Approved and unapproved AI tools: how to set the list

The simplest approved-tools rule is a short written list: these tools are fine for work, everything else needs a yes first. The list matters less than how you choose what goes on it.

Three ways to set the list

Most small businesses end up with the first or third. A block list is hard to keep up, because new tools appear all the time and you'll always be behind.

What to check before a tool goes on the list

You don't need a technical audit. A few plain questions will do.

Who can see what we type in? Australia's privacy regulator says to carefully review the terms and settings that apply to your organisation's use of a product. It also notes that some commercial AI products have terms or settings that let the product owner collect the data customers input, for further training and development.¹ That can mean something typed in by one person ends up helping to train a tool for others.

Is there a business version? Ask whether the maker offers a work plan, and whether its terms differ from the free one. Read both sets of terms, and write down what you found.

Does it connect to anything else? The regulator also warns that some generative AI products have features, such as search engine links, that could send what you type to a third party.¹

Do we know the supplier? The UK's cyber security centre suggests leaders ask whether security is part of the decision to use a tool, and whether they can ask suppliers the right questions about their own security.²

Do we need it at all? The OAIC's view is that AI products shouldn't be used simply because they're available.¹ If a tool doesn't save real effort, leave it off.

Free tools and personal accounts

This is where most gaps open up. A person signs up with their own email, uses the free version, and pastes in work. You never see it.

Your choices:

• Ban personal accounts for work. Clear and easy to explain. It only works if you also supply an approved option, or staff will quietly carry on.
• Allow them for non-sensitive jobs only. For example, brainstorming headline ideas with no business or customer details. This needs a clear definition of "non-sensitive", which the next page helps with.
• Provide a work account and require it. Costs money, but you control the settings. Check current prices on the maker's own page, and note the date and currency you checked.

Whichever you choose, say what staff should do if they already use a personal account. Ask them to tell you, with no blame. You can't manage what you don't know about.

Keep a simple register

The National AI Centre describes an AI register as a central place that records important details about all of the AI systems across the organisation.³ Its full version lists many fields and is written for larger or higher-risk setups. A small business can keep a short table instead: tool name, who approved it, what it may be used for, and when you last checked its terms.

Review the list on a set date. Terms change, and a tool that was fine last year may not be now. Put the approval date next to each entry so it's easy to see which ones are due.

Words for the policy

Something like: "You may use the tools on the approved list for the jobs shown beside them. If you want to use another tool, ask [name] first. Don't use a personal account for work tasks unless the list says you can."

Short, clear, with a name. That's the whole job.