What it is
A staff member finds a tool that would save hours. The form turns that request into a decision: what data goes in, what the provider does with it, how the tool was tested and who approved it on what conditions.
The form records the request and users, the data class and use, a provider assessment tied to the vendor questionnaire, four tests, the risk rating and decision, approved uses and data classes, conditions and the date for the next review.
When to use it
- Any request to adopt a new AI tool or a new use of an approved one.
- Annual re-approval of tools on the approved list.
- When a provider changes its terms.
What’s inside
- Request and cost details
- Data and use questions
- Provider assessment and testing tables
- Rating, decision, conditions and approved list entry
Standard cited
This template follows Firm practice. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What should be tested before approval?
Accuracy on a sample with known answers, handling of unusual input, consistency across runs and inappropriate output. The form has a row for each, with method and result.
Who approves?
The person the policy names, usually the qualified individual for security or a technology partner. The form records the name and date.
What happens after approval?
The tool goes on the approved list with its approved data classes and next review date.
Related templates
- AI Acceptable Use Policy for CPA Firms
- Vendor Due Diligence Questionnaire for CPA Firms
- AI Use Case Inventory and Risk Register (Excel)
- AI Output Review Log (Excel)
Last updated 11/05/2026. All free templates.