Hook

Your approval process is running smoothly. You've approved Claude, ChatGPT Enterprise, and GitHub Copilot. But employees don't know this. Instead of using approved tools, they continue with unapproved ones: ChatGPT free tier, Gemini, unknown Chinese tools found on Reddit. The approval exists, but it's invisible. The catalog exists, but it's a spreadsheet in SharePoint that no one reads. You've solved governance on the IT side; you haven't solved adoption on the business side. A good catalog is not a compliance artifact; it's a marketing tool for approved AI. It's beautiful, discoverable, useful. It tells employees why they should use Claude instead of asking ChatGPT. It explains what Claude can and can't do. It shows examples. It makes doing the right thing easier than doing the wrong thing.

Purpose

An AI tool catalog is the visible face of your AI governance. It lists approved tools, explains approved use cases, provides guidance on data classification limits, documents training requirements, and makes it easy for employees to request and use tools in a compliant way.

A catalog is not just a list. It's:

• Discoverable: Employees can find tools they need.
• Educational: Employees understand tool capabilities, limitations, and proper use.
• Useful: Catalog provides direct access (links, SSO integration), provisioning workflows, and support resources.
• Maintained: Catalog is updated as tools change, new tools are approved, and requirements evolve.

This lesson teaches you to build a catalog that drives adoption of approved tools, reducing shadow AI through attraction rather than enforcement.

Why This Matters

Governance without adoption is theater. You can approve tools, write policies, monitor usage, but if employees don't know which tools are approved and don't find them easy to use, they'll use unapproved tools anyway.

Shadow AI persists because:

• Employees don't know approved tools exist.
• Employees don't know approved tools are allowed.
• Approved tools are hard to get access to (require email requests, slow approvals).
• Approved tools lack features employees need (so they find alternatives).
• Unapproved tools are easier to access (sign up with a personal email, immediate access).

A catalog solves this. It's marketing, support, and governance combined.

Additionally, a catalog is a compliance artifact. Auditors ask: "How do employees know which tools are approved?" Your answer: "The AI tool catalog." It's a paper trail for governance.

Core Concepts

Key insight: A Catalog Is Structured Data, Not a Spreadsheet

A catalog should be:

• Machine-readable: Structured as JSON, YAML, or a database. Queries like "show me tools approved for customer data analysis" should work automatically.
• Accessible via single portal: Not scattered across SharePoint, Slack, wiki pages. Single source of truth.
• Integrated with provisioning systems: Clicking "request access" in the catalog should trigger provisioning, not an email to IT.
• Version-controlled: Changes to the catalog (approval of new tools, changes to data classification limits) are tracked and auditable.

Example structure:

