What It Delivers
Shadow AI Inventory
Endpoint and proxy data used to enumerate AI tools actually in use — not what the acceptable-use policy permits, but what employees are running. Consumer AI assistants, code completion tools, browser extensions, and embedded SaaS AI features all leave traces. You cannot govern a tool you do not know exists.
Azure OpenAI on Private Endpoints
Azure OpenAI deployed within your tenant boundary with private endpoint networking — inference traffic stays inside your Azure virtual network, never traverses the public internet. Your data residency requirements are met structurally, not by contractual assurance alone.
Conditional Access for AI Tools
CA policies that restrict sanctioned AI tool access to compliant, managed devices and approved users. Consumer AI tool access from corporate devices blocked or scoped via proxy policy. The boundary between sanctioned and unsanctioned AI becomes enforceable.
First RAG Pipeline or Fine-Tuned Model
A working retrieval-augmented generation pipeline — or a fine-tuned model — built on your proprietary data. A general cloud model improves at everyone's tasks. A model trained on your data improves at your tasks alone. That gap compounds and is not recoverable by a vendor.
AI Governance Policy
A documented, practical AI governance policy covering sanctioned tools, acceptable data classifications for AI input, human-review requirements for AI-assisted decisions, and a vendor assessment process for new AI procurement. Designed to be enforced, not filed.
The Economic Case
At meaningful usage scale, cloud AI inference is priced to grow with usage. Fixed-cost sovereign infrastructure — local models, private Azure endpoints, or auditable sovereign cloud — produces predictable economics. Organisations spending €5,000–€15,000 monthly on cloud AI APIs typically reach break-even within 12–18 months. Module 5 creates the infrastructure that makes that transition feasible.
Scope and Prerequisites
| Duration | 30–60 days |
| Environment | Azure subscription; M365 E3+ for CA integration |
| Prerequisites | Module 2 (Identity) for CA enforcement; Module 1 (Endpoint Management) for shadow AI discovery from device telemetry |
| Natural follow-on | AURORA for cross-tool AI operations once PULSAR and ASTRAL are deployed |
Your intelligence should stay yours
Proprietary data run through a cloud model trains that model — not yours. Module 5 builds the alternative.