SunCrest Law / Services / AI governance
AI governance that survives contact with your workforce.
Most companies are further along on adoption than governance. Employees are already pasting confidential material into consumer AI tools, vendors are already shipping AI features into products you license, and the board has started asking what the exposure is. The answer is not a policy nobody reads.
- Employees are using AI tools with no policy, or with one written before the tools existed.
- The board, an auditor, or an insurer has started asking about AI oversight.
- You are buying AI-enabled software and nobody is reading the data terms.
- You operate in Utah, Colorado, the EU, or another jurisdiction with AI-specific obligations arriving.
The failure mode is not usually a bad policy. It is a policy with no institution behind it — no committee, no owner, no cadence, no path for an employee who has a question at 4pm on a Tuesday. This program builds the policy and the structure that keeps it current, then trains the people making the daily calls.
It also treats vendor diligence as a first-class problem rather than an afterthought, because the largest realistic exposure for most companies is not what employees type into a chatbot. It is what a vendor's terms permit them to do with the data you have already handed over.
What you get
Every item below is a document or a working process delivered to your team — not a memo describing what one would look like.
-
01
AI use policy
Drafted to your risk posture, your workforce, and the tools actually in use — not a template with your name on the cover.
-
02
Committee charter
Membership, authority, meeting cadence, decision rights, and the escalation path for questions that arrive between meetings.
-
03
Vendor evaluation framework
A repeatable review standard, plus a completed assessment of the AI tools already in your environment.
-
04
Training module
Built for the people who make judgment calls daily, with a rollout plan and a refresh schedule.
-
05
Data-handling controls
Practical rules for personal data, trade secrets, and third-party confidential information entering AI systems.
-
06
90-day adoption roadmap
Sequenced, owner-assigned, and sized to what your team can actually absorb.
Quarterly committee support, review of new tools as they are adopted, annual policy refresh, and regulatory monitoring as AI-specific obligations continue to arrive.
Ongoing work is arranged separately once the program is complete, so the decision to continue is made with the finished product in hand rather than at the outset.
Chaired the AI committee of a NASDAQ-listed company — policy drafting, committee structure, vendor terms review across major model providers, and an enterprise adoption program. Chair of the Cyberlaw Section of the Utah State Bar, where he organized a day-long AI conference featuring the general counsel of Adobe.
How this is priced
This program is quoted as a fixed fee, agreed in writing before any work begins. The scoping call that produces the quote is free and carries no obligation. Where a matter genuinely does not suit a fixed fee, that is said upfront rather than discovered at the first invoice.