The AI Governance Episode

Introduction to the Guest and Topic:

Host Allie Krings introduces Greg Ciampa, Chief Technology Officer at Kirkpatrick Price. The conversation focuses on AI governance, the adoption of artificial intelligence within organizations, and how leadership can safely leverage AI tools while protecting sensitive data. Greg shares his perspective on how AI has become an increasingly important part of both internal operations and customer-facing applications, particularly within software development.

What Is AI Governance?:

AI governance is the framework of policies, controls, and decision-making processes that determine how artificial intelligence tools are used within an organization. Governance helps organizations decide which AI platforms are approved, what data can be shared with those tools, and what safeguards must be in place to ensure information remains secure.

At its core, AI governance is about balancing innovation with risk management while ensuring AI tools are used responsibly and securely.

How Is AI Being Used Today?:

Greg explains that Kirkpatrick Price uses AI in multiple ways.

For Productivity: Microsoft Copilot helps employees analyze data, organize information, summarize emails, create content, and improve efficiency across daily workflows.

For Software Development: Developers leverage AI tools such as Claude and GitHub Copilot to assist with coding, prototyping, reviewing code, and accelerating development efforts. These tools help teams complete work more efficiently while still maintaining human oversight.

For Customer-Facing Features: AI is also being incorporated into product development, including features within Kirkpatrick Price’s Online Audit Manager platform designed to help clients complete security questionnaires more efficiently.

What Does AI Governance Look Like Up Close?:

For Employees:

Employees are provided approved AI tools and clear guidance regarding how those tools should be used. The organization develops acceptable use policies that define appropriate usage, prohibited activities, and data-handling expectations.

For Development Teams:

Developers use AI as a productivity tool rather than a replacement for expertise. AI-generated code must still undergo testing, peer review, and security validation before being deployed. Human oversight remains essential throughout the development process.

For Leadership:

Executive leadership participates in governance decisions, evaluating data protection, vendor agreements, risk considerations, and security controls before approving AI tools for organizational use.

What Are the Biggest Risks Organizations Must Consider?:

One of the most significant concerns is data usage.

Organizations must understand exactly what happens to information entered into an AI platform. Questions include:

• Is the data used to train the model?
• Where is the data stored?
• Who can access the information?
• What protections are in place?

Greg notes that these questions are among the first considerations when evaluating any AI vendor.

How Can Companies Protect Sensitive Data When Using AI?:

Organizations should avoid relying on publicly available AI tools for sensitive business information.

Instead, they should adopt enterprise-level AI platforms that provide stronger privacy protections and contractual assurances around data handling. Kirkpatrick Price selected enterprise solutions that commit not to train public models on company data and that isolate information within dedicated environments.

Why Did Kirkpatrick Price Choose Microsoft Copilot?:

Microsoft Copilot was appealing because it integrates directly with Microsoft 365 applications already used throughout the organization.

In addition, the enterprise environment provides protections that isolate organizational data and prevent it from being used to train public AI models. This allowed employees to benefit from AI functionality while maintaining confidence that company information remained protected.

Why Did the Development Team Choose Claude?:

While Microsoft Copilot serves many productivity needs, the development team also evaluated Claude and other AI tools.

Claude provided additional flexibility for software engineering tasks and offered capabilities specifically geared toward code generation and development workflows. The team appreciated the ability to extend functionality, share workflows across developers, and take advantage of coding-focused AI capabilities.

What Controls Were Implemented Before Rolling Out AI?:

Kirkpatrick Price did not immediately release AI access to everyone.

The company:

• Conducted evaluations of tools and vendors.
• Limited access during initial testing phases.
• Selected trusted early adopters.
• Developed an acceptable use policy.
• Created guidance around what information could and could not be entered into AI systems.
• Implemented governance controls before broader adoption.

What Should an AI Acceptable Use Policy Include?:

Greg explains that organizations should clearly define:

Permitted Uses: The types of business tasks employees may use AI to assist with.

Data Restrictions: What information may be entered into AI systems and what information should never be shared.

Approved Platforms: Which AI providers and services employees are allowed to use.

Security Expectations: The controls and protections employees must follow when interacting with AI tools.

How Should Companies Select AI Vendors?:

Organizations should evaluate:

Data Privacy Protections: Understanding how data is stored, processed, and retained.

Training Policies: Verifying whether data is used to train AI models.

Enterprise Controls: Determining what additional safeguards come with business or enterprise subscriptions.

Vendor Agreements: Reviewing contractual commitments related to security and privacy.

What Are the Biggest Concerns About AI in Development?:

Greg notes that AI has dramatically accelerated software development.

The challenge is no longer producing code—it is reviewing, testing, and validating the large amount of work AI can generate. Because AI can create functionality quickly, organizations must ensure they maintain rigorous review processes to preserve quality and security.

How Will AI Impact Future Developers?:

Greg believes AI is changing how software developers work.

Rather than spending most of their time writing code manually, developers increasingly spend their time crafting prompts, evaluating outputs, reviewing AI-generated work, and refining solutions. However, he emphasizes that foundational technical skills remain critical because developers still need to understand what the AI is producing and verify its quality.

What Does the Future of AI Look Like?:

Greg predicts that AI will continue becoming more autonomous through the rise of “agentic” workflows, where AI systems can perform increasingly complex tasks with limited human involvement.

Rather than replacing employees, he believes AI agents will help automate routine and repetitive work, allowing professionals to focus on higher-value activities. Organizations that establish strong governance today will be better positioned to safely take advantage of these future capabilities.

How Can Companies Ensure Compliance?:

Compliance begins with strong AI governance. Organizations should:

• Understand their data.
• Select approved enterprise AI tools.
• Establish acceptable use policies.
• Limit access during implementation.
• Involve executive leadership.
• Continuously review risks and controls.
• Maintain human oversight over AI-generated work.

By combining security, governance, and responsible adoption practices, organizations can safely leverage AI while protecting their data, employees, and customers.