Start with the document or decision in front of you.

Build a starter AI policy, see if a task is worth automating, or put simple AI rules in place. Everything here is free, and you don’t need to book a call to use it.

Find your starting point.

Try an interactive tool, read a guide, or download something your team can work through together.

7 resources
Automation WEB TOOL

Automation Checker

Describe one repetitive task and answer five quick questions. You’ll get an honest read on whether it’s worth automating.

Includes
  • An honest estimate, not a sales score
  • Which parts of the task are the candidates
  • A low score is a useful answer too

Result shown immediately · no email required

Governance & reporting PDF

Take Control of Your AI

A 10-page guide to getting AI under control: 12 steps, a 90-day plan, and fill-in pages for who owns what.

Includes
  • Fill-in decision and routing records
  • A ten-row data boundary table
  • Illinois applicability screen
  • A 90-day plan

Free with a work email

Governance & reporting DOCX

Executive AI Governance Checklist

25 yes-or-no questions for your leadership team. They show where the gaps are and end with your first three to-dos.

Includes
  • 25 yes / no / needs-review questions
  • Organization, date and review-owner fields
  • A first-three-actions section
  • Laid out to print on one sheet
Details

Also available:

Risk & assessment XLSX

AI Governance Workbook

The handbook as a working spreadsheet: list your AI tools, assign owners, check vendors, and log any problems.

Includes
  • 48 governance controls with status fields
  • AI system register and vendor reviews
  • Obligations register and incident log
  • A 30/60/90-day action plan

Seven working tabs · summary formulas included

Vendor & procurement DOCX

AI Tool Approval Request

A simple form staff fill out before using a new AI tool: what it is, why they need it, and what information it would touch.

Includes
  • Employee request fields
  • Data and integration disclosure
  • Reviewer decision and conditions section
  • Printable and editable formats

Also available:

Updates EMAIL

Actually Useful AI

Occasional guidance for organizations trying to use AI without losing track of their data, vendors or responsibilities. No hype, and nothing you have to sit through.

Updates LIBRARY

Skills Library

A curated library of AI agent skills from Noventech.

The curated skills library is being prepared for public release.

Evaluating AI vendors

Look at the type of account, what it does with your data, what it can reach, and what you plan to use it for, not just the product name. These examples show what to check before approving a tool for work.

Reviewed September 2026. Plans and terms change often, so confirm current terms before approving.

Not all tools, or even tiers within the same tool, are created equal.

A personal account drafting a public outline is different from a business or enterprise plan connected to email, customer records, or source code, even under the same product name. Approve the specific use, plan tier, and configuration, not just a company name.

ChatGPT (OpenAI)

Review settings

General-purpose generative AI for drafting, analysis, ideation, and coding assistance.

Key considerations

  • Data training: Free, Plus, and Pro chats may be used for training unless each user opts out. Business, Enterprise, and API data is not used for training by default.
  • Account type matters: Free, Plus, Pro, Business, and Enterprise each come with different data handling and admin controls.
  • HIPAA: A Business Associate Agreement (BAA) is available only for sales-managed Enterprise, Edu, ChatGPT for Healthcare, and the API. Business, Plus, and Free are not eligible.
  • Never enter: Passwords, full customer records, proprietary source code, or confidential client data.
  • Best for: Brainstorming, general writing support, learning, and coding help.
When to use

Internal drafting, ideation, general research

Biggest risk

Work data entered into personal Free, Plus, or Pro accounts

Microsoft 365 Copilot (Microsoft)

Review access

Built into Microsoft 365 (Word, Excel, Teams, Outlook). Operates within your Microsoft environment.

Key considerations

  • Data boundary: Runs under your Microsoft 365 terms, but some features use subprocessors such as Anthropic, which are on by default in most U.S. tenants. Review the admin setting.
  • Licensing: Copilot Chat is included with Microsoft 365 business plans. Full Microsoft 365 Copilot is a paid add-on or bundle. Consumer Copilot comes with Microsoft 365 Personal, Family, and Premium.
  • HIPAA: Microsoft's BAA covers Microsoft 365 business customers through the Product Terms.
  • Best for: Document editing, email composition, meeting summaries, spreadsheet analysis.
When to use

Internal content creation, document drafting, meeting notes

Biggest risk

Personal Microsoft 365 or Copilot consumer accounts used with company data

Claude (Anthropic)

Review settings

Generative AI for long-document analysis, writing, and coding. Available on the web, in desktop apps, in Team and Enterprise plans, and through the API.

Key considerations

  • Data training: Free, Pro, and Max chats may be used for training unless the user opts out. Team, Enterprise, and API data is not used for training by default.
  • Long context: Well suited to long documents, contracts, or detailed policy reviews.
  • HIPAA: A BAA is available only for the Claude API and sales-assisted Enterprise plans, and must be activated. The Team plan is not covered.
  • Best for: Legal/compliance review, detailed analysis, technical documentation.
When to use

Analysis of detailed documents, policy review, coding assistance

Biggest risk

Misplaced confidence in accuracy. Always verify outputs.

Gemini (Google)

Review access

Google's generative AI, integrated into Google Workspace (Docs, Sheets, Gmail) and available standalone.

Key considerations

  • Workspace integration: Gemini in Workspace has different data handling than standalone Gemini.
  • Personal Google accounts: Consumer Gemini with work data is risky. Data may be used for training, and it is not covered by Google's BAA.
  • HIPAA: Gemini in Google Workspace is covered by Google's BAA on eligible plans once the BAA is accepted.
  • Best for: Document drafting in Google Workspace, email composition, spreadsheet analysis.
When to use

Google Workspace-native workflows if properly licensed

Biggest risk

Personal Google accounts mixing work and consumer data

Image Generation (ChatGPT Images, Midjourney, Adobe Firefly, Stable Diffusion)

Review rights

Create custom images, graphics, and visual content from text descriptions.

Key considerations

  • IP ownership: Who owns the generated image? Each tool has different terms.
  • Training data: Check whether your prompts or outputs are used to improve the tool.
  • Commercial use: Terms vary by plan and company size. For example, Midjourney requires a Pro or Mega plan for companies with more than $1M in annual revenue.
  • Best for: Social media graphics, internal presentations, marketing collateral (with proper licensing).
When to use

Creating custom graphics for approved uses

Biggest risk

Unclear IP ownership or using images without commercial rights

Before you approve any tool, answer these five questions.

  • What data does it touch? Customer info, financial data, health records, employee info, or proprietary material?
  • How is data handled? Is it encrypted? Retained? Used for training? Does the vendor have a BAA or SOC 2?
  • Who can access it? All staff, specific roles, or just one person? What approvals or oversight are in place?
  • What integrations does it create? Does it connect to other systems? What permissions does it request?
  • Can we get our data back? If we stop using the tool, can we export data? How long does it take?

A practical boundary. These resources help you organize the work. They are not legal advice or certification. AI laws, regulatory guidance, vendor terms, and technical capabilities change, so confirm legal obligations with qualified counsel.