A1 Technologies launches AI governance service for mid-market organisations
As adoption outpaces governance, new service aims to help manage AI services.
A1 Technologies has launched Guardrails, a security and governance service aimed at helping mid-market organisations manage their AI services.
A1 Technologies is finding that increasingly organisational leaders need to address questions from regulators, insurers and customers about how AI is used.
This service aims to identify and manage sanctioned and unsanctioned AI. It’s designed for organisations with Microsoft 365 environments and includes both Microsoft and non-Microsoft AI platforms including Claude, Gemini, ChatGPT.
“[Guardrails] leverages Microsoft solutions, overlaid with our own management, reporting and governance capabilities built around providing a clear picture of your full AI estate and a framework to govern and manage it,” said Clint Shiels, technical director, A1 Technologies.
The service runs as a quarterly cycle with four stages. Engagements start with a fixed price survey that gives the organisation a compliance score, which is a measure of how much of its AI is known, owned, controlled and recorded. A1 Technologies measures the score again each quarter.
The next step is to develop AI policies, acceptable-use requirements, governance responsibilities, agent lifecycle management and employee guidance.
Shiels explained that policies are tailored to how that business actually uses AI. “For example, one business might allow ChatGPT for marketing but block it for finance,” he said.
For organisations struggling to get a handle on AI, Shiels said identifying AI is the critical first step because most organisations find far more than they expected.
“Give each tool an owner, fix overshared data and give staff clear rules. With Privacy Act changes coming on 10 December, you can't disclose AI use you haven't mapped,” he said.
AI management is then handled with Microsoft Defender to identify and control AI applications, Purview to protect sensitive information and Agent 365 to support governance of agent identities, access and activity.
The fourth element is executive reporting, risk reviews, AI usage and data security reporting and agent lifecycle oversight that provides ongoing visibility of AI usage.
“Each month we report on what AI is being used and what sensitive data it's accessing. Each quarter we review every agent, who owns it and what it can access, and give leadership a report on the actions needed,” he said.
Shiels is finding that AI governance is still pretty low among many organisations but as AI adoption grows, it’s creating a visibiity and security gap.
“As [organisations] drive more initiatives through AI, it's becoming critical to establish a functional framework to not only control and manage what AI platforms are being used, but what they are connecting to, and to have the ability to report on it,” he told CRN Australia.