01
Start with what is really happening
We inventory the AI services in use, how people sign in, what data they touch and which vendors retain or train on inputs. That picture usually drives more practical decisions than a policy written in isolation.