Are you going to ban AI at our company?
No. We don’t ban AI. We make sure you can answer four questions: which AI tools touch your data, what your team can safely put into them, who approved them, and whether you can prove it. Your control owner makes the business calls.
What can the assessment miss?
We identify AI tools through Microsoft 365 activity, connected applications and staff responses, then document what was and wasn’t checked. Tools not visible through those sources, such as personal devices or browsers we don’t manage, may be missed, and the report says so.
How long does the assessment take?
Our target is findings within 10 business days after we receive access and staff responses. We set the date for those at kickoff, and the 10-day target starts when we have them.
Do we need a Castile managed plan?
No. Castile AI Guardrails begins after AI Governance Implementation, or after we review and accept your existing AI policy and control configuration. No other Castile plan is required.
When does blocking start?
Only after a rule has run in warn mode for at least 30 days, we have reviewed the warnings with your control owner, and your owner approves blocking in writing. Blocking is turned on where your devices are enrolled and your licenses support it. Where they don’t, the rule stays in warn mode and the quarterly report says so.
Does this guarantee our data never leaks, or that we get approved for cyber insurance?
No. Nobody can honestly promise either. What you get is controls set up where your devices, licenses and Microsoft 365 services support them, an honest list of coverage gaps, and quarterly evidence you can show a client, insurer or regulator.
What happens when someone wants a new AI tool?
They send a request with the tool, who will use it, what for, and which data is involved. Complete AI tool requests receive a written decision within five business days, excluding time waiting on the client, vendor, legal counsel, Microsoft, or other third parties.
