FOCUS
AI usage audit, data classification, approved tool register, client disclosure
SOFTWARE IMPLEMENTED
Claude on corporate seats for every team member, with the policy documented in Asana
TEAMS TRANSFORMED
The whole company
PROJECT DURATION
8 weeks
Overview
We're Cirface, an operations and AI consultancy based in Canada, and a two-time award-winning Asana Platinum Solutions Partner. We build the systems teams run on, then put AI to work inside them with rules people can follow. Our team of 15 uses Claude every day, and in 2026 we joined Anthropic's partner network.
As we expanded into helping clients adopt AI safely, we wanted to prove the approach on a real company, and ours was the obvious place to start. In May 2026, we ran a full AI governance assessment on ourselves before offering one to anyone else.
At a glance
The challenge: Our team had adopted AI faster than any written rule could follow, and our May assessment found 15 AI tools in use with 3 approved.
The solution: An anonymous survey of every team member and an inventory of every active tool, then a governance policy built on three data levels and an approved tool register our team maintains itself.
The results: A register of 57 tools, each tagged with its AI status and data level, and a corporate Claude seat for every team member the week the policy rolled out.
The challenge
We had a good problem. Our team took to AI quickly because it made the work better, and adoption moved faster than any written rule.
The clearest example sat at the top. Marquis built himself a daily assistant in Claude Code. It briefs him in Slack each morning, preps his meetings, pushes call transcripts into Asana and assigns the follow-up work, and drafts email replies from his voice notes. To do all of that, it connects to Asana, Google Drive, HubSpot, Slack and Fellow. It never went through an approval process, because we didn't have one.
Our May assessment put numbers on the wider picture. We were using 15 distinct AI tools, and 3 of them were approved. Seven of the 15 people we surveyed put client, personal or financial data into AI tools, and one solutions engineer said plainly that he wasn't sure he was allowed to. Three people were doing company work on personal Claude Pro accounts.
Some of the AI we never chose at all. Of our 35 active tools at the time, 23 had AI built in. In 5 of them, our finance and HR systems, the vendor AI couldn't be turned off. Nobody had picked it. It arrived in product updates.
Two tools were influencing decisions about people, which put them in scope for a human rights impact assessment. Our leadership had also given two different answers on how we disclose AI use to clients. One said we didn't. The other said informally, in conversation.
None of it came from carelessness. Our consultants used Claude as a thinking partner on client solutions, and it made them faster. From there it was a short step to putting real project context in, and a shorter one to connecting the tools where that context lived. Every step was a good decision on its own. Nobody had written down where the line was, so everyone drew their own.
The approach
The work ran in two parts: an assessment of how our team actually uses AI, then a governance policy built from what it found. It began with leadership, on where we wanted AI to go and the position everything else would build on: AI assists people and doesn't replace them.
The assessment started in May, the findings came back on June 23, and the policy rolled out to the whole company on August 18, with a corporate Claude seat for everyone the same week. The policy is documented in Asana, our single source of truth, so the whole team can reach it reliably.
Running an AI audit
The audit combined what people told us with what our systems showed.
An anonymous survey of every team member
The survey is the main way the audit finds AI in use. It asks each person which AI tools they use, what information goes into them, how they check what comes out, what they need from a policy, and what worries them about one. It runs anonymously, and the invitation states the purpose plainly: find the tools that already help people work, bring them onto corporate accounts, and protect the data that goes into them. All 15 of us answered.
An inventory of every active tool
The tool inventory puts every active tool on one list. For each one, it records who owns it, what kind of data it holds, the most sensitive data it should carry, and its AI status: no AI, AI that can be switched off, or AI the vendor has made permanent. The inventory catches what a survey can't. Vendor AI that arrives in a product update never shows up in anyone's answers, because nobody chose it.
We didn't review vendor contracts clause by clause during the audit. Our policy includes a process for folding each vendor's AI terms into our own client disclosures instead, so the work keeps going as contracts change.
From responses to an assessment report
The responses were analyzed with Claude, and a person reviewed what it produced before anything went into the report, the same rule our policy now applies to everyone. Our findings came back on June 23.
Building an AI governance policy
Our team's answers set the brief. Nine of the 15 asked for clear rules on what data can go into which tool, and 6 already double-checked AI output before relying on it. Seven expected a policy to be too restrictive and take away tools they had come to depend on, and only 2 raised any worry about job security. People wanted a green light with boundaries, so the policy had to make saying yes faster.
Six principles sit above the rules: AI that supports people, transparency, fairness, accountability, privacy and security, and reliability. The policy package runs to around 15 documents, and its job is to turn those principles into decisions people can make on the spot.
Three data levels and a ceiling for every tool
Our policy gives every piece of information a colour and every tool a ceiling. Green is public information, anything already on a website. Yellow is internal information with sensitive details removed. Red is the most sensitive material, such as contracts, employee records and personal details. Each approved tool is cleared up to a maximum level, and a document that mixes levels takes the highest one present. Red doesn't mean no AI. A red-level tool needs a corporate account, approval from IT, and a system built to handle that data.
