Approve workplace AI by tool and use case—not by brand name alone. A service used to draft public-facing copy may need different controls from the same service connected to company files or used to assess employees. A practical process is to record the request, classify its risks, review the provider, set access conditions, test the actual workflow, document the decision, and monitor for change.
The NIST AI Risk Management Framework (AI RMF) offers a voluntary way to organize this work; it is guidance, not a universal legal checklist. Requirements depend on your jurisdiction, industry, workforce, and use case. The federal example discussed below applies to federal agencies, not all employers.
As an Amazon Associate I earn from qualifying purchases.
How do I approve AI tools for work?
Use a repeatable, risk-based process that approves a defined combination of service, configuration, users, purpose, and data. NIST’s AI RMF describes managing risk across an AI system’s lifecycle and adapting that work to the organization’s context. Its functions—Govern, Map, Measure, and Manage—can help structure an employer’s process, but they are not mandatory steps prescribed by law. See the NIST AI Risk Management Framework.
- Record the request. Identify the tool and version or configuration, business owner, proposed users, purpose, connected systems, expected outputs, information entered or retrieved, and what could happen if an output is wrong or disclosed. Note whether it is a third-party service, an embedded feature, or a locally operated model. Different forms of generative AI—including foundation models, fine-tuned models, and embedded tools—can call for different controls. NIST discusses organization-wide implications of third-party generative AI in its Generative AI Profile.
- Map the people, data, and potential impact. List information the workflow might expose, including personal, confidential, regulated, customer, employee, or source-code data. Identify who may be affected and whether the use is reversible and low impact or could affect rights, safety, employment, finances, or significant business decisions.
- Review the provider and service. Examine how data is collected, used, retained, and deleted; whether prompts or outputs can be used for model training; access controls; incident handling; service terms; security documentation; subprocessors; and integrations. Choose due diligence in proportion to risk. NIST names procurement review, service-level agreements, software bills of materials, and attestation reports as possible risk-management measures—not universal prerequisites.
- Set approval and access conditions. Name the business owner and involve the functions appropriate to the use, such as security, privacy, legal, procurement, compliance, or IT. Specify the approved service and configuration, authorized users, purpose, permitted data, duration or review condition, and safeguards. NIST’s AI RMF Playbook recommends documenting authorization, duration, type, and access controls for sensitive training or production data.
- Test the actual workflow. Try representative tasks with the intended users and data constraints. Assess capability, limitations, reliability, privacy and security behavior, and the consequences of mistakes. Record what was tested and what the results do—and do not—establish. NIST warns that generative AI pre-deployment testing can be inadequate, nonsystematic, or mismatched to real deployment conditions; benchmark results alone may not show that a tool is reliable for your use.
- Record the decision and tell employees what it means. Document approval, conditional approval, or rejection; the rationale and residual risks; the owner; authorized settings and users; any required training; and events that trigger review. Publish practical employee guidance covering the approved tool, permitted information, prohibited uses, output verification, and how to report a problem. NIST identifies acceptable-use policies and guidance as ways to reduce misuse and misalignment between a system and its users.
- Monitor and revisit. Review incidents, access logs where appropriate, user feedback, provider or model changes, new business uses, and whether safeguards still work. Reassess when a material change alters the risk. NIST’s AI RMF calls for ongoing risk management, while its Risk Management Framework (RMF) includes control selection, assessment, authorization, and continuous monitoring. See the NIST RMF overview.
What AI tools can employees use at work?
Employees should use tools and configurations that the organization has approved for their specific tasks and information—not assume that a familiar consumer service is approved for company work. An employer can maintain a clear approved-tools list, but each entry should say what it is approved to do, who may use it, and what data may be submitted. A feature embedded in software the company already uses still deserves review if it introduces new data flows, permissions, or outputs.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Approval levels can be scaled to the use case. The following is a practical implementation of NIST’s risk-based approach, not a tier system prescribed by NIST:
| Approval path | Possible fit | Controls to consider |
|---|---|---|
| Lightweight | Low-risk, reversible drafting or experimentation using public information | Approved service and user group; clear acceptable-use rules; basic output checking |
| Enhanced review | Work involving confidential or personal information, external actions, or consequential decisions affecting people | Specialist review; tighter permissions; deployment-context testing; documented safeguards and more frequent monitoring |
To choose a path, consider the sensitivity of the data, the consequences of an incorrect, biased, or exposed output, whether a person reviews the output before it acts, what the provider discloses about retention and security, whether use can be restricted and audited, the strength of testing evidence in the actual context, and how easily a decision can be reversed.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do we stop employees from putting sensitive data into AI?
Combine clear rules with controls that make the approved path easy to follow. A policy alone may not prevent accidental disclosure, especially when staff cannot tell which service or setting is safe for a particular type of information.
- Define data boundaries. State which categories may be entered into each approved tool and which are prohibited. Address prompts, uploaded files, connected repositories, and generated outputs.
- Restrict access and permissions. Limit users, integrations, and access to company data to what the approved task requires. Document who is authorized, for what purpose and duration, and under what data-access conditions.
- Check provider terms and settings. Confirm retention and deletion practices, model-training terms, and available access controls before approving sensitive-data use. Do not infer protections from a product label or general marketing language.
- Train staff with concrete examples. Explain which tool to use, what not to submit, how to verify generated content, and where to ask questions or report a suspected disclosure.
- Monitor proportionately. Where appropriate and lawful, review access records, incidents, feedback, and changes to integrations or vendor practices. Use findings to adjust permissions and guidance.
NIST’s Playbook gives a specific suggested action: “Establish and document protocols (authorization, duration, type) and access controls for training sets or production data containing personally sensitive information, in accordance with privacy and data governance policies.” This is guidance for managing risk, not a substitute for the employer’s applicable privacy and data-protection obligations.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Who should approve workplace AI tools?
Assign one accountable business owner for the proposed use, then bring in reviewers according to the data and consequences involved. A low-risk drafting tool may need a lighter path than a system connected to sensitive records or used in consequential decisions. Depending on the case, relevant reviewers may include security, privacy, legal, procurement, compliance, and IT. The organization should name who can grant approval and who owns follow-up after deployment; NIST does not prescribe one universal approval chart for employers.
The approval record should make the boundaries usable: the specific service and configuration, authorized people, permitted purposes and data, duration or review condition, safeguards, residual risks, and the person responsible. If users, data access, integrations, model behavior, or intended purpose materially change, assess whether the original decision still applies.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Does federal AI guidance apply to every employer?
No. Executive Order 14110 gives a risk-based access example for federal agencies; it is not a general private-employer mandate. It directs agencies to limit access to particular generative AI services as needed based on risk assessments, set appropriate-use guidelines, and provide safeguarded access to secure and reliable capabilities at least for low-risk experimentation and routine tasks. The order’s scope is federal agencies, so employers outside that scope should not treat its agency-specific directions as law governing them.
NIST published AI RMF 1.0 in 2023 and its Generative AI Profile (AI 600-1) in 2024. NIST describes the AI RMF as voluntary and says version 1.0 is being revised. The profile’s suggested actions are not law and do not guarantee that a system is safe. Use them as adaptable risk-management guidance, alongside the requirements that actually apply to your organization.
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
