, add-ons and connectors your people use, and the AI in your Microsoft 365, including personal accounts linked into company systems, on company-managed devices and work accounts only. We never look inside personal accounts.
The riskiest dealt with first
What each tool can reach and which put client data or systems at risk, with unsafe tools blocked by your IT under rules you approve.
An AI policy and a register
An AI policy for your board to approve, and a register of every tool and agent, kept in your own Microsoft 365.
A fast route for new tools
An approved-tools list and a simple way for staff to ask for a new one, so good ideas get a quick answer rather than a workaround.
Monthly risk and spend report
What was found and approved, what needs a decision, and the AI licences you are paying for but not using.
Quarterly board report
One page for your board, with evidence mapped to ISO/IEC 42001, the NIST AI Risk Management Framework and, where it applies to you, the EU AI Act.
The AI governance service
Decide how far your AI goes, and show that the decision holds.
You wouldn’t give a new employee more freedom to act on their own, or direct contact with your customers, until they had shown they follow your processes and do a consistently good job. The governance service brings the same discipline to AI. No use moves up a stage without a decision by a named person, on evidence, and a use that goes beyond what was approved is picked up in the regular review and recorded in your register.
Your business decides what good looks like and confirms it, using evidence from the testing your builders already do, whether they are your own teams, an IT partner or a vendor. Your people make the decisions as part of their normal jobs; we run the process with them and report on it to you and your risk function. No AI lead yet? We can provide one for a limited period while you appoint or train your own, and the decisions stay with your people throughout. Read: Who Leads AI Here? →
An owner for every use
Every use of AI and every agent has a named owner, a defined job and written limits, with the riskiest decisions reviewed and challenged by your risk function.
A gate before each step up
Before an agent acts on its own, it is shown that it can be stopped and the work carries on without it. Before customers instruct your AI directly, or it decides outcomes for them, AI failures are part of your incident plans and rehearsed.
Probation for new agents
A new higher-risk agent serves a probation before it acts on its own, ending in a recorded decision.
Control stays with whoever asked
The person who asked for an agent sets what good looks like, confirms the agent meets it, sees whether it is working and can pull it back. Approval follows your policy.
Closer support only where it’s needed
Higher-risk agents and customer-facing uses get more of the attention, so the effort goes where the risk is.
A board view in one page
A scorecard for management and one page a quarter for your board, showing whether AI is within its policy and what needs a board decision.
Access that fits the job
Each agent is matched to the identity it acts under and what that identity can reach. An agent that can reach more than its job needs is flagged to its owner, and your IT makes any change you decide on.
Moving from one to the other
What you have built carries over when you move up.
Both services run in your own Microsoft 365 tenant. When you move to the governance service, your register, policy and evidence carry straight over, and your AI policy becomes the starting point for your board’s AI policy.
An agent already live?
You don’t have to wait for set-up.
If a higher-risk or customer-facing agent is already live, or about to go live, AI stabilisation helps your team put it on probation quickly and ends with a clear decision on what happens next. It doesn’t commit you to the governance service.
In both services
The business decides. Your IT keeps control. You keep the evidence.
Your decisions
Your leadership makes the decisions about AI, so accountability sits with the business rather than with IT or a supplier. We draft, advise and check the process is followed; independent assurance comes from your internal audit or a third party.
Your systems
We don’t change your agents or operate your controls. Whoever runs your IT stays in control.
Your data
No Peruze person sees the content of your documents, emails, chats or agent conversations. Your register, policy and evidence stay in your own Microsoft 365, and you keep them if you stop.
Your record carries on
Change your build partners, AI models or tools, and your register, decisions and evidence carry on unchanged. A vendor’s own governance features leave with the vendor.
Our checks are our own, not an audit opinion or a certification, and our work is not legal advice.
Not sure which fits?
In a 45-minute walkthrough we talk through the framework, where AI already sits in your business and the right first step.