An approved tool register our team maintains
Our approved tool register lists 57 tools, each tagged with its AI status and the highest data level it's cleared for. Anyone who wants a new tool submits a request, and the tool is researched and scored before it's added, sometimes on a new corporate account. Exceptions are allowed when they're documented. The scoring process is part of the policy, so our own team scores each tool and keeps the register current when a vendor changes its terms or ships a new AI feature. Nobody waits on an outside review.
Hard lines and an incident process
Our policy sets a short list of hard lines: no passwords, API keys or other credentials in any AI tool, red data only in tools cleared for red, no personal accounts for yellow or red work, no note-taker on a client call without the client knowing, and no new AI feature switched on over yellow or red data before it's evaluated.
Our incident process has four steps:
Stop using the tool for work,
note what happened with which tool and when,
report it,
delete nothing.
We treat a report as useful information, so a recurring problem, such as an agent whose instructions need correcting, gets fixed instead of worked around.
Decisions about people
In our policy, AI that informs a decision about a person never makes the final call. Hiring and screening, promotion and performance, discipline and offboarding, and access to services all trigger a human rights impact assessment. The assessment follows the Human Rights AI Impact Assessment developed by the Ontario Human Rights Commission and the Law Commission of Ontario.
A disclosure statement clients can read
Our two answers on disclosure became one written statement that clients can read in their SOW under our privacy policy.
Rolling out Claude with the policy
The policy and the tool arrived together. On August 18, the whole company met for an hour to go through the new governance policy. The team was briefed on our six principles defining the policy, which are:
Supportive. AI assists people and never replaces them. No new tool or system would be used to eliminate positions.
Transparency. AI systems stay visible, traceable and explainable. There are no black boxes: we know what each tool can access, what data it shares and how it reaches its outputs.
Fairness. AI treats people fairly and affirms human rights, with protections built in to prevent and remedy discrimination.
Accountability. Whatever we put out is ours. Nobody gets to say the AI did it.
Privacy and security. Privacy by design, protection for our data and clients’ data, and honouring the commitments in our client contracts.
Reliability. AI should behave consistently and safely, including in situations it wasn’t designed for and when someone tries to manipulate it. Drift, made-up answers and inconsistent outputs get reported.
We then reviewed the data levels, the register and how to request a tool, the hard lines, and how to report a problem. We introduced the policy as a first version and treated the team's questions as a way to find the gaps. Every team member had a corporate Claude seat that same week.
Results
Marquis's assistant still runs every morning. It now has a much shorter list of things it's allowed to touch, and the rest of us work to the same rules.
| Need | At the May 2026 assessment | Now |
|---|---|---|
| Knowing which AI tools are in use | 15 AI tools in use, 3 approved | A register of 57 tools, each tagged with AI status and data level |
| Company work on company accounts | 3 people on personal Claude Pro accounts | A corporate Claude seat for every team member |
| Knowing which data can go where | No written rule | Three data levels and a ceiling for every tool |
| Telling clients how AI is used | Two different answers from leadership | One written disclosure statement |
| Reporting a problem | A message to the CEO | A defined incident process |
| Tracking AI risk | Outside the company risk register | Inside the company risk register |
| Vendor AI with no off switch | 5 finance and HR systems | Still on, each cleared to a data level |
"A policy isn't a list of bans. It's what lets you say yes to a new tool quickly, because you already know what class of data it would be handling and where that class is allowed to go."
Marquis Murray | CEO, Cirface
The AI Readiness Assessment and the AI governance program
We now offer both halves of this work to clients, as two separate services.
The AI Readiness Assessment shows where AI already lives in your company. It delivers five things:
a full inventory of every tool in use, approved, unofficial and shadow AI alike,
an exposure map of every place AI touches company data,
risk-ranked findings, with quick wins your team can apply the same week,
a clear recommendation, which can be that you're in better shape than you thought,
and a leadership readout with a findings deck, a video walkthrough and a working session with your executives.
The service asks little of your team: about an hour per person for the survey, a couple of hours from managers to follow up, and a week or two to collect responses. The findings follow two to three weeks after responses close.
The AI governance program builds the rules that let your team say yes safely. Over six to ten weeks, it delivers an acceptable use policy written for your operations and your data:
plain-language data rules that settle once which data goes into which tools,
a tool approval process with a fast, safe yes for the tools your team wants to bring in,
a client-ready disclosure statement, with the incident runbook behind it,
and a handoff to your own team.
The handoff includes the tool scoring process, so your IT lead keeps the register current without waiting on us. Our own build took eight weeks, from findings on June 23 to company-wide rollout on August 18.
Both usually sit with a CTO or IT lead, since IT tends to hold the software list already, and HR joins when AI touches decisions about people. Most teams that ask for them share one gap: nobody in-house has the time or the expertise to take this on alongside their real work.
Find out where AI already lives in your company
Start with the free AI readiness kit, about thirty minutes that puts real numbers against your own team's AI use. For the full picture, or the rules that come after it, see our AI services or talk to us.
