The leadership team that discovered “shadow AI”
Employees paste customer data into free AI tools. You need a policy that works in practice, not a PDF nobody reads.
AI Governance for SMBs
AI governance to use AI safely without slowing the company down.
For companies with 50 to 500 employees where teams already use AI — with or without permission — and leadership needs clear rules, risks under control and LGPD compliance. We put this in place in weeks, sized right for your company.
Who it's for
Three situations where this service makes sense.
The company that sells to large clients
Clients and public tenders are starting to require an AI policy, a risk assessment and evidence of compliance. We prepare you to respond with confidence.
The DPO or legal team without technical support
You know the LGPD, but you need someone to translate the law into technical controls inside the AI tools and integrations.
Problems and answers
What governance solves
Nobody knows which AI tools are in useInventory of tools, models and integrations, with the data flowing through each one and the associated risk.
Personal data going into AI without a legal basisUsage rules by data type, minimization and anonymization, a record of processing activities and adjustments to the privacy policy — aligned with the LGPD.
Automated decisions without an ownerRoles, mandatory human oversight at critical points, an audit trail and an incident response process.
A client or audit asking for evidenceA documented governance program aligned with ISO/IEC 42001 and the NIST AI RMF, at the level of formality your company's size requires.
How it works
Four stages, with a concrete deliverable in each one.
Short cycles, defined timelines and governance from day one. You know what you get and when.
01
Assessment
Inventory of current AI use, interviews with each department, risk classification and gaps relative to the LGPD.
1 to 2 weeks02
Strategy
Use policy, roles and a (lightweight) committee, controls by risk level and a prioritized compliance plan.
2 weeks03
Implementation
Technical controls in the tools and integrations, team training, assessment and record templates.
3 to 6 weeks04
Evolution
Monitoring of models and tools, periodic risk review, updates as regulation evolves.
quarterly
What you get
Deliverables, not slide decks.
- Inventory of AI tools, models and data flows
- Responsible AI use policy ready to publish internally
- Risk matrix and prioritized compliance plan (LGPD, ISO/IEC 42001, NIST AI RMF)
- Technical controls configured in the tools and integrations
- Impact assessment template for new use cases
- Team training and an evidence kit for clients and audits
Frequently asked questions
What SMBs usually ask.
Does an SMB really need AI governance?
It needs governance of the right size. An 80-person company doesn't set up a 10-member committee; it sets up a 3-page policy, one owner, three clear rules about data and an up-to-date inventory. That is what we put in place.
Is AI governance the same as LGPD compliance?
No, but they overlap. The LGPD (Brazil's General Data Protection Law) deals with personal data; AI governance also covers quality, bias, vendor dependency, human oversight and model security. We handle both in an integrated way.
Do I need to certify the company under ISO/IEC 42001?
For most SMBs, no. We use the standard as a reference to structure the controls; certification only makes sense when a client or market requires it — and in that case, the program already leaves the company prepared.
Does Brazil's AI bill change anything right now?
Brazil's AI bill (PL 2338) is still moving through Congress, but the direction is clear: risk-based classification, transparency and accountability. Structuring governance today avoids rework when the law takes effect and already meets what clients and the ANPD (Brazil's data protection authority) expect.
See also
The other two NexaOps services.
Contact
Let's talk about AI governance for your company.
Describe your situation in a few lines. We reply within one business day with a proposal for an initial conversation — free and with no commitment.
Request a free assessment
Tell us a little about your challenge. We will get back to you with a proposal for an initial conversation.