{
"catalog": {
"version": "2024-01-15",
"last_updated": "2024-03-20",
"tools": [
{
"id": "claude_enterprise",
"name": "Claude Enterprise",
"vendor": "Anthropic",
"url": "https://claude.ai",
"tier": "Approved",
"category": "General AI / Writing",
"approval_date": "2024-01-15",
"renewal_date": "2025-01-15",
"description": "Large language model for writing, analysis, coding, and research.",
"capabilities": ["Text generation", "Code review", "Analysis", "Summarization"],
"approved_use_cases": [
{
"use_case": "Content writing",
"description": "Blog posts, marketing copy, emails",
"data_classification_limit": "Internal",
"sample": "Generate a blog post outline for 'AI in IT Operations'"
},
{
"use_case": "Code review",
"description": "Review code for bugs, style, security",
"data_classification_limit": "Internal source code",
"sample": "Review this Python function for memory leaks"
}
],
"restricted_use_cases": [
{
"use_case": "Customer data analysis",
"reason": "Risk of uploading customer PII"
},
{
"use_case": "Financial data processing",
"reason": "Requires audit trail and compliance controls"
}
],
"data_classification_limits": {
"public": "Allowed",
"internal": "Allowed",
"confidential": "Allowed with caution (no trade secrets)",
"restricted": "Not allowed (no PII, health records, financial account info)"
},
"cost": "$30/month per user",
"procurement": "Annual contract with Anthropic",
"sso_enabled": true,
"sso_provider": "Okta",
"provisioning": {
"method": "Self-service via catalog",
"turnaround_time": "Within 24 hours",
"approval_required": false,
"instructions": "Click 'Request Access' below. You'll be added to the Claude organization automatically."
},
"training": {
"required": true,
"duration": "30 minutes",
"link": "https://training.company.com/claude-enterprise",
"certification": true
},
"support": {
"primary": "IT Help Desk",
"contact": "[email protected]",
"hours": "Monday-Friday 8 AM - 6 PM",
"response_time": "4 hours"
},
"user_groups": ["Marketing", "Engineering", "Product", "Sales"],
"restrictions": {
"geographic": "Available worldwide",
"device": "Web and desktop app (not mobile)",
"concurrent_sessions": "Up to 5 simultaneous logins per account"
},
"security": {
"soc2_certified": true,
"gdpr_compliant": true,
"hipaa_compliant": false,
"data_retention": "Customer data not retained; not used for model training",
"audit_logging": true
},
"compliance_notes": "Approved for non-HIPAA use. For healthcare, use alternative tool with BAA.",
"faq": [
{
"question": "Can I use Claude for customer data?",
"answer": "No. Claude free tier uses data for model training. Enterprise tier doesn't, but risk is still high. Avoid uploading PII."
},
{
"question": "Is Claude better than ChatGPT?",
"answer": "Different tools for different needs. Claude excels at analysis and writing. ChatGPT excels at conversation. Try both and see what works for your use case."
}
],
"comparison_to_alternatives": [
{
"tool": "ChatGPT Enterprise",
"comparison": "Similar capabilities. Claude is slightly better at analysis. ChatGPT has more integrations (Slack, Outlook)."
},
{
"tool": "Gemini",
"comparison": "Similar. Gemini is better integrated with Google Workspace. Claude is slightly better at long documents."
}
],
"request_access_button": "Click here to request access"
},
{
"id": "github_copilot",
"name": "GitHub Copilot",
"vendor": "GitHub (Microsoft)",
"tier": "Approved",
"category": "Development / Code Generation",
"approval_date": "2023-06-01",
"description": "AI coding assistant. Generates code based on comments and context.",
"approved_use_cases": [
{
"use_case": "Code generation",
"description": "Generate code snippets, functions, classes",
"data_classification_limit": "Internal source code",
"sample": "Generate a Python function to validate email addresses"
}
],
"restricted_use_cases": [
{
"use_case": "Non-code documents",
"reason": "Tool is specialized for code; not designed for prose"
}
],
"user_groups": ["Engineering"],
"provisioning": {
"method": "Request via IT, GitHub account required",
"turnaround_time": "2-3 business days",
"instructions": "Email [email protected] with your GitHub username."
},
"training": {
"required": true,
"link": "https://github.com/copilot-docs",
"certification": false
},
"comparison_to_alternatives": [
{
"tool": "Claude (via IDE integration)",
"comparison": "GitHub Copilot is more tightly integrated with IDEs and has stronger VS Code support."
}
]
}
]
}
}

Key insight: Catalog Should Drive Adoption, Not Just Compliance

An effective catalog is discoverable and attractive.

Poor catalog design (compliance-focused):

• Dense technical language.
• Focuses on restrictions ("don't use for X").
• Hard to navigate (30 tools buried in a spreadsheet).
• No examples or use cases.
• Result: Employees ignore it and use unapproved tools.

Good catalog design (adoption-focused):

• Clear, simple language ("Claude is great for writing").
• Highlights benefits ("3x faster than manual writing").
• Easy to navigate (categorized tools, search, filters).
• Rich examples and samples.
• Direct access (one-click provisioning, SSO integration).
• Result: Employees prefer approved tools because they're easier.

