AI Tool Risk Directory

Which AI tools are safe for work? Every tool below gets a tier verdict — Approved, Limited, or Prohibited — plus the facts a compliance or IT lead actually needs: does it train on your data, what does it retain, what can an admin control, and what certifications it can show.

Verdicts are our generic recommendation for a 50–500 person company that handles client or regulated data, based on publicly documented vendor terms as of July 2026. Click any tool for the full breakdown — including HIPAA/BAA status and healthcare, financial-services, and legal risk notes.

How we classify tools

• Approved — corporate-grade data terms (no training on your data by default), real admin controls, and a published security posture. Safe to allow under a written policy, on the corporate plan named in the verdict.
• Limited — usable under specific conditions: the right plan tier, the right data types, consent rules, or feature restrictions. The conditions belong in your policy, in writing.
• Prohibited — data terms, jurisdiction, or the absence of any governance surface make company use unacceptable. Block it and name the approved alternative.

We never list a certification we can’t find in the vendor’s published documentation — where something isn’t publicly documented, the tool page says exactly that.

Already have an AI policy? See how many of these tools it actually covers: run the free policy gap check →. Not sure where your company stands overall? Take the 2-minute exposure scorer →.