Guides
Longer explanations of the frameworks, policies and attacks that come up when an organization starts using AI, written for the people who have to decide. Each guide is labeled with the readers it suits best.
- Governance
AI governance frameworks explained for small organizations
How the NIST AI RMF, ISO/IEC 42001 and the EU AI Act differ, and how a small organization can build a light AI governance setup from them.
- IT teams
AI red teaming explained for organizations that use AI
What AI red teaming is, how MITRE ATLAS helps you plan tests, and a one-hour exercise a small organization can run on its own chatbot or assistant.
- Non-profits
AI vendor assessment questions to ask before you sign
A plain-language list of questions to send an AI vendor before you sign, what good answers and red flags look like, and how to record and compare replies.
- Non-profits
An AI acceptable-use policy template for non-profits
A ready-to-adapt AI acceptable use policy template for non-profits, with sample wording for each section and a simple plan to roll it out to staff.
- Governance
An AI risk assessment template for small organizations
A fill-in AI risk assessment template with eight sections, a worked example and a simple routine for keeping it current at a small organization.
- IT teams
An AI security checklist for small organizations
A practical AI security checklist for small organizations, grouped by task, with advice on fixing the worst problems first and how often to repeat it.
- Developers
LLM security basics for teams running AI applications
What changes when you secure an app built on a large language model, the six risk areas to cover, and the controls and patching habits that keep it safe.
- Non-profits
Prompt injection explained for people who are not engineers
A plain-language guide to prompt injection: what it is, where it shows up in a small organization, and the setup choices and vendor questions that limit harm.
- Governance
The EU AI Act timeline for small organizations
Every EU AI Act date from 2024 to 2028 in a single table, what each stage means for a small organization that uses AI tools, and the steps to take now.
- IT teams
The OWASP Top 10 for LLM applications in plain language
What each of the 10 risks in the 2025 OWASP list for LLM apps means, with an everyday example and a question to ask a vendor or developer.
- Non-profits
What happened in the March 2023 ChatGPT data exposure
A plain-language account of the March 2023 ChatGPT bug that exposed some chat titles and payment details, and what a small organization should do about it.
- Non-profits
What is AI safety, and how is it different from AI security
A plain-language guide to what AI safety means, how it differs from AI security, and the practical steps a small organization can take on each.