AI usage review before you write the policy

A technical audit can verify activity and configuration inside systems it can inspect. Interviews can reveal reported use of personal accounts, privately purchased subscriptions and informal work that those logs may miss. Neither method proves the whole picture alone. We state the evidence boundary in the report and recommend technical checks where they are justified.

Good framing improves the chance of candid answers, but an interview remains self reported evidence. We explain that the review is not disciplinary, use a representative sample and avoid attributing ordinary comments to individuals. Leadership must approve that framing before interviews begin.

The typical elapsed time is under three weeks. We quote a fixed price based on organisation size and the agreed staff sample, with the scope and figure confirmed before interviews begin.

No. The engagement is interview based and document light. We do not log into Microsoft 365, devices, networks or any other system. That boundary limits access to sensitive systems and keeps the evidence type clear.

It is a starting draft, not a final legal document. We write it in plain English and base it on how the team works in practice. HR and legal should review it before sign off.

Yes. We work with not for profits, allied health, disability and aged care providers regularly. The data sensitivity in those sectors is exactly why a usage review matters before a policy is written.

That is a separate scope, and often we recommend your existing IT provider does it because they already manage your environment. The report states what to ask for, and we can brief the provider. Implementation is independent of the review.