AI is already in procurement, product, and professional services. The legal question is no longer whether to use it — it is how to use it with a governance model the business will actually follow.
Start with inventory: which tools, which data, which human review. Then contract for the gaps vendors will not volunteer — training rights, confidentiality, incident notice, and audit. Privacy impact assessments should track real data flows, not marketing language.
Boards do not need a 40-page policy. They need a named owner, a risk appetite, and a reporting rhythm. That is the program we help clients build.