Independent secure AI adoption advisory for New Zealand and Australian business. We assess where AI is already in use, show you what to fix first, and give you the evidence to put in front of clients, insurers and auditors.
Book an AI readiness conversation →Your people adopt the tools that make their work easier, and most of that adoption happens without a formal decision. Assistants and chatbots, AI note takers, browser extensions, AI features switched on quietly inside software you already pay for, and models wired straight into a workflow by whoever happened to hold the API key. Very few organisations can say with confidence which AI tools touch their data, what those tools do with it, or who is accountable when something goes wrong.
Meanwhile the security questionnaires that spent five years asking about multi-factor authentication and backups have started asking how you govern AI. Clients, insurers and procurement teams now want evidence, not assurances. Most businesses cannot produce it.
Secure AI adoption is not a product you buy or a switch you turn off. It is the governance that lets a business use AI confidently: knowing which tools are in use, understanding the risk of each, setting rules staff can follow, and being able to show your workings when someone asks.
Done properly it is an enabler rather than a brake. The businesses that govern AI well move faster, because they are not stopping every few months to worry about whether they have created a privacy problem.
A register of every AI use case across your business, risk rated, with named owners.
We establish where unapproved AI tools are in use, and what that exposes.
Acceptable use policy and controls aligned to ISO/IEC 42001, the NIST AI RMF and the CSA AI Controls Matrix.
For when procurement or a major client starts asking for the certificate.
Most businesses are not adopting AI in the abstract, and rarely through one door. It arrives as a licensed assistant, as a tool someone signed up for, as a feature switched on in an update, and as a model embedded in something you build. Each route raises the same questions about data, accountability and oversight, so we assess all of them:
The assessment is deliberately tool agnostic. Platforms change every few months, so we govern the use case, the data and the accountability rather than writing a policy that expires with the next product release.
We do not sell, deploy or configure any of these tools. Your IT provider does that. We establish what good looks like, and verify it independently.
The AI security market is crowded with vendors selling a tool as the answer. Mosaic takes no product commissions and resells no tooling, so our findings are shaped by your risk and nothing else. You get advice you can act on, and evidence you can hand to a third party without it looking like a sales document.
Secure AI adoption is the practice of putting governance, risk assessment and controls around AI tools before and during their use, so a business gets the productivity benefit without exposing data, breaching privacy obligations or failing a client security review. In practice it means knowing which AI tools are in use, assessing the risk of each, setting an acceptable use policy, and assigning named owners for the decisions AI touches.
If your staff use AI tools of any kind, yes. An acceptable use policy tells staff which tools are approved, what data may never be entered into them, and how to request a new tool. It is also the first document a client, insurer or auditor will ask for when they start asking how you govern AI.
Shadow AI is the use of AI tools by staff without the knowledge or approval of the business. It matters more than ordinary shadow IT because the moment a prompt is submitted, the data has already left your control. Most organisations underestimate how widespread it is until someone looks properly.
Entering personal information into an AI tool you do not control can be a disclosure, and may involve sending that information offshore. Under the NZ Privacy Act 2020 you remain accountable for personal information you hold, including how it is used, disclosed and sent overseas. That makes an AI use case register and clear rules on what data may be entered a practical necessity, not a formality.
ISO/IEC 42001 is the international standard for AI management systems. Most small and medium businesses do not need the certificate, but the structure behind it (a register of AI use cases, a risk assessment for each, and named owners) is exactly what stops shadow AI taking root. The certificate becomes worth pursuing when procurement or a major client starts asking for it.
Yes, whichever tool it is. We assess the governance around it: what data it can reach, who is accountable, what your acceptable use rules should say, and what needs to be in place before a wider rollout. We do not sell, deploy or configure the tooling itself. Your IT provider does that, and we tell you what good looks like and verify it independently.
No. Mosaic takes no product commissions and resells no tooling. We assess, advise and provide the evidence. That independence is the point: our recommendations are driven by your risk, not by what we would otherwise be trying to sell you.
It depends on the size of your business and how many AI use cases are in play. Most engagements are measured in weeks rather than months, and we scope and price the work before we start so there are no surprises.
A no-obligation conversation about how AI is being used in your business, what it exposes, and what to do about it first.
Book an AI readiness conversation →