How It Works
Free Checklist
Governance-Ready Pilot Blueprint
Enterprise Procurement Ready in 4 Weeks
Your team is already using AI. 10-15 tools, probably. Most unauthorised.
The question isn't whether to govern it. The question is whether you formalise governance proactively or
wait until an enterprise RFP exposes what you can't document.
4 weeks. £3,500.
Complete governance framework.
The Enterprise Procurement Gap
Most UK agencies lose enterprise contracts at procurement. Not because their work isn't good enough—because they can't answer basic AI governance questions.
How do you ensure client data doesn't enter unauthorised AI tools?
What oversight protocols govern AI-generated content before client delivery?
Can you provide documentation of your AI usage policies?
Most agencies freeze at question three. The enterprise client moves on.
Beyond procurement, there's confidentiality risk: client data in unauthorised tools, campaign strategies in ChatGPT history, proprietary methodologies exposed.

71%
of employees use unauthorised AI tools weekly
That's 7 out of 10 people in your agency uploading client data to tools you haven't vetted.

(Microsoft UK, October 2025)
This isn't theoretical. I've lived this pattern.
I was a partner in two agencies simultaneously when a major client payment freeze created extraordinary external pressure.
XEIOH survived through formalised governance—documented processes demanded by pharmaceutical clients. When crisis hit, those systems proved their value.
The other agency operated on informal governance. Worked perfectly under normal conditions. When external pressure arrived, informal systems reached their limits.
Michael MacDonald
Former agency partner with AI certifications from Wharton, Vanderbilt, and Northeastern.
"The difference wasn't competence. It was documentation.
What I'll Deliver: The 4-Week Blueprint
Week 1
Current State Mapping
I'll conduct a complete Shadow AI inventory of your agency.
We'll map:
  • Which tools are running (authorised and unauthorised)
  • How each department uses them
  • What data classifications go where
  • Where your risk exposures are
By end of Week 1, you'll know exactly:
  • Which 10-15 tools are actually running
  • Where client data is going
  • What your enterprise procurement gaps are
  • Which risks need immediate attention
Week 2
Policy Development
I'll implement the Three Simple Rules framework with your team.
Rule 1: Data Traffic Light
  • 🔴 RED: Never in any AI (PII, financials, confidential strategy)
  • 🟡 AMBER: Enterprise tools only (brand briefs, drafts, anonymized data)
  • 🟢 GREEN: Any approved tool (public information, ideation)
Rule 2: Human Wrapper
  • Creator self-review protocols
  • Creative Lead approval checkpoints
  • Account Director sign-off requirements
  • No AI output to clients without documented oversight
Rule 3: Prompt Dividend
  • Time savings tracking system
  • Knowledge capture protocols
  • Margin protection methodology
  • Shared Prompt Library framework
I'll also create:
  • Approved tools register
  • Tool evaluation framework
  • Data protection protocols
  • Client communication templates

Why Three Rules? Creative teams remember three rules. They abandon thirty principles. I've designed this framework for actual adoption, not theoretical compliance.
Week 3
Team Training
I'll run a 2-hour workshop with your team covering:
  • Three Simple Rules walkthrough
  • Real scenario practice
  • Department-specific applications
  • Q&A and objection handling
Then I'll provide role-specific training:
  • Account teams: Client conversations
  • Creative teams: Daily usage protocols
  • Operations: Monitoring and enforcement
  • Leadership: Procurement responses
You'll get:
  • Complete training deck
  • Scenario library
  • Quick reference cards
  • Internal FAQ document
Week 4
Enterprise Readiness
I'll deliver your AI Assurance Pack with pre-written answers to 20 most common enterprise procurement questions:
  • "How do you govern AI tool access?"
  • "What data protection protocols are in place?"
  • "Can you provide audit trail documentation?"
  • "What happens if AI generates non-compliant content?"
  • And 16 more
Plus procurement response templates:
  • Security questionnaire frameworks
  • Vendor assessment responses
  • Data processing agreement language
  • Client-facing policy summaries
Implementation handover includes:
  • Policy documentation (ready for internal distribution)
  • Training materials (for ongoing team onboarding)
  • Monitoring protocols (how to maintain governance)
  • 90-day evolution roadmap
Where you'll be: You can answer enterprise security questionnaires with documented evidence. Not theoretical capability—actual documentation you can share in procurement conversations.
The Three Simple Rules Framework
Most governance frameworks fail because they're too complex.
