Execution Timeline: Q2 2026
Industry: Mortgage Lending
Size: ~50 Employees
Engagement: AI Governance, Data Protection & Implementation Review
The Problem
This mortgage lender’s team embraced AI early, using it across 19 different tasks. The company already had a written AI policy, but no intake, approval, or exception process to put it into practice, and many tools ran on personal accounts. With borrower data and regulatory obligations in play, leadership wanted a clear, practical framework that would let staff keep using AI with confidence.
The Solution
- Mapped real AI use. GadellNet surveyed staff and built a usage and risk matrix, scoring each use case on data sensitivity and where the output goes. Then it was assigned a tier of Low, Medium or High.
- Reviewed Microsoft 365 for AI readiness. A read-only review confirmed strong foundations, including enforced MFA and admin approval before any app can connect to company data. It also pinpointed the next priorities like sensitivity labels and SharePoint access reviews.
- Built on the policy they already had. Our governance review delivered six recommendations: staff acknowledgment of the policy, a named AI Owner, business team accounts for ChatGPT and Claude, phased Microsoft Purview data protection, central AI records, and light training.
- Walked leadership through every recommendation with the COO and compliance manager.
Did You Know?
Before any formal approval process existed, 28 of 48 surveyed employees were already using AI at work. Starting with real usage data meant the governance framework was built around how people actually work.
The Results
- A stronger AI policy. The compliance team is folding the review’s language directly into the company’s AI policy.
- Clear ownership. The COO leads the AI program day to day, the compliance manager owns policy and approvals, and ownership serves as the escalation point.
- A simple sign-off path. Staff will acknowledge a short policy appendix after training, using the HR platform process the company already runs.
- Existing controls validated. An existing Microsoft data protection rule automatically blocked sharing of a file containing sensitive loan content, confirming the company could move forward without a large new project first.
- Momentum for what’s next. Ownership is moving to formally adopt the review, with staff training and AI pilot planning up next.
Ready to put AI to work safely? Contact GadellNet’s AI Strategy & Adoption team about where to start.