As AI software and platforms have become more common and more affordable, many companies and employees are adopting these tools at a rapid pace, often without thinking about their broader impact to the organization beyond vague promises of efficiency gains and convenience.
While the impulse to implement the latest AI tool may be strong, doing so can lead to potentially serious risks. According to crisis strategist Dr. Tonisha M. Pinckney, the most obvious risks include tool sprawl, inconsistent controls, privacy and data exposure, and multiple vendors with differing security protocols. To prevent such risks, organizations need a system in place for vetting AI tools to make sure they align with business goals and values.
Practical Tips for Vetting AI Tools
To set clear, effective targets for the business, CEOs and CIOs must pinpoint which AI use cases truly drive positive financial returns, so they can set clear, effective targets for every function and leader, said Tina Nunno, distinguished vice president and Gartner fellow. But establishing an AI adoption strategy is not just a C-suite responsibility. Risk managers should be involved in the decision-making process to evaluate how AI tools can impact the business, both positively and negatively. This process should include the following key steps:
Establish your organization’s risk tolerance: Before engaging with any AI tools, it is important to determine what applications the organization considers acceptable and what is considered too risky. “When the executive team or board has reached a determination, it will be easier to convince busy employees to take the necessary steps to keep AI risks within bounds,” said Lori Meyer Nugent, co-founder and partner at cybersecurity, privacy and AI firm Fulcrum Law. “An AI acceptable use policy formalizes this process and shows that effort flows from the top down to make sure that the business’s AI use is appropriate. If you do not have an AI acceptable use policy yet, this would be a good time to put one in place.”
Define accountability: Risk managers, CEOs and CISOs are all accountable for AI to varying degrees, but accountability must be defined early in the process so the organization will not be left scrambling to react when issues arise. “The business owns how the tool is being used,” Pinckney said. “Security has responsibility for the technology, cyber, information security and related data risk. Risk provides oversight and challenge. Executive leadership is still answerable for the decisions the organization makes and the risk it accepts.” However, not every use case needs its own separate governance structure. “There should be an enterprise foundation, and then the controls and oversight increase based on the risk,” she said.
Ensure the AI tool makes sense for the business: Many businesses can make the mistake of jumping into an AI project without establishing a clear, measurable benefit to the business. According to Gallup, organizational adoption of AI grew to 46% in the second quarter of 2026, but recent Gartner research found that the most popular and hyped AI applications are not the ones with the biggest ROI. In fact, the top two use cases pursued by leaders were cybersecurity threat detection and response (54%) and IT service desk automation (54%), but the AI use cases with the most positive returns were intelligent IT asset and cost optimization (40%) and synthetic data generation (28%).
Additionally, according to MIT’s 2025 State of AI in Business report, 95% of all generative AI pilot projects had no measurable benefits to the business and only 5% generated a rapid impact on revenue. “The main cause was the inability to integrate the AI into the way the business actually works—not a technical failure of the AI,” Nugent explained. “Bottom line: Time spent up front to understand how the AI tool will fit into your business’s actual workflow pays off.”
Understand the tool’s capabilities: A big part of understanding an AI tool is knowing what input and output the tool owns and if there are other privacy concerns. It is essential to carefully read the tool’s terms of service. “Terms of Service and privacy policies are usually long and tedious, but if you approve use of the AI tool without reviewing these documents, it will be harder to defend you and the business when something goes wrong,” Nugent said.
It is also important to identify the tool’s risk level beyond simply high, medium or low risk. “AI can add quantification to human decision-making, and risk managers should use that same thinking when evaluating the technology,” she said. “What is the probability of error? What is the potential loss? How many people or transactions could be affected? A 1% error across 100 decisions is not the same as 1% across a million.”
Consider AI tools already implemented: When considering the adoption of new AI tools, it is crucial to take stock of tools already implemented and think about how new tools will interact with existing ones. One major concern is organizations reviewing each tool individually and never asking what all those tools mean together. “You can have several tools that look acceptable independently and still create cumulative or reinforcing risk across the organization," Pinckney said.
Neil Sahota, AI strategist and AI advisor to the United Nations, cited a typical scenario: “Legal approves a contract AI tool. Sales adopts an AI-enabled CRM. Finance uses an analysis agent. Individually, each product passes security, privacy and risk reviews. Then, people connect them. Each individual decision may be reasonable; however, collectively, they can create a capability nobody evaluated.”
Conduct a third-party review: Third-party reviews should be an ongoing process. According to Pinckney, it is important to know what each vendor is required to report when there is an attempted intrusion, an actual incident, a material vulnerability or a significant change to the technology. “How quickly will they notify us? What patches are available? What remediation support will they provide? What information will you get during the investigation and recovery? Those expectations need to be established before something happens,” Pinckney explained.
The level of scrutiny applied during this process should match the tool’s intended use. For example, a tool helping someone draft an email does not present the same risk as AI used for fraud, credit, identity verification, account restrictions, cybersecurity or decisions that can affect someone’s money or access to services.
Creating an AI Acceptable Use Policy
As AI tools continue to evolve, so should your organization’s acceptable use policy. Leaders should meet regularly to ensure the policy still aligns with business goals and make any necessary updates to account for new regulations, recent security incidents or overall changes in the organization’s risk appetite.
An effective AI acceptable use policy should include:
- Applicable state data privacy laws and AI regulations
- Defined business goals specific to AI use
- A list of pre-approved AI tools
- A list of prohibited AI tools that should not be used
- The process for submitting an AI tool for higher-level review
- An outline of what information is safe to put into an AI tool and what data is restricted
- A requirement for employees to disclose any AI tools they use, even if it is on the approved list
- A clear process for reporting incidents like data leaks, suspicious outputs or unapproved use
- A schedule for periodic reviews of implemented AI tools to ensure each one still passes the vetting process
An acceptable use policy should be considered a living document to guide both vetting and implementation on an ongoing basis. “AI risk does not stop changing,” Sahota said. “What an organization evaluates today will be materially different whenever the vendor changes the underlying model, employees connect new data, permissions expand, memory is enabled or AI gains the ability to use additional tools.”