Three questions
Open your AI policy, then answer these.
Who approved the last new AI tool anyone in the firm started using, and where is that written down? What did your staff actually use last month, as opposed to what the policy says they should? And what changed in Australian privacy law this year that affects you?
A shrug, a guess and nothing. That’s a document, not governance.
We’ll be fair about our own side of it. Plenty of providers, us included, have delivered an AI section inside an annual IT strategy and a usage policy in a standard set. Both were honest work. They’re also a couple of paragraphs written without anyone sitting down with your leadership team, and they go stale the week after they’re signed. That’s the limit of what an annual section inside a bigger document can be. It’s why this is a separate service.
What you get, and how often
Monthly
What your staff actually used
A report of the AI tools in use, including the ones you haven’t approved. Adoption figures for the tools you have approved, so you can see whether the licences you pay for are being used. And how AI assistants described, cited and recommended your firm this month, including who they recommended instead.
Quarterly
A session, not a PDF
A standing AI item in your business review with a person in the room. A staff awareness refresh. A check on any new software your own people have built since last time. And a re-audit of how your website reads to AI tools, with a remediation list.
Ongoing
The policy and the registers
Your AI usage policy, owned, maintained and version-controlled by us. Your approved tool register, with a documented process for approving the next request rather than an argument about it. A register of the applications your staff have built, each with an owner and a risk rating. Plus a prompt library and short guides for the tools you’ve approved.
Ongoing
Regulatory watch
Someone here reads the OAIC guidance, the Privacy Act changes, CPS 230 and where ISO 42001 is heading, and writes you a short note in plain English when it matters to you. Most months it doesn’t, and we say so.
And when something goes wrong: AI incident response. A tool leaks, or a model gets something materially wrong and somebody acted on it. You call us.
What it costs
$200 a month ex GST. Existing managed services clients pay $150 a month for the first year.
The web visibility module is a separate line on the same agreement, so you can take one without the other. A marketing-led firm often wants the visibility reporting long before it cares about policy, and that’s a sensible place to start.
Start with a 30-minute AI risk conversation
We’ll ask what your staff are using, what your policy says, and what’s worrying the partners. You’ll leave with a clear view of where your biggest AI risks sit, even if we don’t end up working together.
Book a timeWhy choose Intuitive IT for this?
Who we work with Professional services firms with 10 to 100 staff, and firms with a board, an auditor, a PI insurer or a regulator who will eventually ask. You don’t have to be a managed services client.
What you get The monthly reporting is what makes this a service rather than a document: what staff used, what they adopted, how you’re described, what changed in the rules. The policy and the register are maintained between those reports, not revisited once a year.
How we talk Partners get the risk, the cost and the decision we need from them. Your practice manager or internal IT person gets the full detail whenever they want it.
Who we’re not the right fit for Firms wanting an auditor. We’re not one, we don’t issue assurance against ISO 42001 or anything else, and we’ll say so in writing. Firms wanting the policy without the reporting, because a document nobody checks is the version that gets cancelled. And firms wanting us to support shadow AI: we detect it and report it, the conversation with the staff member is yours.
What’s not included
Stated plainly so nobody discovers it later. Day-to-day coaching on how to prompt sits outside this. Licensing, access and “it isn’t working” is the service desk. “How should I write this prompt” is the prompt library, your own internal champion, or a training engagement. AI strategy work beyond the quarterly review is chargeable. We’d rather tell you now than find a way to charge for it later.
One condition as well. We won’t govern an environment we haven’t assessed, which means a discovery workshop first. Governing something nobody has looked at isn’t a service, it’s a liability, and it’s ours as much as yours.
Someone here reads it so you do not have to
The regulatory watch is a person, not a feed. Someone on this team reads the OAIC guidance and the Privacy Act changes each month and writes you a short note when something touches your firm. Most months it does not, and we say so.
Questions partners ask us
- What does an AI governance service include?
- A maintained AI usage policy, a register of approved tools with a process for approving new ones, monthly reporting on what staff are really using, adoption figures, a quarterly review item, regulatory updates in plain English, and incident response when something goes wrong. The reporting is what makes it a service rather than a document.
- How do you detect AI tools staff are using without telling us?
- Through the device management tools most firms already own, on company devices. We report which unapproved tools are in use and how widely. We don’t read anyone’s messages and we don’t monitor keystrokes, and we wouldn’t offer it if we did.
- Isn’t this already in our managed services agreement?
- Part of it is. An annual AI strategy section and a standard AI usage policy are in most agreements. The monthly detection, the live tool register, the adoption reporting, the visibility work and the regulatory watch are new, and that’s what the monthly fee covers. Worth opening last year’s IT strategy and reading the AI section before you decide.
- Does $200 a month really cover all that?
- It covers it because most of the work is written once and used across every client. A regulatory impact note costs the same to write for one firm as for forty. What’s specific to you is the reporting, the register and the quarterly session, and those fit the fee.
- Do we need to be an existing managed services client?
- No. The service runs standalone at the same $200 a month. Existing clients pay $150 a month for the first year.
- Can we cancel?
- Yes, the agreement is monthly. What most firms find is that the visibility report is the one they’d miss, because it moves and it’s comparative, and the policy work is the one they’d regret dropping.
Send us what you’ve got
If you already have an AI policy, send it over and we’ll tell you what it’s missing against the December 2026 disclosure rules. That costs you nothing and you can do what you like with the answer.
