Skip to main content
ThoughtFox
Book a call

Safe AI Use: Rules that help you say yes to AI, under the EU AI Act.

For businesses whose people are already using AI, with or without permission. Two fixed-scope packages, Safe to Start and Safe to Scale, find every tool in use, set clear rules and give people a quick way to get a yes. You keep the record the EU AI Act expects, and a named owner of your own keeps it current.

Book a 30-minute call

Not ready to talk? Take the 5-minute AI readiness check

THOUGHTFOXRECEIPT 000 · YOUR AI LIST
Tool
to agree
Used for
to agree
Data in it
to agree
Owner
to agree

** EVERY TOOL, A NAMED OWNER **

000 05 0000
RECEIPT 000 · YOUR AI LIST: Tool to agree, Used for to agree, Data in it to agree, Owner to agree. every tool, a named owner.

Sound familiar?

“A client’s questionnaire asked for our AI policy. We had nothing to send.”

The managing director

“Our default answer is no, because nobody knows what’s allowed.”

The operations lead

“Recruitment want an AI tool to screen CVs. I’ve no idea if we’re even allowed.”

The HR director
What you get

Safe use becomes a habit, not a policy on a shelf.

All of this comes with Safe to Start. Safe to Scale builds on it.

  1. A list of every AI tool you use.

    Including the ones people signed up to themselves, each with a named owner and a traffic light.

  2. A one-page policy people actually read.

    Which tools to use, what information never goes in, how to check AI’s work, and how to ask for something new.

  3. Client data kept out of the wrong tools.

    Checks on your main AI suppliers: where your data is stored, and whether it is used to train their AI.

  4. A quick route for every new request.

    Low-risk uses go straight ahead. Higher-risk ones go to the right person to sign off.

  5. Training for every level, with a record.

    Who was trained, to what level, and when, kept fresh with SharpFox reinforcement.

  6. A named owner who keeps it running.

    One senior person, about two hours a month, with one line in every quarterly board pack and a yearly review.

Proof

At Emydex, we trained the leadership team first. They built the company’s AI policy and staff training themselves, and nobody gets an AI licence until they’ve been trained.

Your duties

What the law asks. What you can show.

The EU AI Act asks every organisation that uses AI to help its people use it safely. The law calls this AI literacy, and it has applied since February 2025. Since July 2026 the duty is to take reasonable steps, not to guarantee a set level, so what matters is a record of what you did: who was trained, to what level, and when.

Every new use of AI goes through the same short route, and leaves a record behind it. Risk decides how fast a request moves, not whether it does. The only firm no is the short list of uses the law bans. Pick a request to see how it moves.

Try a request
  1. 01 · ProposeThe customer service lead

    They want AI to draft first replies to customer emails, so the team answers faster.

  2. 02 · CheckCustomer data

    Customer details only go into the approved tool. A person reads and edits every reply before it is sent.

  3. 03 · Sign offManager approves

    Amber light: the team’s manager signs it off.

  4. 04 · RecordEntry with a condition

    The list records the use, the data and the rule that a person checks every reply.

Example routing. Your own sign-off levels are agreed with you.

THOUGHTFOXAI LIST · ENTRY AI-014
Request
First replies to customer emails
Tool
Approved AI assistant
Data in it
Customer names and queries
Signed off by
Customer service manager
Owner
Customer service manager
TRAFFIC LIGHTAMBERmanager approves

** A PERSON CHECKS EVERY REPLY **

014 05 1111
Packages

Two packages. Safe to Start, then Safe to Scale.

Together, they give you an AI governance framework: the rules, checks and owners that keep AI use safe. Both use the same five steps: Scan, Prioritise, Implement, Control, Educate. Safe to Scale goes deeper on each one, so you never start again from scratch. Both are fixed in scope, so you know what you’re getting before you start.

Need your people trained first? Start with our 90-minute AI literacy session and a year of SharpFox reinforcement. Safe to Start builds on it.

Safe to Start

For businesses that buy AI tools rather than build them, with little or no governance in place yet.

  1. Find what’s in use.

    A short staff survey, a conversation with each team and a check of your software licences. Every tool gets a traffic light, and we check for banned and high-risk uses.

  2. Put the basics in place.

    We set up the policy, key controls, supplier checks and an access check with you, then walk through the incident plan once with IT and data protection.

  3. Train and hand over.

    Training for every level, leaders first, then SharpFox reinforcement. Your named owner takes it from there.

Time:
four to six weeks
You leave with:
a list of your AI tools with traffic lights, an AI policy with the route for new requests, one page on who owns what, a supplier check sheet, a procedure for telling people when AI is involved, and a training record.
Ask about Safe to Start →

Safe to Scale

For businesses where AI is spreading across teams or sites, regulated firms, and any firm with a high-risk use, its own AI builds or AI agents. Everything in Safe to Start is in place first, whether we did it or you did.

