Requester section
Keep this to one screen. Every extra field reduces the number of people who ask at all.
- Tool name and vendor
- What you want to use it for
- One or two sentences on the actual task.
- Who will use it
- e.g. Marketing team, 6 people
AI Tool Approval & Intake Form
An AI approval process that takes six weeks guarantees people stop asking. This form is deliberately short: enough to make a sound decision, fast enough that requesting approval stays easier than going around it.
What you get
- A requester section short enough that people actually complete it
- A reviewer section covering security, legal, and data protection
- A decision block with conditions and a review date
- A documented turnaround commitment
How to use this template
- 1
Commit to a turnaround and publish it. Five working days is realistic for most reviews. The commitment is the point: without it the process becomes a black hole and people default to using the tool anyway.
- 2
Decide from the data, not the tool. The questions that matter are what data goes in, whether the vendor trains on it, where it is processed, and who at the vendor can access it. The tool's feature set is largely irrelevant to the risk decision.
- 3
Approve with conditions rather than rejecting outright. 'Approved for Internal data only, no customer information' resolves most requests. Binary approve/reject pushes borderline cases into unsanctioned use.
What's inside
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
Related templates
More free templates IT teams use alongside this one.
AI Governance
Get templateAI Tool Inventory
You cannot govern AI usage you cannot see, and most AI adoption happens through free tiers and browser extensions that never touch procurement. This inventory is built to surface those, which a record of what you bought will not show.
AI Governance
Get templateAI Acceptable Use Policy
Banning AI tools does not work. It moves usage onto personal accounts where you have no visibility at all. This policy assumes people will use AI and makes the boundary explicit: which tools, which data, and how to get something new approved.
Vendor & Buying
Get templateVendor Risk Assessment Questionnaire
Sending every vendor a 200-question security questionnaire means nobody reads the answers. This one tiers vendors by what they can actually damage, and asks a proportionate set, with evidence required rather than self-attestation at the top tier.
Frequently asked questions
What should an AI tool approval process check?
+
Whether the vendor trains on your data and if that can be excluded contractually, DPA availability, processing location, SSO and deprovisioning support, the vendor's security posture, OAuth scopes requested, who at the vendor can access data, and termination handling.
How long should AI tool approval take?
+
Around five working days. The commitment matters more than the exact number: a process with no published turnaround becomes a queue people route around, which returns you to ungoverned usage.
Should AI tool requests ever be rejected outright?
+
Rarely. Approving with conditions (a data classification ceiling, SSO required, no customer data) resolves most requests and keeps usage visible. Binary rejection tends to push borderline cases into unsanctioned use.