Key insight: Categorization Helps Employees Find What They Need

Organize tools by category and use case:

By category:

• General AI / Large Language Models (Claude, ChatGPT, Gemini)
• Development / Code Assistance (GitHub Copilot, Tabnine)
• Data Analysis / Business Intelligence (DataRobot, Tableau)
• Image Generation (DALL-E, Midjourney)
• Specialized (Medical AI, Legal AI)

By department/function:

• Marketing: Copywriting, brainstorming, image generation
• Engineering: Code generation, code review, documentation
• Customer Support: Chatbots, response suggestions
• Sales: Proposal generation, customer research
• Finance: Analysis, reporting, forecasting

By use case:

• "I need to write better copy" → Category: Writing
• "I need code examples" → Category: Development
• "I need to analyze data" → Category: Data Analysis
• "I need to review PDFs" → Category: Document Analysis

Good categorization lets employees find tools quickly. Search should work: "Show me tools for writing" returns Claude, ChatGPT Enterprise, Gemini.

Key insight: Data Classification Limits Are Non-Negotiable

For each tool, specify what data can be uploaded.

Example data classification limits:

Claude Enterprise:
├─ Public data: YES (news articles, public websites, published data)
├─ Internal data: YES (org charts, internal memos, meeting notes)
├─ Confidential data: YES, with caution (avoid trade secrets, strategic plans)
├─ Restricted data: NO (customer PII, health records, financial account info)

ChatGPT Free:
├─ Public data: YES
├─ Internal data: NO (data may be used for model training)
├─ Confidential data: NO
├─ Restricted data: NO

GitHub Copilot (for source code):
├─ Public code: YES
├─ Internal code: YES (company source code, internal tools)
├─ Confidential code: CAUTION (proprietary algorithms; be careful not to upload)
├─ Restricted code: NO (code handling PII, financial data, health data)

These limits are absolute. They prevent data leakage.

Key insight: Training and Certification Ensure Safe Use

Approving a tool means nothing if employees don't know how to use it safely.

Training requirements:

• Duration: 15-60 minutes depending on tool complexity.
• Content: Capabilities, limitations, data risks, approved use cases, restricted use cases.
• Format: Video, interactive course, documentation.
• Certification: Employees acknowledge they understand the tool and will use it safely.
• Renewal: Annual refresher or when tool changes significantly.

Example training module (30 minutes):

Module 1: Introduction (5 min)
├─ What is Claude?
├─ What is Claude Enterprise vs. free tier?
└─ Why is Claude approved?

Module 2: Capabilities & Limitations (10 min)
├─ What Claude can do (writing, analysis, coding, research)
├─ What Claude cannot do (internet search, real-time data, image generation)
├─ Accuracy considerations (Claude is not 100% accurate; always verify)
└─ Hallucinations (Claude sometimes makes up information; check facts)

Module 3: Data Safety (10 min)
├─ What data is safe to upload (public, internal, some confidential)
├─ What data is NOT safe (customer PII, financial accounts, health records)
├─ How to handle sensitive data (redact, anonymize, use alternative)
├─ Incident reporting (if you accidentally upload sensitive data)

Module 4: Approved Use Cases (5 min)
├─ Writing: blog posts, emails, marketing copy
├─ Analysis: summarize documents, analyze arguments
├─ Coding: review code, generate snippets, explain concepts
└─ Examples for each use case

Final Quiz (5 questions, must pass)
├─ Question: "Can you upload customer data to Claude Enterprise?"
│ └─ Answer: "No. Even Claude Enterprise should not store customer PII."
├─ Question: "Claude sometimes makes mistakes. What should you do?"
│ └─ Answer: "Always verify Claude's output. Don't trust it blindly."
└─ Certification on pass: "You are certified to use Claude Enterprise safely."

