// OF-04 · Govern

AI and automation governance: use agents and AI tools without losing control.

A fixed-scope diagnostic for SMEs that already use AI or are getting started. It sets who approves what, where credentials live, what gets logged and how far an agent can go. You leave with a workable AI use policy and a short plan.

The problem

AI came into companies through tools: writing assistants, automations wired into email and calendars, agents with access to accounts and documents. It almost always arrived before any rules.

The questions come later. What data is being sent outside? Who gave an agent access to the invoicing account? Where are the API keys? If an automation gets it wrong, will anyone notice and be able to roll it back?

Meanwhile, Article 4 of the AI Act requires organisations using AI systems to take measures supporting their staff's AI literacy. The obligation has applied since 2 February 2025 and is enforced from 2 August 2026, according to the European Commission. The article was amended by Regulation (EU) 2026/1744, in force since 27 July 2026. NIS2, as transposed in Portugal by Decree-Law 125/2025, treats digital service providers as part of the supply chain. AI vendors are among them.

What we review

Inventory of AI tools, agents and automations in use, official or not, and the data each one can reach.
Approval levels: what can run automatically, what needs human sign-off and what should never be delegated.
Secrets management: where the API keys, tokens and passwords used by automations are stored, and who can see them.
Decision and action logging: what is written down, where and for how long, so you can explain and roll back.
Limits on agents: dedicated accounts, least privilege, time windows, budgets and forbidden actions.
AI vendors in the supply chain: contracts, data location, sub-processors and exit plan.

How we work

Remote and fixed scope. We install nothing and do not ask for admin access to your systems.

A short questionnaire and two or three remote sessions with the people who use and manage the tools.
Review of configurations and permissions from exports or shared sessions.
Risk classification of each use and definition of approval levels.
Validation of the draft policy with management before closing.

What you get

A short, workable company AI use policy, in Portuguese and, if needed, English.
An approval matrix by type of action (automatic, with approval, forbidden).
Rules for secrets management and agent accounts, with a tool suggestion that fits your size.
A decision and change log template.
A list of AI vendors with risk, data involved and exit plan.
A 90-day plan and a short team training session, as an AI literacy measure.

Who it is for

Portuguese SMEs, industrial or services, that already use AI day to day or want to start using agents and automations with access to real systems. Especially relevant if the company is in scope of NIS2 or works for clients that are.

Frequently asked questions

Is this an AI Act audit?

No. It is a technical and organisational diagnostic. It helps meet the AI literacy obligation and build evidence, but the legal classification of your systems should be done with legal support.

Do we need AI agents for this to make sense?

No. Even with simple tools such as writing assistants or email automations, it is worth setting rules on data, approvals and credentials before you scale.

Do you recommend specific tools?

Only when useful, and with no commercial ties to vendors. The focus is on rules and controls, which outlast tool changes.

How does this relate to NIS2?

The regime requires supply chain risk management, including digital service providers. AI vendors with access to data or systems fall within that analysis.

Sources

General information, not legal advice.

Last updated: November 2026.