40-page policy documents that nobody reads.
Compliance checklists that creative teams ignore.
I designed for adoption first, comprehensiveness second.
Data Traffic Light
Your team already understands traffic lights.
RED means stop.
AMBER means caution.
GREEN means go.
Apply this to data classification and everyone instantly knows what's safe to put in which tools.
Example: I've seen this work at a 15-person healthcare comms agency. They had 14 unauthorised tools. Applied Traffic Light classification. Nine tools had RED data exposure. Shut them down immediately. No deliberation needed.
Human Wrapper
AI creates first drafts.
Humans make final decisions.
Every AI output goes through documented human review before reaching clients. Creator reviews. Lead approves. Account Director signs off.
Not bureaucracy. Documented accountability.
Example: I've watched agencies lose enterprise contracts because they couldn't demonstrate oversight. The Human Wrapper solves this. Client asks 'Who reviews AI content?' You show them the documented protocol.
Prompt Dividend
AI saves time.
That saved time is agency value.
Track it. Capture it. Protect it from becoming automatic client discounts.
Build a shared Prompt Library so efficiency gains compound instead of disappearing.
Example: I've seen agencies capture 40 hours monthly in time savings, then watch those savings evaporate as scope creep. Prompt Dividend prevents that. You track the efficiency. You protect the margin.
Why This Works: Framework-first thinking. Named systems. Visual tools. Portable principles that survive job changes and market shifts.
What You'll Achieve
Pass enterprise security questionnaires with 20 pre-written answers and documented evidence.
Train your team on compliant AI usage so everyone knows what's safe, what's restricted, what requires approval.
Protect margins through Prompt Dividend tracking so time savings become agency value, not automatic client discounts.
Document governance for client audits with policies, training records, and approval protocols ready for external review.
Respond to RFPs confidently without freezing at question three about AI governance capabilities.
Bottom line: You become enterprise procurement ready. Not theoretically ready—actually ready with documentation you can share.
Who This Is For
You're a Good Fit If:
You're facing enterprise RFPs where larger clients are asking governance questions you can't answer yet.
You need governance but lack time to DIY—you know what's required, you don't have 6-12 months to build it yourself.
Your team is already using AI and you need to formalize what's happening, not prevent what might happen.
Client anxiety about AI is creating sales friction where 80% of pitch questions are now 'How do you govern AI?'
You're Not a Good Fit If:
Your team isn't using AI yet. Start with the £500 Shadow AI Audit to establish baseline understanding first.
You're looking for AI acceleration consulting. This is governance-focused, not 'how to use AI faster' consulting.
You prefer DIY implementation. If you have 6-12 months and internal expertise, you might not need external support.
You're not pursuing enterprise clients. SMB clients rarely require formal governance documentation.
The 4-Week Process
Week 1: Discovery & Mapping
Your investment: 2-3 hours (interviews, workflow review)
I'll deliver: Complete Shadow AI inventory, risk assessment, baseline documentation
Week 2: Framework Design
Your investment: 2 hours (policy review, feedback sessions)
I'll deliver: Three Simple Rules implementation, approved tools register, protocols
Week 3: Training & Buy-In
Your investment: 3 hours (workshop attendance, role-specific sessions)
I'll deliver: Team training, scenario practice, internal documentation
Week 4: Documentation & Handover
Your investment: 2 hours (final review, handover session)
I'll deliver: AI Assurance Pack, procurement templates, implementation roadmap
Total time from your team: 9-10 hours over 4 weeks.
I do the heavy lifting: 32 hours of governance design, documentation, and delivery.
Not imposed frameworks. Collaborative development that fits your workflows.
Why Not DIY?
'Can't I just build this myself?'
Yes. Many agencies do.
What takes 6-12 months DIY, I deliver in 4 weeks.
Here's what the DIY path looks like:
  • Month 1-2: Research regulatory requirements, study competitor approaches
  • Month 3-4: Draft policies, circulate for feedback, revise 3-4 times
  • Month 5-6: Attempt team training, discover adoption problems
  • Month 7-9: Revise policies again, rebuild training materials
  • Month 10-12: Maybe ready for enterprise procurement
Or: with documented operational experience in
4 weeks
The difference:
  • Policies your team will actually follow (not 80-page manuals nobody reads)
  • Training that creates adoption (not compliance theater)
  • Based on operational experience (not theoretical frameworks)
Pricing & Value
£3,500
Investment
Market rate for governance consulting: £12,000-25,000 (Big 4)
My rate: £3,500 (operator pricing, not consultant overhead)
Compare to:
  • Lost enterprise contract: £50,000-200,000 annually
  • GDPR enforcement action: £5,000-50,000 penalties
  • Client relationship damage: Immeasurable
Frame it this way: £3,500 to unlock £200,000+ contract opportunities you're currently losing at procurement stage.