Key insight: Maintenance and Renewal Keep the Catalog Current

Tools change. New features are added. Security incidents happen. Pricing changes. The catalog must stay current.

Maintenance tasks:

• Monthly: Review tool updates, security advisories. Update catalog if major changes.
• Quarterly: Re-evaluate approval status. Is the tool still the best choice? Has a better alternative emerged?
• Annually: Security re-assessment (pen testing results, SOC 2 audit). Contract renewal. Pricing review.
• As-needed: Update training if tool significantly changes. Update use cases based on employee feedback.

Renewal dates are important: "ChatGPT Enterprise approved until 2025-01-15. After that, re-assessment is required."

Practical Use Cases

Before/After: Catalog Drives Adoption

Before (No Catalog or Poor Catalog):

• IT approves Claude, ChatGPT Enterprise, and Copilot.
• But approval is announced via email: "We've approved 3 new AI tools. Email [email protected] for access."
• Employees don't see email or don't pay attention.
• 2 weeks later: Discovery shows employees are still using ChatGPT free tier (60% of AI use), not ChatGPT Enterprise (5%), not Claude (10%).
• Why? Employees don't know approved tools exist. ChatGPT free tier is familiar and easy. Approved tools require email + manual approval.
• IT increases monitoring and enforcement (block ChatGPT free tier).
• Employees are frustrated ("Why are you blocking the tool we use?"). Shadow AI adoption increases (VPN, personal devices).

After (Catalog Marketing + Easy Provisioning):

• IT creates an AI tool catalog website.
• Home page: "Your approved AI tools" with 3 large cards:
• Claude Enterprise: "Best for writing and analysis. 3x faster. Costs $0 (company pays). Get access in 1 click."
• ChatGPT Enterprise: "Best for conversation and quick questions. Integrated with Microsoft 365. Get access in 1 click."
• GitHub Copilot: "Best for coding. 50% faster coding (per GitHub study). For engineers. Request access."
• Catalog includes examples: "Claude can summarize a 50-page document in 2 minutes. ChatGPT is faster at quick Q&A. Copilot can generate a boilerplate function."
• Employees see the catalog. Clicked "Get access" button is one click → immediate provisioning.
• 2 weeks later: Discovery shows Claude, ChatGPT Enterprise usage is up 8x. ChatGPT free tier is down 60%. Approval succeeded.

Before/After: Training Prevents Misuse

Before (No Training):

• Tool is approved and provisioned.
• Employee is excited to use it. Copies customer email (including names, emails, problems) into Claude for brainstorming responses.
• Claude processes the data. (Claude doesn't retain it, but data left the company perimeter.)
• Employee submits response. But because Claude output wasn't verified, response contains inaccuracies.
• Customer is confused. Support ticket escalates.
• Compliance audit finds that customer PII was uploaded to Claude (employee admits it). Finding: "Inadequate data governance training."

After (Training Required):

• Same employee is required to take 30-min training before accessing Claude.
• Training covers: "Claude can help draft responses, but don't upload customer PII (names, emails, account info). Redact or summarize: 'Customer reported issue with login,' without the email."
• Employee learns the pattern: "Use Claude for brainstorming approaches, not for processing raw customer data."
• Employee uses Claude safely. No compliance finding.

Examples

Example 1: Catalog User Experience

Scenario: Marketing manager discovers the catalog.

Step 1: Manager visits AI catalog homepage
├─ URL: https://ai-tools.company.com
├─ Homepage shows:
├─ Hero section: "Find the right AI tool for your work"
├─ Search bar: "Search tools" (accepts tool name or use case)
├─ Top tools (featured): Claude, ChatGPT Enterprise, GitHub Copilot
├─ Categories: Writing, Development, Data Analysis, Image Generation, Specialized
└─ News: "Updated March 20: Gemini is now approved. Perplexity fast-track review complete."

