A marketing coordinator has a client proposal due at four pm. She signs up for a free AI writing tool with her work email, pastes in the draft, and has a cleaner version in a few minutes. Nobody in IT knows the account exists. Meanwhile, the client’s proposal is now stored on servers that the company has never vetted.
Traditionally, new software reaches employees by a slower route. Before a new CRM or accounting platform goes live, IT has usually tested it, and someone has signed a contract that spells out where the company’s data will go. But AI tools often bypass that process. They run in a browser and cost nothing to try, so adoption can happen one employee at a time, well below the level where governance usually operates. The convenience that makes these tools useful also keeps them out of IT’s sight.
Multiply the number of employees an organization has by the AI tools they signed up for, and a grim picture emerges. The result is often an expanding portfolio of unvetted vendors, unreviewed data exposure, and AI-dependent workflows that IT can neither see nor support. In regulated industries, each unvetted tool is a compliance risk that could surface at the worst possible moment: during an audit, a breach investigation, or a regulatory inquiry.
Agentic AI compounds the challenge. These systems do not just answer prompts but take autonomous, multi-step actions inside an organization’s IT environment. The infrastructure floods with new machine identities, as every autonomous agent needs credentials to interact with other systems. Poorly governed machine identities expand the attack surface at supersonic speed.
Increased cost can follow closely behind. Even when organizations formalize adoption of AI tools, spending on AI can spiral in ways that do not map to any budgeting process organizations have used before. For instance, Uber exhausted its entire 2026 AI budget by April, as Fortune reported.
Each of these risks traces back to the same gap: AI is arriving faster than most organizations’ governance can absorb it. Technology Management Group (TMG) built its AI Center of Excellence, or ACE, to close that gap. ACE is an operational structure that moves every AI use case, from an enterprise platform evaluation to a single employee trying a free browser extension, through the same lifecycle: intake, triage, risk review, launch, evaluation, and a deliberate scale-or-stop decision. 
Of course, a governance system works only if people actually use it. If every request faces the same level of review, employees will stop asking permission and start working around the process, leaving the organization with the very shadow AI it set out to eliminate.
So while every request follows the same stages, the depth of review depends on the risk. ACE uses a four-tier risk classification, which means a brainstorming tool can be approved quickly while an agent with write access to a client database gets the scrutiny it warrants. Every tool that clears intake goes into a central registry with a named owner and defined success metrics, so the organization can always answer two basic questions: what is running in our environment, and who is responsible for it? The aim is for AI governance to become ordinary business hygiene, handled as routinely as a vendor approval or an access review.
“We’re not an AI startup, bolting governance onto a product,” says Chris Moschovitis, TMG’s founder, chairman, and CEO. “We understand how the technology actually works, how it fails, and how to build a process that people will actually follow because following it is easier than working around it.”
Three and a Half Decades of Pattern Recognition
ACE embodies Moschovitis’ three and a half decades of experience watching several generations of organizations convince themselves that a new technology is fundamentally different from everything that came before it. Remember the dot-com bubble? The shift to the cloud? The explosion of mobile computing? Today, it is AI.
He believes that the technology changes, but the discipline required to adopt it safely does not. The fundamental questions remain the same. Who owns this technology, what data does it touch, how is it tested, when was it last reviewed, what happens if it fails? That pattern recognition is, for him, the most practical asset ACE brings to a client facing AI adoption today. “We’ve already seen how ungoverned enthusiasm for a powerful new capability plays out, and we recognize the early warning signs long before they become headline incidents,” says Moschovitis. 
Why SMBs Cannot Afford to Wait
In almost every conversation with SMB leaders, Moschovitis hears the same thing: “We’re not Microsoft or Amazon; we don’t have a nine-figure monthly AI bill! Why would our risk look anything like theirs?”
In truth, ungoverned AI adoption creates the same categories of risk whether an organization has 50,000 employees or 50. An organization can still end up with duplicate vendor spend that nobody tracks and data handling that nobody has questioned. Some risks do not scale down proportionally with headcount: a compliance gap is a compliance gap, regardless of the number of employees. In fact, these risks can be more dangerous in smaller organizations, because they lack a dedicated security or compliance function watching for them.
Moschovitis puts it plainly: “New technology exposes old governance gaps.” If an SMB already struggles to track who owns vendor relationships, who approves new software, or who is accountable for data handling, AI is not introducing a new problem; it is magnifying one that was already there.
Gaps like these are not new to Moschovitis; they are the reason he founded TMG in 1989. He saw organizations oversold and underserved by technology vendors, with expertise reserved mostly for Fortune 5000 companies. His goal was for business to be served by technology, not held hostage by it. TMG has spent its whole existence serving the organizations those vendors overlooked: the ones without a large IT or compliance department.
