AI Tool Selection and Evaluation Guide

How to use this document

• What it is for. This is a base guide to compare and decide on AI tools, services, APIs and platforms before contracting, enabling or expanding them. It provides criteria, a scoring scale, knock-out criteria, hands-on tests and decision rules.
• Who should own it. The AI lead, with IT and procurement as supporting functions. Information security, the data protection officer (or the country's equivalent role), legal and the system owner take part in each evaluation. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Decide the weight of each criterion (Section 7.2, suggested value) and the approval thresholds (Section 7.4). The depth of the evaluation is not decided here: it follows from the risk level set by the "AI Risk Classification Matrix" (Section 5), and who approves follows the lanes in the "AI Governance Operating Model" (Section 10.3).
• Fields to complete. Replace the bracketed fields. Adapt the matrix in Section 6 and the questionnaire in Section 9 to your industry. Keep [OPTIONAL] clauses only if they apply.
• Country variants. This guide has no country variants. If the tool will process personal data or be used in several countries, complete the privacy and data transfer criteria using the laws listed in "Related regulatory references."
• Review. Have legal or an outside advisor review the knock-out criteria and the questions on data, intellectual property and transfers, and have security validate the minimum technical requirements.
• Approval and publication. Have it approved by the AI lead (at the standard or reinforced level, [AI COMMITTEE]), record the approval in "Version history," and publish it where procurement, IT and the teams that request tools can find it.

AI Tool Selection and Evaluation Guide

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Guide owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Request channel	[AI GOVERNANCE EMAIL]

1. Purpose and scope

1.1 This guide sets out how [ORGANIZATION NAME] evaluates and compares tools with AI components in order to choose the one that best meets a need with risk within the risk appetite (see "AI Risk Appetite Statement"), and to keep a record of why it was approved, made conditional or rejected.

1.2 It applies before:

a) contracting or licensing an AI tool, platform or API, including free and trial versions;
b) enabling an AI feature inside a product already under contract (for example, an assistant built into email, the CRM or the office suite);
c) installing browser extensions or plug-ins with AI;
d) expanding the use of an approved tool to new data, new users or a new purpose;
e) renewing a contract when the vendor has changed the model, its data use terms or where processing takes place.

1.3 It does not replace the impact assessment, the data protection impact assessment or vendor due diligence where these apply; it feeds them and is coordinated with them. This guide compares candidates; the full vendor questionnaire is in the "AI Vendor Due Diligence Checklist" and the selected vendor is recorded in the "AI Vendor and Audit Register."

2. Definitions

• AI tool: software, cloud service, API or built-in feature that uses AI models to generate content, classify, predict, recommend or act.
• Requesting unit: the business unit that needs the tool; it appoints the system owner.
• Evaluation: the documented process in this guide, from the request to the decision.
• Knock-out criterion: a requirement that, if not met, prevents approval of the tool regardless of its total score.
• Shortlist: candidate tools that pass the initial screening and are evaluated in detail.