Technology & Platforms ยท TEC-01
Approved AI tools and platforms
The organisation keeps a current list of approved AI tools and platforms, each with clear conditions of use, and staff know where to find it.
Why it matters
Staff need a quick answer to which AI tools they can use and for what. An approved list with conditions turns policy into something people can act on, and gives procurement, security and data teams one place to record their decisions about each tool.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No approved list; staff choose tools themselves or wait for case-by-case answers. |
| 2 Developing | Some tools are known to be allowed, but there is no maintained list, or conditions of use are missing or unclear. |
| 3 Defined | A maintained, published list of approved AI tools and platforms states each one's permitted uses, data limits and owner, with a route to request additions. |
| 4 Managed | The list is reviewed on a set cycle, requests are handled within an agreed time, and use of approved tools is measured against the conditions. |
| 5 Optimising | The list is refined from usage, requests and supplier change, and approval of new tools is quick enough that staff rarely look elsewhere. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- TEC-01.1 A maintained list of approved AI tools and platforms exists.
- TEC-01.2 For each listed tool or platform, the list states its permitted uses, the data that may and may not be used with it, and its owner.
- TEC-01.3 The list is published to all staff.
- TEC-01.4 Staff have a route to request additions to the list.
- TEC-01.5 The list covers the environments and toolchains used to build, test and run the organisation's own AI, each with an owner and support. BLD
Assessment questions
- Where would a member of staff look to find out which AI tools they may use, and for what data?
- How does a tool get added to or removed from the list, and how long does that take?
- When was the list last reviewed?
- The approved tools list with conditions of use, owners and review date
- The request process and a log of recent requests and decisions
- Approved build, test and run environments with owners
How to reach Level 3
- List the AI tools and platforms already approved or in use, and confirm which are allowed.
- For each approved item, record permitted uses, data that may and may not be used with it, and an owner.
- Publish the list to all staff with a route to request additions.
- Where the organisation builds its own AI, add the environments and toolchains used to build, test and run it, each with an owner and support.
Common pitfalls
- Publishing a list without data rules, so staff know what tool to use but not what to put in it.
- Letting requests for additions sit unanswered, which pushes people to unapproved tools (TEC-08).
Starter artefacts
- Approved AI tools list
- Tool addition request form
Ownership and sequence
- Accountable
- delivery lead
- Contributors
- security lead, data owner, ai governance lead
- Depends on
- GOV-01
- Roadmap step
- 3
- Lifecycle
- acquire_build, deploy, operate, retire
Cross-references
| AI Cyber Security Code of Practice | 4.5 direct; 6.3 partial; 10.1 partial; 10.2 partial |
|---|---|
| ISO/IEC 42001 | A.4.4 partial |
| JSP 936 Part 1 | para 48 partial; para 155 partial; para 178 partial |
| MITRE AI Maturity Model | P4.3 direct |
| NIST AI RMF 1.0 | MAP 3.3 partial |
| UK Data and AI Ethics Framework | Accountability 9 partial |
| UNESCO AI Maturity Framework | 3.1 direct; 3.4 direct |
direct: this control at Level 3 meets the item. partial: it covers part of it.