Payment Terms
Option 1: Full payment (£3,500 upfront)
Option 2: Split payment (£1,750 at start,
£1,750 at Week 2 midpoint)
What's Included
What's included:
  • Complete governance framework
  • Team training (2-hour workshop + role-specific sessions)
  • AI Assurance Pack (procurement responses)
  • Implementation documentation
  • 90-day evolution roadmap
  • Email support during 4-week engagement
What's Not Included
What's not included:
  • Ongoing monthly support (available via Momentum Advisory Retainer)
  • Custom tool integrations beyond approved tools register
  • Legal review of client contracts (I provide templates, not legal advice)
What Happens After: Your External AI Governance Team
Many Clients Continue with Momentum Advisory Retainer
£2,500/month for ongoing governance support:
Monthly:
  • 60-minute advisory call
  • Governance dashboard review
  • Tool evaluation support (up to 2 new tools)
Quarterly:
  • Policy updates (as regulations evolve)
  • Training refresher sessions
  • Benchmark reports (your governance vs. market standards)
As-needed:
  • Enterprise procurement support
  • Incident response guidance
  • Regulatory change briefings
Why continue? Governance isn't one-and-done. AI tools evolve. Regulations change. Enterprise requirements shift. The Retainer keeps your governance current without requiring you to become an AI policy expert.
No obligation: Many clients complete the Pilot Blueprint and manage governance internally. The Retainer exists for agencies who want ongoing support as they scale.
Common Questions
Can I implement this myself?
Yes. If you have 6-12 months and internal governance expertise.
Most agencies don't have either. That's why the Pilot Blueprint exists—4 weeks vs. 12 months.
Will my team actually follow this?
Three Simple Rules is designed for adoption first.
Creative teams remember three rules. They abandon thirty principles.
I build the framework with your team, not impose it on them. That's why adoption rates are high.
What if regulations change?
The framework is adaptable by design.
Three Simple Rules principles remain stable while specific protocols evolve. That's governance architecture that survives regulatory shifts.
Ongoing regulatory monitoring is included in the optional Momentum Advisory Retainer.
Do I need the Shadow AI Audit first?
Not required, but recommended.
The £500 Audit establishes baseline understanding of your current AI usage and risk exposure. That makes Week 1 of the Blueprint more efficient.
But if you already know you have 10+ unauthorised tools and need governance immediately, you can start directly with the Blueprint.
What makes you qualified to do this?
Three sources of credibility:
  • Operational experience: I was a partner in two South African agencies. Watched formalised governance determine which survived external crisis and which didn't.
  • Formal training: AI certifications from Wharton, Vanderbilt, and Northeastern.
  • Current practice: Building this consultancy in public. Pre-revenue, startup rates, operator honesty about what I know and what I'm still testing.
I'm not a Big 4 consultant selling theoretical frameworks. I'm an operator who's lived the difference between informal and formalised governance under pressure.
What if this doesn't work for our agency?
Discovery call first. Let's confirm this is the right fit.
If Week 1 reveals your governance needs are simpler or more complex than the Blueprint structure, we'll adjust scope or part ways professionally. No hard feelings.
Trust-before-transaction relationships. Not forced fits.
Ready to Get Started?
4 weeks.
£3,500.
Complete governance framework.
You'll exit with:
  • Three Simple Rules implementation
  • Trained team
  • AI Assurance Pack
  • Procurement response templates
  • Documentation ready for client audits
Next step: Book a 30-minute discovery call.
No obligation. No pressure. Let's confirm this is the right fit for your agency.
Questions? Email hello@brainsb4bots.com
The Choice Worth Considering
Worth thinking about: Do you formalise governance proactively or wait until an enterprise RFP exposes what you can't document?
Most agencies lose contracts at procurement stage. Not because their work isn't good enough. Because they can't answer 20 questions about AI governance.
Four weeks from now, you can answer all twenty.
Brains Before Bots | Shadow AI Governance for UK Agencies
GovernFirst, not AI-First