Employees are discovering new AI tools every week. Without a formal approval process, your company will end up with dozens of unapproved AI tools processing company data — each one a potential security, privacy, or compliance risk.
A structured approval checklist gives your IT, security, and legal teams a consistent framework for evaluating AI tools. It also gives employees a clear path to request new tools, which reduces the temptation to use unapproved alternatives.
An employee or department head submits a request for a new AI tool, including the business justification and intended use cases.
IT or the AI governance committee conducts an initial screening to determine if the tool is already covered by an existing approved tool, and whether the use case justifies the evaluation effort.
If the tool passes initial screening, it is evaluated against the checklist below.
The AI governance committee (or designated approver) reviews the evaluation and makes a decision: Approved, Approved with Conditions, or Rejected.
If approved, IT onboards the tool with appropriate access controls, monitoring, and user training.
For each section, assign a score:
| Score | Meaning |
|---|---|
| Pass | All required items checked |
| Conditional Pass | Most items checked; gaps have documented mitigations |
| Fail | Critical items unchecked with no viable mitigation |
Decision Matrix:
| Sections Passed | Decision |
|---|---|
| All sections Pass | Approved |
| 1-2 Conditional | Approved with Conditions (document conditions and review date) |
| Any section Fail | Rejected (or return to vendor for remediation) |
| Field | Details |
|---|---|
| Tool name | [NAME] |
| Vendor | [VENDOR] |
| Evaluation date | [DATE] |
| Evaluated by | [NAMES] |
| Business sponsor | [NAME] |
| Decision | Approved / Approved with Conditions / Rejected |
| Conditions (if any) | [DETAILS] |
| Next review date | [DATE — typically 12 months] |
| Approved by | [NAME AND ROLE] |
Approval is not the end of the process. After a tool is approved:
Watch for these warning signs during evaluation:
A thorough AI vendor approval typically takes 2-4 weeks, depending on vendor responsiveness and the complexity of the evaluation. Simple tools with strong enterprise credentials (SOC 2, clear DPA, enterprise SLA) can be approved faster. Complex or high-risk tools may take longer due to legal review and security testing.
Generally no. Free versions of AI tools typically use customer inputs for model training, lack enterprise security features, have no SLA or support, and provide no admin controls. Companies should approve enterprise/paid versions that offer proper data protection, audit logs, and admin management.
This is common and should be addressed urgently but constructively. First, conduct an audit to understand which tools are in use. Then fast-track the approval process for the most popular tools (enterprise versions). Finally, communicate the approved alternatives and enforce the policy with a reasonable grace period.
