Technology & Platforms ยท TEC-08
Unapproved AI tools
Use of unapproved AI tools is detected, and people using them are steered to an approved alternative or a route to get their need met.
Why it matters
When approved options are slow or missing, people use whatever is to hand, often with organisational data. Finding that use, and responding by meeting the need rather than only blocking it, reduces the risk and shows where the approved list falls short.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No one knows which unapproved AI tools are in use. |
| 2 Developing | Some unapproved use is known about, through reports or occasional checks, but responses are inconsistent or limited to blocking. |
| 3 Defined | Unapproved AI tool use is detected by defined means across the organisation, and each finding is recorded and leads to the person being steered to an approved route. |
| 4 Managed | The level of unapproved use is measured over time, repeat or high-risk use is escalated, and findings feed changes to the approved tools list. |
| 5 Optimising | Unapproved use is low because approved options meet need, and detection and response are refined from trends and new kinds of tool. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- TEC-08.1 Defined means detect use of unapproved AI tools across the organisation.
- TEC-08.2 Each finding of unapproved use is recorded.
- TEC-08.3 Each finding leads to the person being steered to an approved tool or a request route.
Assessment questions
- How do you find out which AI tools people use that are not approved?
- When you find one in use, what happens to the person and to the need behind it?
- Is unapproved use going up or down, and how do you know?
- Detection reports or records of unapproved AI tool use
- Records of responses, including tools added to the approved list as a result
How to reach Level 3
- Decide the means of detecting unapproved AI tool use, such as network or browser logs, expense claims and staff surveys, and apply them across the organisation.
- Respond to each finding by steering the person to an approved tool from TEC-01 or to the request route.
- Record each finding and the response, and pass compliance matters to GOV-08.
Common pitfalls
- Responding only by blocking, which drives use to personal devices.
- Treating findings as disciplinary matters when the need behind them is unmet.
Starter artefacts
- Detection method description
- Unapproved tool findings log
Ownership and sequence
- Accountable
- delivery lead
- Contributors
- security lead, ai governance lead, people lead
- Depends on
- TEC-01
- Roadmap step
- 4
- Lifecycle
- operate
Cross-references
| UK Data and AI Ethics Framework | Privacy 8 partial |
|---|
direct: this control at Level 3 meets the item. partial: it covers part of it.