An AI tool approval process stops staff from signing up to random AI tools while making it easy to get good tools approved quickly. This five-step process takes days, not months, for most requests.
The process
- Request. The employee fills in a short form: tool name and link, plan, what it is for, which data it will touch, number of users and cost.
- Quick screen (1 day). The AI owner checks the tool's SafeScore and “Is it safe?” page, and whether an approved tool already does the job. Low-risk requests (public data only, no integrations) can be approved here.
- Assessment (up to 1 week). For internal, confidential or personal data: send the vendor questionnaire and complete the risk assessment. IT checks SSO and security; legal checks terms and DPA.
- Decision. The AI owner approves, approves with conditions, or rejects, and gives the reason.
- Record and roll out. Add the tool to the risk register and the approved list, set the review date, switch off training, and brief users.
Fast-track rules
| Request | Route |
|---|---|
| Public data only, free or low cost, no integrations | Quick screen only |
| Internal data, business plan | Quick screen + vendor questionnaire |
| Client confidential or personal data | Full assessment + DPA |
| Decisions about people, health data, AI agents with system access | Full assessment + leadership sign-off |
Request form fields
- Your name and team
- Tool name, website and plan
- What problem it solves (one sentence)
- Data it will use
- Integrations (email, drive, CRM)
- Number of users and monthly cost
- Is there an approved tool that could do this?