Use whenEvaluating any AI vendor, implementation partner, or internal tool — including every tool surfaced by the shadow-AI inventory — before it is approved or funded.
OutputA working evaluation rubric and a registry placement: approved, experimental, or prohibited.
A
Evaluation context
Vendor / tool
Evaluated by
Date
Workflow it serves A workflow the organization has actually prioritized.
1
Ten evaluation criteria
Criterion
Rating (1–5)
Evidence & notes
Follow-up needed
1 · Business & workflow fit
Does it address a workflow the organization has actually prioritized?
Does it address a workflow the organization has actually prioritized?
2 · Security & privacy
Architecture, certifications, breach history, data handling.
Architecture, certifications, breach history, data handling.
3 · Data retention & model-training terms
Does the vendor retain inputs? Train on them? Can that be turned off contractually?
Does the vendor retain inputs? Train on them? Can that be turned off contractually?
4 · Identity, access & administration
SSO, role-based access, admin visibility.
SSO, role-based access, admin visibility.
5 · Integration requirements
What it must connect to, and what that costs.
What it must connect to, and what that costs.
6 · Accuracy & human-review requirements
Error rates for this task, and the review burden they create.
Error rates for this task, and the review burden they create.
7 · Accessibility & employee usability
Can people across roles and abilities actually use it?
Can people across roles and abilities actually use it?
8 · Training & support
What the vendor provides versus what the organization must build.
What the vendor provides versus what the organization must build.
9 · Total cost & expected value
Licenses plus integration, training, oversight, and administration.
Licenses plus integration, training, oversight, and administration.
10 · Vendor stability & exit options
What happens to your data and workflows if the vendor folds or the contract ends?
What happens to your data and workflows if the vendor folds or the contract ends?
Add any criteria your regulatory context requires before adopting the rubric.
2
Registry placement
The council decides; specialists assess.Detailed technical, security, legal, and workflow evaluations are delegated — the placement decision stays with the council.
Delegated to: IT / security Systems, identity, data protection, technical evaluation.
Delegated to: legal / privacy / compliance Contracts, regulated data, risk classification.
Delegated to: workflow owner Useful, usable, and realistic for the actual work.
You should now have