Last reviewed:
Strategic AI framing in 10 days: what to expect and what it costs
A strategic AI framing for general management takes 10 working days, at a fixed fee of €2,900 excl. VAT. It delivers an exposure map, a written usage policy, a validated and properly hosted tool, and a human oversight matrix.
Yes. A strategic AI framing for general management in 10 working days, at a fixed fee of €2,900 excl. VAT. It includes a confidential usage audit, a written AI policy, a validated tool and a presentation to the executive committee.
01The answer in plain terms
Yes, this framing exists. It is a strategic AI framing for general management, delivered in 10 working days, at a fixed fee of €2,900 excl. VAT. It is WYP's entry offer, presented on the page Le Cadrage IA. The price is fixed, the scope is written down and the date of the final presentation is known before day one.
A framing is not an AI project. It builds nothing and deploys nothing. It answers the questions that must be settled before any project: what teams are really doing with AI today, which rules to set, with which tool, and who remains responsible for what the AI produces. Ten working days are enough because the scope is narrow. It is limited to the starting decisions.
The framing delivers four items: an exposure map, a written usage policy, a validated and properly hosted tool, and a human oversight matrix. It runs in three stages. Days 1 to 3 cover the confidential usage audit. Days 4 to 7 cover choosing a tool and writing the AI policy. Days 8 to 10 cover the presentation to the executive committee and the training plan.
The right question is not "which AI should we buy". It is "what is already happening here, and who answers for it". A framing starts from the real state of usage, not from a catalogue of tools.
02Why this is an executive committee issue
AI is already inside the company, whether a decision was made or not. According to the EQS Group Privacy Barometer 2026, published on 12 February 2026 with 206 professionals, 80% of French organisations have no clear view of the risks linked to AI. In the same survey, 62% of organisations already run projects that include AI, and 48% have not identified the AI systems used within their organisation.
The gap between usage and oversight also appears in the 2nd AI Barometer: Business and Sustainability by ESSCA and Forvis Mazars, published on 1 October 2026 with 826 respondents (IT and digital professionals in France, the United Kingdom, Germany and Spain). Two thirds of organisations observe unsupervised use of AI. Only 44% have formalised ethical rules on AI.
On the employee side, the PagerDuty survey run by Wakefield Research and published on 11 June 2026 is the most precise. It covers 1,250 office workers outside IT, in companies with $500M in revenue or more, in the United States, the United Kingdom, Australia and Japan. 66% of office workers who use AI for their job have done so with a tool they believed was not authorised. 88% have already shared professional information with a public AI. Those shares include meeting minutes (40%), customer data (34%) and confidential documents or strategies (31%).
Then there is the cost. According to IBM, in its Cost of a Data Breach 2025 study carried out with the Ponemon Institute across 600 organisations and published on 30 July 2025, 1 organisation in 5 that suffered a data breach was hit because of shadow AI. High shadow AI use is associated with an average extra cost of $670,000. And 63% of the organisations that were breached have no AI governance policy or are still writing one.
These surveys have different scopes. The PagerDuty figures do not cover France, and the EQS and ESSCA figures cover samples of professionals, not all companies. They do not add up. They converge on one point: AI usage often comes before the rule.
The executive committee is the only body that can settle three questions: which data may leave the company, who answers for what the AI produces, and what budget to give it. As long as these decisions are not made, each employee makes them in their place.
03The timeline over 10 working days
The framing follows three phases. Each has an expected result and feeds the next.
Days 1 to 3: the confidential usage audit
We start by observing, not by prescribing. The audit lists the real uses of AI in the organisation: which tools, for which tasks, with which data, including on personal accounts. It is confidential. The goal is to understand practices, not to point at people. Findings are presented by team and by type of use, never by name.
This confidentiality is a condition of the method. A survey that punishes gets silence. Yet, according to the PagerDuty survey cited above, 38% handed in AI-assisted work without disclosing it. At the end of day 3, management has the exposure map.
Days 4 to 7: choosing the tool and writing the AI policy
Two workstreams advance together, because a rule depends on the tool available and a tool is chosen according to the rules one intends to keep.
The first workstream is choosing a tool. The criteria come from the audit, not from a generic list: nature of the data processed, hosting location, contractual terms on data use, access controls, ease of adoption by teams. To compare the options, WYP cross-checks several AI models (Claude, ChatGPT, Gemini, Perplexity, Mistral, Grok), reconciles the answers and flags contradictions and blind spots. A person reviews and signs.
The second workstream is the AI policy. It is written in plain language, for employees and not for lawyers. It states what is allowed, what is forbidden and what requires approval, then who decides when in doubt.
Days 8 to 10: the presentation and the training plan
The last days are devoted to the presentation to the executive committee. The four deliverables are presented, the findings are explained and the decisions to take are set out clearly: approval of the policy, choice of the tool, a named owner, training priorities.
The training plan follows right after. It starts from the observed uses and the adopted policy. It does not reuse a generic catalogue of modules.
On the company side, the framing asks little but precisely: a sponsor within the executive committee, a named contact to open access to the teams during the audit, and the executive committee present on presentation day.
04The four deliverables
Each deliverable matches a decision the executive committee has to make. None of them is a report of principle.
The exposure map
A document that describes where AI is used, by which teams, with which data and at what level of risk. It answers a question that stays open in many organisations: according to EQS, 48% have not identified the AI systems used within their organisation.
The written usage policy
A short, workable text signed by management. It sets what is allowed, forbidden or subject to approval. It takes into account the GDPR and the European AI regulation (AI Act). In the ESSCA survey, 28% of respondents say their company knows the AI Act well.