In its work with SMBs, TMG does not hand them an enterprise governance program sized for resources they do not have. Instead, it follows five practical, sequenced steps:
- Gain visibility into what is actually being used before writing any policy
- Map AI usage against the data classification the business already has
- Treat AI platforms as vendors and give them the same due diligence
- Make accountability for accuracy and appropriateness explicit and human
- Fold AI governance into existing risk, vendor management, and incident response processes
TMG can do this at SMB scale thanks to two features. First, it provides fractional CIO, CTO, CISO, and DPO leadership, so a smaller organization gets senior judgment without a senior-executive payroll. Second, the company’s platform, cyberCTRL, brings GRC, security orchestration, and incident response together in one flat monthly subscription that is modular enough to scale with clients rather than forcing them to buy shelfware. That combination of senior guidance with a right-sized platform is how TMG helps SMB leaders get the efficiency they hope AI will deliver without gambling their businesses on it.
How One Firm Tamed Its Shadow AI
One anonymized engagement with an SMB shows TMG’s approach at work. A mid-sized professional services firm came to TMG after a partner noticed, almost by accident, that different teams were using at least half a dozen AI writing, research, and coding tools, none of which had ever been reviewed by IT or by the firm’s outside counsel. When TMG mapped the firm’s AI usage, it found that client documents had been uploaded to at least two tools under default settings that permitted the vendor to use that data for model training.
TMG did not start by shutting anything down, because that would have just pushed the same behavior further out of sight. Instead, it ran its ACE intake process across every department, identifying every tool in active use. Next, TMG classified each one using its four-tier risk model and reviewed each vendor’s data retention and training policies against the firm’s confidentiality obligations to its clients.
Two tools were approved outright because the risk was low. Two were approved with configuration changes – turning off training on inputs, for example, and restricting which document types could be uploaded. Two were retired, with those use cases moved to vendors already under a signed data processing agreement.
The outcome was a registry of every AI tool in use, an owner and a review date attached to each one, and a clear, fast intake path for the next tool someone wants to try, so the next discovery does not happen by accident. The firm kept the productivity gains its teams had found on their own and closed the exposure that came with them. “That is the goal. Not necessarily less AI, but better-governed AI,” says Moschovitis.
Why Clients Choose TMG Over Newer Entrants
Moschovitis says that much of the market sells either a repackaged compliance checklist or software marketed as if buying it were the same thing as governing. “We think both of those miss the point, and that’s why we built TMG around a different premise from the start,” remarks Moschovitis.
TMG’s edge, Moschovitis says, rests on four things:
First, Independence
TMG is vendor-neutral by design. “We don’t sell hype, tools, or theoretical models, and we don’t make money by pointing a client toward a particular platform,” says Moschovitis. That means when TMG tells a client a tool is safe to use, or that a vendor’s data practices are a problem, the company has no stake in the answer either way.
Second, Depth Over Dashboards
Plenty of AI governance offerings are essentially a monitoring tool with a policy template attached. TMG offers a governance discipline backed by decades of hands-on experience across IT, cybersecurity, and now AI, delivered by senior people who have actually run technology organizations, not just consulted about them. TMG’s ACE framework is effective because it is built around how organizations function. It takes into account how requests get made and how people navigate around an inconvenient policy.
Third, Strategy and Tooling Come Together
TMG backs ACE with its cyberCTRL platform. Most competitors sell either the strategy or the tooling. TMG built both, under one roof, so they stay in sync.
Fourth, The Track Record
“This is not TMG’s first rodeo! We’ve been doing this for a long time, through every technology cycle that convinced organizations the old rules didn’t apply anymore,” says Moschovitis. A long track record, combined with independence and a real platform behind the advice, cannot be built quickly. “It’s the reason organizations come to us instead of a newer entrant promising to have solved AI governance in the time it took to build a product demo,” he adds.
Building AI Strategy & Integration as TMG’s Third Pillar
The clearest growth line for TMG right now is deepening AI Strategy & Integration as a fully-fledged practice alongside its consulting and advisory and managed IT and cybersecurity work. “I don’t see this as an add-on service, but as a formal third pillar, pursued with the same rigor we’ve applied to cybersecurity for 35+ years,” declares Moschovitis. Organizations should expect TMG to keep building out the underlying tooling by expanding the registry structure, adding sector-specific risk-tiering models for regulated industries like healthcare, finance, and education, and publishing practical, ready-to-use templates that let a client’s own team run parts of the ACE lifecycle without needing TMG in the room for every step.
On the platform side, cyberCTRL will take on more of the AI governance workload, so clients are not managing it in a spreadsheet beside a separate security platform.
“I also expect us to keep investing in the SMB and mid-market segments specifically, because that’s where the governance gap is widest and the available help is thinnest,” says Moschovitis. Larger enterprises can buy their way out of this problem. Small and mid-market organizations generally cannot, and that is exactly the kind of client TMG was built to serve from day one.
“None of that changes what TMG fundamentally is. We are not chasing a pivot into becoming an AI company. We’re a governance-first technology and cybersecurity firm, and AI is simply the next place that discipline needs to show up,” says Moschovitis. Whatever TMG adds next will be in service of the same idea the company started with in 1989: business to be served by technology, not held hostage by it.
Chris Moschovitis’ new book is out! Order your copy on Amazon: Cybersecurity, Privacy, & AI: The Essential Business Guide
Explore Chris Moschovitis’ articles:
AI Governance: A Practical Guide for Business Leaders
Cyber Insurance: From Risk Transfer to Risk Signal
The Busy Executive’s Guide to Reading Penetration Testing Reports and Spotting Red Flags
