Sample Company AI Control Plan
See what the written decision looks like.
This fictional example shows the structure and level of detail produced by the Company AI Control Review. It is not a customer case study and contains no client data.
Illustrative only
Not customer evidence.
This example demonstrates the deliverable, not a result Airlark claims to have produced for a client. A real plan is based on the workshop, supplied policies, system summaries and the commercial and technical context of one business.
It is not a legal, GDPR or security audit. Legal obligations, contract terms and security assurance remain with the business and its qualified advisers.
01 / Decision summary
Use the existing service, after preparation.
Recommended route: configure and pilot the company’s existing enterprise AI service for one proposal-drafting workflow. Do not commission a custom build at this stage.
- Why this route
The required documents already sit in the company’s managed document system, the proposed users have company identities, and the workflow needs drafting assistance rather than autonomous action.
- What must happen first
Review access to the source folders, confirm the provider’s current data-processing and retention terms, define the approved user group and name the person responsible for final approval.
- Decision owner
The operations director approves the pilot. The IT provider confirms technical controls. The commercial manager remains accountable for every proposal sent.
02 / Current workflow and data flow
Name every step and boundary.
- People
Five estimators assemble first drafts. A commercial manager reviews the content, price and commitments before anything leaves the company.
- Source documents
Approved project sheets, service descriptions and standard terms remain in the company’s managed document library.
- Prompts and retrieved context
An estimator asks for a draft using selected approved documents. Access follows the user’s existing company permissions.
- Model requests
The approved enterprise service sends the required prompt and selected context to its model-processing environment. The provider, region and contractual safeguards must be confirmed against current terms before the pilot.
- Output
The draft returns to the estimator. It is marked as unapproved until the commercial manager completes the normal review.
03 / Data location
Record what is known and what must be confirmed.
- Storage
Source files stay in the company-managed document system. No copy is placed in an Airlark account.
- Processing
Selected prompts and context may be processed by the enterprise AI provider. The exact service, model provider and processing region are recorded before approval.
- Logs and retention
The IT provider confirms which prompts, outputs and administrative events are logged, where those logs are stored and how long each record is retained.
- Transfers and suppliers
The business records the relevant processor, subprocessor and international-transfer questions for review under its own GDPR and supplier-management process.
- Open question
Confirm whether the selected service configuration supports the required EEA processing and retention choices under the company’s contract.
04 / Controls
Keep authority with named people.
- Permissions and access
Limit the pilot to a named group. Remove broad or inherited access to proposal source folders before connecting them to the service.
- Approved accounts
Use company-managed identities only. Personal AI accounts are not part of this workflow.
- Logging
Enable the audit and usage records available under the selected service. Name the IT owner responsible for reviewing exceptions.
- Human approval
No proposal is sent, price accepted or contractual statement approved by the AI service. The commercial manager performs and records the final review.
- Staff guidance
Give pilot users a one-page instruction covering approved sources, prohibited information, escalation and the required review before use.
05 / Pilot scope
Test one useful workflow.
- Goal
Produce a usable first proposal draft from approved company material while preserving the existing commercial review.
- Users and duration
Five estimators and one commercial approver for a four-week pilot.
- Dependencies
Permission review, provider-term confirmation, approved document set, named owners, pilot guidance and a support contact from the IT provider.
- Success checks
Users can find the correct approved material, drafts cite the selected sources, prohibited information is not introduced and every proposal receives human approval.
- Out of scope
Automatic sending, pricing decisions, contract acceptance, access to every project folder, custom software and company-wide rollout.
The next decision
Approve, revise or stop.
This illustrative plan supports one bounded decision: approve the prepared pilot, revise its controls or stop before implementation. A real Company AI Control Plan also records the implementation estimate when further work is justified.