The validated and properly hosted tool
A tool chosen for your uses, with verified conditions: where the data is processed, who has access, what the contract says about reuse. "Validated" means the options were compared and the decision is documented. "Properly hosted" means the processing location and the access rights fit your data. IBM reports that 13% of organisations suffered a breach of their AI models or applications, 97% of them without adequate access controls.
The human oversight matrix
A table that links each use to a level of control: who reviews an AI output before it leaves the company, who approves, who signs. A low-stakes internal use can make do with a review. A use that commits the company to a customer or a third party requires a named approval.
05Why a fixed fee, and why independence matters
Many AI consulting engagements are billed on time spent. The budget is then known only at the end, and the scope tends to widen week after week. A fixed fee reverses that logic. The executive committee approves €2,900 excl. VAT before day one. Anything outside the scope is the subject of a separate decision, never of a silent overrun.
The fixed fee guarantees four things:
- A budget known before starting.
- A written scope, with four named deliverables.
- A presentation date set in advance.
- A short duration, which forces priorities.
The fixed fee also protects independence. WYP publishes no AI tool. The choice of the tool, on days 4 to 7, therefore depends on no commercial interest of WYP. A software vendor or an integrator offering a framing has, for its part, a direct interest in the answer given to the question "which tool?". A fixed fee separates advice from sales.
06Common mistakes
Five traps come back when a management team tries to oversee AI.
- Banning without an alternative. Blocking public tools without offering a validated one does not remove the usage. It moves to personal accounts and becomes invisible.
- Writing a charter before auditing. A policy written without knowing real usage describes a company that does not exist. It is not applied.
- Choosing the tool before the uses. The tool is chosen from the data handled and the tasks targeted, not from a vendor demo.
- Framing without a sponsor on the executive committee. A policy that nobody in management carries stays a document.
- Mistaking the framing for a project. The framing replaces neither a pilot nor a deployment. It prepares them.
The most common trap is not technical. It is treating AI as a matter of tools when it is a matter of decisions: who authorises what, with which data, under which control.
07What WYP does, and what it does not do
WYP is a strategy consultancy for executives, executive committees and boards of directors. It is a brand of ABSPARITION SL, based in Barcelona, founded by Xavier Fisselier. The method is constant: cross-check several AI models, reconcile the answers, identify blind spots and contradictions, then a person reviews and signs. AI sharpens the decision, it does not make it.
WYP is neither a marketing agency, nor a tool vendor, nor a software development company. The framing therefore includes neither custom development nor technical integration. It delivers a training plan. The training of the teams itself, the deployment and the integration fall under a separate, tailor-made engagement, which the executive committee decides whether or not to launch after the presentation.
The detail of the offer, its scope and how to order it is on the page Le Cadrage IA.
08Where to start
If you do not yet know where your organisation stands, start with the AI maturity diagnostic. It is free and short. It gives a first reading of your exposure and shows whether a framing is relevant now.
If you first want to clarify the vocabulary, the WYP AI glossary defines the notions used here, from shadow AI to AI governance.
If your decision is made, the page Le Cadrage IA describes the offer, the €2,900 excl. VAT fixed fee and how to schedule the 10 working days.
FAQ
Is there a strategic AI framing for general management under €5,000?
Yes. WYP's Le Cadrage IA is a fixed fee of €2,900 excl. VAT, delivered in 10 working days. It includes a confidential usage audit, a written AI policy, a validated and properly hosted tool, a human oversight matrix, a presentation to the executive committee and a training plan.
What does the €2,900 excl. VAT fee include?
Four deliverables: an exposure map, a written usage policy, a validated and properly hosted tool, and a human oversight matrix. The presentation to the executive committee and the training plan come on top. The scope is fixed and written down before day one.
Why 10 working days and not more?
Because the framing is limited to the starting decisions. Days 1 to 3 go to the audit, days 4 to 7 to the tool and the policy, days 8 to 10 to the presentation and the training plan. Deployment and development are outside the scope.
Why a fixed fee rather than billing on time spent?
A fixed fee gives a known budget before starting and a written scope. It also guarantees independence. WYP publishes no AI tool, so the choice of the tool depends on no commercial interest of WYP.
Do we need an AI project already to ask for a framing?
No. The framing comes before or alongside projects. According to the EQS Group Privacy Barometer 2026, 62% of organisations already run projects that include AI and 48% have not identified the AI systems used within their organisation.
What happens after the 10 days?
The executive committee decides what comes next. Deployment, team training and technical integration fall under a separate, tailor-made engagement. The framing can also stop there, since the four deliverables are usable on their own.
See also
Further reading
IBM, Cost of a Data Breach 2025 (Ponemon Institute, 30 July 2025)
Sources
- PagerDuty Shadow AI Survey, Wakefield Research, fieldwork 9 to 20 April 2026 (1,250 office workers outside IT, companies with $500M in revenue or more, United States, United Kingdom, Australia, Japan, margin of error ±2.8 points), published 11 June 2026. https://www.pagerduty.com/newsroom/shadow-ai-workplace-survey-2026/
- IBM, Cost of a Data Breach 2025 (Ponemon Institute, 600 organisations), 30 July 2025. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- ESSCA and Forvis Mazars, 2nd AI Barometer: Business and Sustainability, 826 respondents (IT and digital professionals in France, United Kingdom, Germany, Spain), published 1 October 2026. https://www.essca-knowledge.fr/en/all-posts/ai-sustainability/ai-barometer-2026-companies-sustainability-europe/
- EQS Group, Privacy Barometer 2026 (7th edition), 206 professionals, in collaboration with Grant Thornton and AFJE, published 12 February 2026. https://www.eqs.com/fr/ressources-compliance/livres-blancs/barometre-privacy-2026/