Keep a register of approved AI tools

Ask five people in your company which AI tools they are allowed to use and you will get five answers. One will name the tool IT bought. One will name the tool they use at home. One will say they thought everything was fine. The other two will ask whether there is a list.

There should be. An AI tool register is a single list of the AI tools your company has looked at, with a decision for each one. It is the reference that your policy points to, the answer people get when they ask, and the evidence you show a client who wants to know which tools touch their data.

What goes in each entry

Keep it short enough that someone will maintain it. These columns cover most needs:

• Name and web address of the tool, so people can tell two similar products apart.
• Status: approved, restricted or under review.
• Owner: the person who answers questions about the tool and reviews it.
• Purpose: what the company uses it for, in a sentence.
• Allowed data: which kinds of information may go into it. Public, internal, confidential, customer data, personal data, financial data, source code, credentials.
• Review date: when someone will next check the tool's terms and your decision.
• Notes: the plan you are on, the account type, anything people should know.

Three statuses are enough

Approved means people may use the tool for the purposes and data listed. Restricted means it may be used only with the limits written in the entry, for example public information only, or only by the marketing team. Under review means someone has asked for it and a decision is pending; until then, treat it as not approved for anything beyond public information.

Some companies add a fourth status for tools that are not allowed at all. That can help, but a list of banned tools is never complete. A register that says anything not listed is not approved is simpler and harder to argue with.

The allowed data column does the real work

Most of the risk in AI use is about what goes in, not which tool is used. Saying a tool is approved without saying for what leaves people guessing. At Harbour Lane Design, an agency of 25, the register lists the company's chosen chat assistant as approved for internal and confidential information on the business plan, but not for client personal data. The image tool is approved for public information only. A translation tool is restricted to the two people who handle overseas clients.

Those three entries answer most of the questions the team used to ask in chat.

Start from what is already in use

The first version of the register should not be a wish list. Start with the tools people already use, which you can find by asking teams, looking at expense claims and checking which apps have been connected to company accounts. Once the register exists, the AI-use policy can simply point to it. If you have not written the policy yet, start with the first-policy guide.

Add each one as under review, then make decisions in order of how much data flows into them. The tool the whole sales team uses daily comes before the one somebody tried once.

Make it easy to find

A register nobody can find is no better than none. Put a link to it in the policy, in the onboarding guide and wherever people ask questions, such as the team chat or the help desk. When someone asks whether they can use a tool, answer with the link as well as the answer. Within a few weeks, people start checking the register before they ask.

Keep it current

A register goes stale in two ways: new tools appear that are not on it, and old entries stop being true because the tool's terms or features changed. Two habits handle both:

1. Give every entry a review date, usually six or twelve months out, and make the owner responsible for checking it when the date comes.
2. Make asking for a new tool easy. A short form or a message to one named person. If asking is hard, people stop asking and start using.

In Openn Shield

The AI tool register in Openn Shield has these fields: name, address, status (approved, restricted or under review), owner, purpose, allowed data classes, review date and notes. When a review date passes, the owner gets an alert. Every change is recorded in the activity trail with who made it and when, so the history of each decision stays. See the tool register.