AI Tool Risk Directory

Which AI tools are safe for work? Every tool below gets a tier verdict — Approved, Limited, or Prohibited — plus the facts a compliance or IT lead actually needs: does it train on your data, what does it retain, what can an admin control, will the vendor sign a BAA, and what certifications it can show.

Verdicts are our generic recommendation for a 50–500 person company that handles client or regulated data, based on publicly documented vendor terms assessed 29 July 2026. Each tool page lists the vendor documents behind every claim and links them. Click any tool for the full breakdown — including HIPAA/BAA status and healthcare, financial-services, and legal risk notes.

Sorting by the BAA column instead? See the HIPAA and BAA comparison →

How we classify tools

• Approved — corporate-grade data terms (no training on your data by default), real admin controls, and a published security posture. Safe to allow under a written policy, on the corporate plan named in the verdict.
• Limited — usable under specific conditions: the right plan tier, the right data types, consent rules, or feature restrictions. The conditions belong in your policy, in writing.
• Prohibited — data terms, jurisdiction, or the absence of any governance surface make company use unacceptable. Block it and name the approved alternative.

We never list a certification we can’t find in the vendor’s published documentation. Where something isn’t publicly documented — or where the vendor’s page would not load in a form we could read — the tool page says exactly that instead of guessing.

Already have an AI policy? See how many of these tools it actually covers: run the free policy gap check →. Not sure where your company stands overall? Take the 2-minute exposure scorer →.