  1. Map everything you run and build.

    Every AI system and agent, with its owner, purpose, data and supplier, including AI you build, each one formally classified for risk.

  2. Decide and control.

    Your board approves what AI will and won’t be used for. Checks that prove your rules are working, supplier checks built into buying, and our step-by-step method for any high-risk AI.

  3. Watch it, and run it yourselves.

    A monitoring plan for each key system: what to watch for, including drift, and when to pause. Who decides what, in writing, a quarterly board report, practice runs for when things go wrong, and role descriptions for your AI lead and system owners.

Time:
set once we know your systems
You leave with:
who decides what, in writing, a statement your board approves, a monitoring plan for each key system, role descriptions, a quarterly board report and a tested plan for when things go wrong.
Ask about Safe to Scale →
After the training

SharpFox: reinforcement, two minutes at a time.

Training fades if nobody uses it. SharpFox is our reinforcement tool. Short questions, about two minutes each, arrive in the chat tool your team already uses, each one a real situation from their work. Answers are scored, and people see the right answer straight away.

Behind it sits an admin view. You see who has been trained and how reinforcement is going, and you can show it to anyone who asks: a client, an auditor or your board.

Try it. Answer as your team would, then switch to the admin view.

SharpFox· 2-minute reinforcement
SharpFox APP · 1 of 3

A colleague pastes a client’s contract into a free AI tool to summarise it. What’s the risk?

Score 0 of 0Added to your training record

We arrive with tested templates, checklists and a method for high-risk AI, in light versions for smaller firms and full versions for larger ones. Everything we set up is yours, and your own people run it. Any AI tool that carries real risk also gets its own check, such as an impact assessment, a bias audit or rules for an AI agent, agreed with you before it starts.

Running AI agents?

Agents act, not just suggest. Our rules give each one a named owner, ongoing monitoring, a full log of what it did, built-in limits and a stop that has been tested, and it is approved again whenever its AI model changes. Part of Safe to Scale, and added to Safe to Start if agents are already running.

What does it do on its own?
What can it touch?

Tier 3: High A written charter, hard limits, a named person checking it, an impact assessment, logs checked weekly and its stop tested every quarter.

Based in Ireland?

You may be eligible for training grants through Enterprise Ireland, IDA Ireland or Skillnet Ireland. We’ll help you check what applies and prepare the application.

AI literacy check

Where does your organisation stand?

Answer three questions honestly. There are no right or wrong answers, only useful ones. We use your answers to tailor the free guide we send you: How To Guide: Building AI Literacy in Your Organisation.

1 / 3 Does your organisation have an AI policy?

A formal policy covering acceptable AI tool use, data handling, risk assessment and employee responsibilities.

2 / 3 Do you know what AI your people are using right now?

Shadow AI is one of the fastest-growing data risks. People are not acting maliciously, they are being productive, but without literacy and governance they make decisions about your data that you have not sanctioned.

3 / 3 Have you put any AI training in place for your people?

Any structured programme, formal or informal, that helps people understand AI, use it responsibly or build their capability.

About you
Who leads this

Led by people who’ve sat on the other side.

  • Marie Toft, ThoughtFox

    Marie Toft

    Co-founder, AI Governance & Literacy Lead. Lectures in AI governance and compliance at Trinity College Dublin, and has taken organisations such as Workday and Fidelity Investments through AI executive leadership training.

  • Edel Churchill, ThoughtFox

    Edel Churchill

    Co-founder, AI Adoption & Change Lead. Has served on boards in healthcare technology and financial services, with oversight of regulatory compliance. Holds diplomas in Advanced AI for Business and in Corporate Governance.

Questions people ask

Before you book the call.

Does the EU AI Act apply to us?

If your people use AI at work in the EU, the duty to help them use it safely applies to you. Higher-risk uses bring more duties, and we’ll tell you which, if any, apply.

We’re based in the UK.

If your AI, or what it produces, is used in the EU, the Act can reach you. Either way, clients and insurers increasingly ask to see your AI policy and records.

Our group already has an AI policy.

We work within it. Your division gets its own list of tools, owners and training, lined up with the group’s rules.

Our people use AI on their own accounts.

Most businesses we meet are in the same position. We find it first, without blame, then bring it inside the rules.

How much of our time does it take?

Less than people expect. One senior person takes it on as part of an existing role, usually about two hours a month. Most staff need one 90-minute session.

Is this legal advice?

No. We get you ready to meet your duties under the EU AI Act and GDPR, in plain English. Where a question needs a legal view, we say so, and sign-off sits with your own advisers.

Further reading

Find out what AI your people already use.

Start with a call, or take the AI readiness check. It shows which package fits, or whether you’ve already done enough to begin at Safe to Scale.

Book a 30-minute callTake the AI readiness check