How do you build an approved AI tools registry?

How do you build an approved AI tools registry?

A registry is one page listing every AI tool your company sanctions, who owns it, what data each tool may touch, and when it gets reviewed. That's it. I've built these for a 22-person media agency and a 140-person construction firm this year, and both took under a day of actual work once someone stopped drafting policy language and started listing tools.

The reason to build one now: Cyberhaven reported in January 2025 that over 73% of workplace AI usage runs through unsanctioned personal accounts, and its April 2025 analysis put 71% of AI tools used at work in the data-risk category. Your people are already pasting things into tools you have never heard of. A registry is how you stop pretending otherwise.

What goes in the registry?

Keep it to eight columns or nobody maintains it. Per tool, record: product and edition, approved use cases, prohibited use cases, data tier allowed, who owns it, how users log in, what the vendor promises about training and retention, and the review date.

The column people skip is the one that matters most: edition. "ChatGPT approved" is a useless entry because ChatGPT Business ($20/user/month billed annually, $25 if you go monthly, per OpenAI's pricing page) contractually excludes your workspace data from model training, while a personal Plus account does not. Same brand, opposite risk profile. Microsoft makes the same distinction irrelevant by design: with Microsoft 365 Copilot ($30/user/month paid yearly, on top of a qualifying M365 license), Microsoft commits that prompts and responses stay in your tenant and are not used to train their foundation models.

How do you vet a tool before approving it?

Ask three questions in writing, by email, and keep the answers: Does our data train your models in the edition we are buying? How long do you retain prompts and uploads, and can we configure that? Can we revoke a user's access from a central admin console?

SOC 2 Type II is the baseline evidence to request, and the big three (OpenAI, Microsoft, Google Workspace) all carry it for their business tiers. But a SOC 2 report describes controls over a period; it is not a promise that a product is safe for every data type. I ask for the report's scope and exceptions anyway, because vendors that answer that question quickly tend to be the ones that answer the three questions above quickly too.

Tools that fail vetting in practice: free browser extensions and random AI websites (no admin console, no retention controls, no contractual anything), and consumer accounts of anything. Meeting note-takers like Otter or Fireflies usually land in conditional approval: fine for internal meetings, banned from customer calls until you've checked recording consent and transcript retention settings. I got burned on that once, a client's vendor asked why their pricing discussion showed up in a transcript summary. Never again.

How do you gate tools by data sensitivity?

Four tiers, written in plain language on the same page as the registry. Public: anything already on your website, any tool goes. Internal: normal business docs, approved business-tier tools only. Confidential: customer data, contracts, financials, source code; only tools with contractual no-training terms and admin-controlled retention. Restricted: passwords, payment data, government IDs; no general-purpose AI tool, full stop.

The rule that makes tiers work: classification follows the information, not the person. A marketing hire can paste public copy into anything approved, and cannot paste the unreleased acquisition deck into the same tool. People grasp this faster than any policy paragraph.

How do you handle access and offboarding?

Buy seats centrally on the company card and stop reimbursing personal AI subscriptions; the reimbursement route is how shadow AI gets financed. Require company email addresses. Turn on MFA everywhere the vendor supports it. Give each tool one named admin and one backup.

Offboarding is where small companies actually leak. Disable the departed user's account, then revoke OAuth grants and API keys, because a Copilot or Gemini seat tied to Microsoft Entra ID or Google Workspace dies with the main account, but a standalone ChatGPT Business seat has to be removed in the OpenAI admin console manually. I watched a 60-person client pay for eleven months of dead ChatGPT seats because nobody owned that step. Check your seat list against payroll once a quarter; it takes twenty minutes and it is the cheapest money you will ever save.

Do you need to audit outputs too?

Yes, but proportionately. Gartner's generative AI guidance recommends monitoring outputs rather than banning tools outright. The tiered version: anything going to a customer gets a human read before it leaves. Internal drafts get spot checks. One caution from the field: if you use Microsoft 365 Copilot, it surfaces whatever SharePoint permissions already allow, so a permissions review before rollout matters more than any AI-specific setting. Copilot doesn't leak what your file permissions don't already leak.

What happens after the registry exists?

Publish it where people actually look, link it from the onboarding checklist, and review it twice a year. Software AG found in 2024 that 46% of employees would refuse to stop using AI even under a full company ban, so a ban without sanctioned alternatives just drives usage further underground. The point of a registry is giving people tools good enough that the personal-account workaround stops being worth the effort.

If you want a second pair of eyes on your first draft of one, or want help getting your team onto sanctioned tools without a productivity dip, book a call. It's usually a one-session fix.