How I use AI

Why this page exists

AI consulting is part of my practice. If I'm going to sit across the table from a client and help them decide what their people can and can't do with these tools, you should be able to see the rules I hold my own firm to.

Saying "we don't use AI" isn't believable in 2026. We use it for research, drafting and editing, and I'd rather just say so. Even autocomplete in Outlook or Gmail, or a pass through Grammarly, is some form of AI. A disclosure label at the bottom of a page doesn't help much either. It doesn't tell you anything you can act on, and after you've seen five of them you stop reading. So this page spells out where a model shows up in our work, where it doesn't and what we won't put into one.

The basic rule is that a real-live human reviews every deliverable before it goes out.

The question I tell clients to ask

I tell clients to ask every vendor two questions. How do you use generative AI? And do your AI tools train on the data we give you? A vendor should be able to answer both plainly, so here are my answers.

We use AI to help write rough first drafts, to work through research (simple and complicated), to pull facts together with citations we can check and to build system diagrams when a project needs them. Our tools don't train on the data we give them. And one of us reads every line before anything goes to a client. The judgment and expertise in our deliverables are ours. The AI tools sometimes help us finish faster.

What goes in, and what never does

If we were evaluating a consultant, this is the part we'd ask about first, because what data goes into a model is a bigger risk than which model it is.

Every AI tool we use runs on a business account with enterprise terms: it doesn't train on our inputs, and it keeps data only for a short window. We don't use consumer chatbots or consumer AI tools.

Enterprise terms aren't permission to paste in everything, though, so the rules on data are stricter. Threat indicators specific to a client don't go into a model. When AI touches work for a client, we strip the client out first. The model sees "a water treatment client" or "an election office," never a name, a network or any detail that would identify one.

The exception is incident response, and it's narrow. If a client gives us logs during an incident, we may use these tools to help review them, inside that same enterprise setup. Credentials and personal information still stay out.

Where a model shows up

A draft usually starts with me talking. Wispr Flow turns that into a rough transcript, a model helps me find the structure in it, and then I fix what I said. The tools include Adobe Creative Cloud, Claude, ChatGPT, Canva and occasionally OpenAI's open-weight gpt-oss model.

For research, a model summarizes the standard, rule or vendor documentation and points me to the parts that bear on the question I'm working on. Then we read the source. Every statistic, citation and quote that reaches a client or appears on this site gets checked against the original, because models will produce references that look right and don't exist.

We also use models when editing, to cut and tighten and to catch places where we wrote around a point instead of making it. A real-live human makes and owns every judgment call.

What stays ours

The ideas and the analysis stay ours. Findings, risk ratings and the final recommendation on an engagement come from the consultant who did the work, not from a model. We don't ask a model to fill in something we don't know and then present the answer as if we knew it. We don't generate client examples, case studies or testimonials. Every engagement we describe is real.

The people who work with me

Foundation Consultant Group is me plus subcontractors. This policy is part of every subcontractor agreement, so it binds them too. Subcontractors tell me how they used these tools on an engagement, and their work gets the same human review mine does.

Worth reading

I didn't invent this kind of page. The Center for Democracy and Technology publishes its own generative AI usage policy. It's short and readable, it's upfront that its staff use these tools, and it puts a person behind every use. I send clients to it a lot. Katie Harbath's "How I Use AI to Make My Newsletter, and What I Won't Let It Do" walks through her whole process, including the tools and the limits. She does amazing work.

Questions

If you're evaluating us and need more detail than this page gives, ask. Engagement agreements can include specific terms on AI use, including terms stricter than what's written here. You can reach us through the contact form.

Version 1.3, published Oct. 7, 2026. This version trims the list of what stays out of AI tools and rewrites the page in plainer language. Version 1.2 (Aug. 15, 2026) added the section on client data, the reasoning behind the rules and two outside references. It also says "we" where the whole firm is responsible, not just me. If I update it again, I'll change the version and date here and say what changed.