guavaHow should an IT services firm handle AI policy and client data?
Write down which AI tools are approved, what client data can go into them and who approves a new one. Inventory what your consultants already use, check it against client contracts, and review it quarterly. Guava’s Ongoing Optimization & Governance ($4,000 a month) sets this up and coaches your team to run it.
What it covers
- Acceptable-use policy Which AI tools are approved, what data can go into them, who approves a new tool, connector or agent, and how people report a mistake.
- Client-data rules What each client’s contract and NDA allow, which client data can go into which tool, and where a client has to agree first. Keep it in your own tenant, under your admin controls.
- Shadow-AI inventory Every AI tool, connector and agent in use, including the ones nobody signed off: personal ChatGPT or Claude accounts, browser extensions, and apps connected to company email or files.
- Access and connector reviews Who holds admin rights, which Claude and ChatGPT connectors and Copilot agents can reach which data, and which should be switched off.
- Quarterly governance review What was added, what was removed, and what you sign off on for the next quarter.
- Incident guidance What to do when someone pastes the wrong data into an AI tool, or an agent does something it shouldn’t, including when to tell the client.
Why client data changes the job
Your consultants handle other companies’ data every day, under contracts that say what they can do with it. One proposal pasted into a personal account can break a promise your firm made. A written policy and a current inventory also give you an answer when a client asks how you use AI on its work.
Then offer it
Once you run governance on your own firm, you can offer it to your clients, because you already practice what you’re selling. New tools, connectors and agents keep arriving, so it’s recurring work. How an IT services firm starts selling AI services
How Guava does it
- Ongoing Optimization & Governance $4,000 a month after any engagement, cancel anytime. The policy, inventory, reviews, quarterly review and incident guidance above, with your team coached to run governance itself and to offer it to your clients.
- AI Assessment $4,000, 2 weeks. Inventories what’s already in use, alongside the ranked list of workflows. Credited in full toward a Rollout or Implementation.
- AI Rollout $25,000, 3–6 weeks. On Microsoft 365 its Ready phase plans the oversharing cleanup and sets sensitivity labels before Copilot goes live.
Fixed fees, agreed in writing before work starts, and you own everything built. See the engagements
What happened at one firm
As Chief AI Officer at an SF-based tech staffing company, I set up its AI services as an Assessment, then an implementation, then ongoing support. 80% of its implementations stayed on for ongoing support. That’s one firm, not a forecast for yours. See the track record
Questions IT services owners ask
Our people already use AI tools on their own. Is that a problem?
It’s normal, and it’s where governance starts. Inventory what’s in use, then turn it into a policy, access and connector reviews, and a quarterly review your team runs.
Can consultants put client documents into AI tools?
Only into approved tools, and only what that client’s contract allows. Personal accounts are the first thing to close off. Your lawyer should read the contracts that matter most.
Should we ban personal AI tools?
A ban tends to push the use out of sight. Give people an approved tool and a clear policy, then inventory what’s left.
How often should it be reviewed?
Quarterly, with an access and connector review whenever a new tool, connector or agent is added.
Will Guava run governance for our clients?
No. I coach your team to run governance itself and to offer it to your clients, so your people deliver it without me.
More questions IT services owners ask
Talk it through.
Twenty minutes on what your consultants are already using. Prefer email? romeo@workwithguava.com