Building an Approved AI Tools Catalog: A Practical Guide for Mid-Market Firms

What an Approved AI Tools Catalog Is

The catalog is a short, published list of the AI services staff may use, what each one is approved for, and who may use it. It pairs with a brief acceptable use policy that explains the principles, such as never pasting client data into an unapproved tool, while the catalog provides the practical answer to “can I use this?” Together they turn AI from an unmanaged habit into a governed part of how the firm works, which is the goal of our AI-powered IT solutions.

Vetting Criteria for Every Tool

A tool earns a place on the list by clearing written criteria, applied the same way every time:

• No training on your data: contractual terms confirming prompts and outputs are not used to train the vendor’s models.
• Enterprise data protection: a business or enterprise license with administrative controls, not a personal consumer account.
• Regulatory fit: a Business Associate Agreement where healthcare data is involved, and data handling that matches the firm’s other obligations.
• Security evidence: a current SOC 2 Type II report or equivalent on file.
• Corporate sign-in: access through the firm’s identity provider, so accounts are removed when people leave.
• A named owner and use case: someone accountable for the tool, and specific approved uses rather than blanket approval.

A tool that misses a criterion stays off the list until the gap is closed.

What Usually Ends Up on the List

For firms already on Microsoft 365, Microsoft 365 Copilot is usually the anchor, because it works inside the firm’s tenant under Microsoft’s enterprise data protection terms and respects existing permissions and sensitivity labels. Enterprise versions of other assistants, such as ChatGPT Enterprise or Claude for Work, may be approved for specific workflows. Role-specific tools fill the gaps: legal research platforms, coding assistants for developers, or clinical documentation tools in healthcare. Each entry records the approved uses, the roles allowed, and any data restrictions.

Publish It Where People Look

A catalog buried in a forgotten folder fails. Put it in a SharePoint or Teams location staff already use, link it from onboarding materials, and keep a visible change log so people can see what was added or retired. A simple request process, with written criteria and a defined response time, keeps staff from quietly working around the list when they want a new tool.

Enforce It With Discovery and Controls

A list without enforcement is a suggestion. Discovery comes first: Microsoft Defender for Cloud Apps identifies the AI services already in use across the organization and scores their risk, as described in Microsoft’s Defender for Cloud Apps documentation. From there, unsanctioned services can be blocked or flagged with a warning that points users to the approved alternative, and sanctioned services can require corporate sign-in through Conditional Access. Data loss prevention adds a content layer, catching sensitive data before it is pasted into a tool that is not on the list. We covered what discovery typically turns up in our look at shadow AI in professional services.

Review It on a Schedule

AI products change quickly: new features appear, terms of service shift, and vendors add or drop data protections. A quarterly review keeps the catalog accurate. Re-run discovery, check whether approved tools still meet the criteria, vet tools staff have requested, retire anything that no longer qualifies, and publish the updated list with its change log.

How VirtuWorks Runs the Catalog

The approved AI tools catalog is delivered as part of the Compliance and AI Readiness Add-On, $59.99 per user per month on any VirtuWorks managed plan. It includes Defender for Cloud Apps discovery and blocking of unsanctioned AI services, an executive-approved acceptable use policy, a managed catalog of approved services, a defined process for evaluating new tools, audit logging of AI prompts and responses where the platform supports it, and an annual AI governance review alongside the Quarterly Executive Business Review.

Where to Start

Find out what your team uses today before writing the list, because the catalog should start from reality rather than assumptions. Schedule a Call and we will run discovery on your tenant, show you which AI services are in use, and help you build a catalog your staff will actually follow.