AI tools with moderate exposure

Risk depends on what goes in. Requires an explicit classification in your policy.

Approval conditional on classification. The risk is not in the tool itself, but in the data that goes into it. Classify it as allowed, restricted or prohibited in your policy, communicate that to employees and keep the record. That is the evidence the NIST AI RMF and ISO 42001 ask for.