Map of current uses
Identify the tools, automations and practices already in place, then separate what is useful, what must be framed and what should be stopped.
Rules, data and responsibilities
AI governance for SMEs
Put AI governance into practice without slowing down your teams.
People are already using ChatGPT, Claude, Copilot, assistants and automations. Those uses often move faster than the company’s rules.
Leadership needs to decide which uses are allowed, which data can be used, who reviews the outputs, who remains accountable and how new tools should be framed.
Mahthildis takes on the design, implementation and steering of that framework. Paulo Castro remains your principal counterpart. He can design, steer and take direct charge of an operational scope.
Situations
When AI governance becomes necessary
AI is already in use, but no rules have been set.
Sensitive information is going into external tools, without a clear frame.
AI-produced or AI-assisted outputs go out without human review.
Agents or automations act without rights, logs or an owner.
AI tools keep multiplying, each with its own habits.
Rules exist on paper, but they are not applied.
Illustrative scenario
Framing the use of AI assistants
People are using AI assistants to summarise client documents and draft commercial replies. Which data can go in, which tools can be used and what review is required still need to be defined.
- Define which data may enter an assistant, which must stay internal, and which tools can be used.
- Name who reviews a commercial reply, who remains accountable for a document that goes out, and who can stop a use.
- Build those rules into working practices, explain them to users and adjust them when new uses appear.
The outcome we look for is AI use framed in day-to-day work, not just another charter on paper. This scenario illustrates the engagement; it is not a completed client reference.
Scope
What Mahthildis takes on
This is not a one-off audit or an isolated second opinion. Mahthildis builds a usable framework, puts it in place with the teams and can keep steering it if the need lasts.
Rules of use
Define which uses are allowed, which are conditional and which should be ruled out, including data that must not enter an unapproved tool.
Responsibilities and review
Name who decides, who reviews an output and who remains accountable when a result affects a client, a budget or a decision.
Controls inside the work
Build the controls into real processes: access rights, review, logs, escalation thresholds and decision points, rather than leaving them in a standalone document.
Support and training
Work with business and technical teams so the rules are understood, usable and kept. Awareness sessions are part of the engagement when they help.
Keeping the framework current
Review the frame when a new tool arrives, a use spreads or a risk changes. Governance should be able to evolve without freezing everything.
How it works
How the engagement is run
The first conversation is there to understand the situation. The engagement itself is paid. It can stay short or continue as ongoing support, depending on the need.
01
Understand the uses and the context
See what is already in use, which data is involved, which teams are concerned and which decisions leadership needs to be able to hold.
02
Build the governance frame
Write the rules, responsibilities, reviews and controls that fit the company, rather than copying a generic charter.
03
Put it into practice
Install the frame in processes, tools and working habits, with the people who will have to apply it.
04
Support it and keep it current
Follow adoption, adjust what gets in the way and update the framework when uses or risks change.
Deliverables
What you may receive
Deliverables depend on the agreed scope. Mahthildis does not systematically promise every item on this list.
Inventory of uses and tools
What is already in place, who uses it, with which data and for which purpose.
Operational policy or charter
Short rules the teams can apply, rather than a theoretical document.
Uses / data / risk matrix
A clear reading of what can continue, what must be conditioned and what should be stopped.
Responsibility matrix
Who decides, who reviews, who documents and who can stop a use.
Review procedure
The level of human review expected, according to the risk, the audience and the impact of an error.
Rollout plan
The order of implementation, the teams concerned and what must be in place before a wider rollout.
Prioritised action plan
The next decisions and the work to open, including a technical intervention if it was planned in the scope.
Steering
Governance that stays in use
An unused framework achieves nothing. Mahthildis works with business and technical teams so the rules hold in day-to-day work.
The rules are built from real uses, not from an abstract model. The people already using AI need to be able to say what helps them and what gets in the way.
Steering is about adoption: what is understood, what is bypassed and what must be adjusted. Paulo Castro remains responsible for the coherence of the framework.
If technical implementation is needed — rights, logs, integration, or an automation that must be reframed — it can be included when it has been planned in the scope.
Responsibility
A senior counterpart, with the skills the work needs
Paulo Castro personally designs and steers the engagement. He works with the client’s business and technical teams and can take charge of the operational work that has been agreed.
Additional expertise when the work needs it
When the scope requires it, complementary skills are brought in under his lead. Their role and fees are agreed beforehand.
How it is framed
Quoted after the scope is understood. The engagement can be short or continue as ongoing support, depending on the need. No prior audit is required. The first 20-minute conversation is there to understand the situation and confirm the useful scope.
Limits of the engagement
- Mahthildis does not promise a certification, or full GDPR or AI Act compliance.
- The engagement is not a legal, DPO or specialist cybersecurity opinion. Points beyond the scope are identified for the relevant advisers.
- A technical intervention can be included if it is planned in the scoping. It is not included by default.
FAQ
Common questions.
Should we ban ChatGPT?
Not necessarily. The point is to define which uses are allowed, which data must not go in and what review is expected. A ban without a usable alternative often pushes the work into the shadows.
Do we already need AI rules?
No. The engagement can start from uses already present, even if there is no charter yet. It can also take existing rules that are not being applied and put them into practice.
Can you put the rules in place?
Yes. Mahthildis does not stop at writing a document. The engagement can include implementation, steering and team support, within the agreed scope.
Do you work with our teams?
Yes. The frame is built with the people already using AI and with those who will have to keep it. Paulo Castro remains the principal counterpart.
Can you train our people?
Yes, when it helps the scope. This is operational support on uses and rules, not a regulated training catalogue.
How is this different from an AI audit?
An AI audit maps the current state and helps you decide what to keep, improve, secure, test or stop. AI governance designs and installs the frame that then has to live: rules, responsibilities, review and controls.
How is the duration set?
After the first conversation, according to the spread of uses, the number of teams involved and the level of implementation you want. Some engagements stay short. Others continue to support adoption.
What are the regulatory limits?
Mahthildis identifies points of attention and situations that should be checked with the relevant advisers. No certification, and no full GDPR or AI Act compliance, is promised.
Do you need to frame AI use in your company?
Book a first conversation or send your request. Mahthildis will confirm the useful scope before any engagement.
