AI Governance Consultant: What a CPG Brand Needs Written Down First

Your bookkeeper pastes a bank statement into a free chat tool, because nobody ever told them which company information is off limits. Then a consultant's proposal arrives, and it starts with a workshop. An AI governance consultant helps you write down which AI tools your team may use, what company information each may touch, and who reads the output before it leaves the building. For a brand your size that is one page, and you can draft it this afternoon, before you pay anyone.

What does AI governance mean for a brand with a small team?

It means rules, in writing, for how your people use AI at work. Not a committee and not a binder. In a company of eight, governance is three questions with a named person beside each answer. Which tools are allowed? What information may go into each one? Who reads the output before it goes outside the company? Boards and review cycles can come later.

The second question carries the most risk. Sort your company information into four tiers by what a leak would cost: public (published prices), internal (meeting notes), confidential (retailer terms, margins) and never share (passwords, formulas, card numbers). Each tool then gets one rule, the highest tier it may hold. I wrote up the tiers in What guardrails should a CPG founder set up before using AI with sensitive company information?. The policy below uses them.

What does an AI governance consultant actually do?

A good one does five jobs. They list the AI tools your team really uses, including the free ones people signed up for on their own. They sort your company information by what a leak would cost. They name an owner for each tool, and a backup for when that person is out. They write the rules in plain sentences. And they come back a month later to check the rules against how people actually work.

Judge a consultant on how they work, not on somebody else's results. Ask them to put three things in writing: what they hand you, who on your team owns it afterwards, and how they treat your files, including whether they keep copies. A consultant who offers to show you another client's policy as proof has told you how they will treat yours.

Which decisions need a named owner first?

Three, in this order.

1. Which tools are allowed. One person says yes or no, so a new tool cannot arrive because one employee liked it.
2. Which tier of information each tool may hold. The owner is whoever runs your software or your operations, because they set up the account and the access.
3. Who reads what leaves the company. Anything sent to a retailer, a broker or a customer is read by a named person first. In What should a CPG founder automate first? I listed the calls that stay with a person: whether to increase spend, change inventory plans, push a wholesale account, adjust the promo calendar. Those stay with you.

The rule gets stricter the less a person is involved, and each way of using AI adds something.

• A chat happens only when somebody types. It needs the tier rule.
• A saved project keeps your files and standing instructions between chats. It adds one rule: which files go in.
• A scheduled job is a chore the AI does on a timetable, such as every morning at seven, whether or not anyone opens it. It adds a named person who reads what it produces, and an alarm for when it did not run, because anything you automate needs an answer to how you would know if it stopped.
• A connection is a link that lets the AI reach your files or systems. Read only means it can look and cannot change anything. A connection that can edit or send adds your approval for each change.

The seven levels of AI for CPG walks through the steps between a chat and a job that runs itself.

How do you get the policy written without losing an afternoon?

In the older days you would block an afternoon with your operations lead, list every tool the team uses, go person by person asking what each one pastes into it, argue about who should approve what, and type the page yourself. Say six hours spread over a fortnight, because the same two people are never free together twice.

Today you hand that to Claude, an AI chat assistant you type to like a text conversation. Whoever runs your operations opens a browser, goes to Claude and pastes the instructions below. Claude asks one question at a time, they answer by typing, and then Claude writes the page. Allow about fifteen minutes, nearly all of it your operations lead answering questions. Your part is reading the page and saying yes or no to each row. Here is what comes back, with invented example entries:

| Tool | Highest tier it may hold | Owner | Backup |

|---|---|---|---|

| Free chat assistant | Public (published copy, public prices) | Operations lead | Bookkeeper |

| Paid business chat account (its written terms say the maker will not use what you type to teach its AI) | Confidential (retailer terms, margins) | Operations lead | Founder |

| Friday sales report, set to run itself every week, read only | Internal (sales exports) | Operations lead | Bookkeeper |

Below the table sits one line: "Anything sent outside the company is read by a person first, and the founder approves price and promotion changes." After that come six questions to put to any consultant, each one answerable in writing. Claude writes the word GUESS beside anything it had to guess.

I run operations at a consumer packaged goods company with a small team. Interview me to write our one-page AI use policy. Ask one question at a time and wait for my answer. Cover, in this order: every AI tool anyone on the team uses, including free ones people signed up for themselves; what company information gets typed or pasted into each tool; who reads what each tool produces before it leaves the company, and who covers when that person is out. Stop after 12 questions at most. Then write the policy as a table with one row per tool: the tool, the highest tier of information it may hold (public, internal, confidential or never share), the named owner, the named backup. Under the table, add one sentence on what a person must approve before anything goes outside the company. Then write six questions I should ask any consultant who offers to handle AI governance for us, each one answerable in writing. Write the word GUESS beside anything you had to guess.

Claude can get a row wrong, as any assistant can, so the table is a first draft. Read each row against what you know about the business, and send the corrections back in the same chat. What the draft does not fix is whether people follow it. That takes the named owner reading what each tool produces, as the page says.

When is an outside governance consultant worth hiring?

When the page above raises a question nobody on your team can settle. A retailer or supplier contract that might restrict what you can share with an AI tool is the clearest case, because a wrong answer there costs a deal. Another is a request from a retailer, lender or insurer for a written AI policy you cannot yet answer. A third is two people who both think they own the same decision.

Skip the consultant when the draft takes fifteen minutes, nobody disagrees with it and every row has a name. You already have the policy. Spend the money on getting a job built under it. If one job is ready, the CPG AI Assessment is an hour inside that job, with a written scope and the price to build it at the end.

How does AI keep the policy current as tools change?

Tools change their settings and their terms, and your team adds new ones. Once a month, and any time someone names a new tool, whoever runs your operations pastes the policy into the same chat and types the new tool names and any change to a tool's terms they have seen. Claude lists which rows no longer match and writes the corrected rows. That is a few minutes for the same person who ran the first draft, and they do not need the instructions again.

Claude can also run a saved task on a timetable, so the monthly check can run itself, and the seven levels note covers how. Add one rule to the policy itself: a tool gets a row before its first use. A new tool that arrives without a row is the one to ask about.