Step 2: Manager searches "I need to write better blog posts"
├─ Catalog returns: Claude, ChatGPT Enterprise, Gemini
├─ Each shows:
├─ Tool name, logo, vendor
├─ Approval status (Approved, experimental, pending)
├─ Use case relevance ("Writing is an approved use case")
├─ Rating/popularity (number of users, reviews)
├─ One-sentence benefit ("Claude is best for long-form writing")
└─ "Learn more" and "Request access" buttons

Step 3: Manager clicks "Learn more" for Claude
├─ Tool detail page shows:
├─ Description: "Large language model trained on diverse data. Excellent at analysis, writing, and coding."
├─ What it can do: [list of capabilities]
├─ What it can't do: [list of limitations]
├─ Approved use cases: "Blog post writing, email drafting, outline creation, editing, brainstorming"
├─ Sample: "Prompt: 'Write a 500-word blog post on AI in IT Operations.' Claude output: [sample blog post]"
├─ Pricing: "$30/month per user. Company pays; no cost to you."
├─ Data safety: "Safe to upload internal company documents. NOT safe to upload customer names, emails, account info."
├─ Training required: "30-minute course on prompt engineering and data safety. ~12 people have taken it."
├─ Support: "Questions? Email [email protected] or chat with #ai-tools in Slack."
├─ FAQ:
├─ Q: "Can I use Claude for customer emails?" A: "No. Don't upload customer data."
├─ Q: "Is Claude better than ChatGPT?" A: "Different strengths. Try both."
└─ Q: "Can I use Claude offline?" A: "No, it requires internet connection."
├─ Comparison: "Claude vs. ChatGPT vs. Gemini (table showing strengths of each)"
├─ Reviews: "5/5 stars. 'Game changer for content writing.' - Sarah, Marketing"
├─ Request access button: "Request Claude Enterprise Access"

Step 4: Manager clicks "Request Claude Enterprise Access"
├─ Modal popup shows:
├─ Training required: "Before you get access, complete the 30-minute Claude safety training."
├─ Link: "Take training now" or "I've already taken it"
├─ Checkbox: "I acknowledge that I will not upload customer data or trade secrets"
├─ Button: "Request access"

Step 5: Manager takes training (if not already taken)
├─ Video 1 (5 min): What is Claude?
├─ Video 2 (10 min): Capabilities, limitations, accuracy
├─ Video 3 (10 min): Data safety (approved and restricted data)
├─ Quiz (5 min): 5 questions; must score 80%+
├─ Certification: "You are certified to use Claude Enterprise. Valid until March 2025."

Step 6: Manager gets instant access
├─ Email: "You've been added to Claude Enterprise. You can log in now using Okta."
├─ Access method: Click login button on catalog → Okta SSO → Claude dashboard
├─ First login: Onboarding modal explaining Claude basics
├─ Dashboard: Usage stats, prompt library (examples), support link

Timeline:
├─ Discover tool: 2 minutes
├─ Review tool: 5 minutes
├─ Training: 30 minutes
├─ Get access: Immediate
├─ Total: 37 minutes from discovering the catalog to using the tool
└─ Result: Manager uses approved tool within hours, not weeks.

Example 2: Catalog Search and Filter

Scenario: Employee searches "data analysis"

Results:
├─ 1. Google Sheets AI (Built-in)
│ ├─ Category: Data Analysis
│ ├─ Status: Approved
│ ├─ Approval date: Built-in; always available
│ ├─ Summary: "AI analysis directly in spreadsheets. Best for tabular data."
│ ├─ Cost: Free (included in Google Workspace)
│ ├─ Approval status: ✅ Approved
│ └─ Get access: (Already have access if you use Google Workspace)
│
├─ 2. ChatGPT Data Analysis (GPT-4 with Code Interpreter)
│ ├─ Category: Data Analysis
│ ├─ Status: Approved with conditions
│ ├─ Data classification limit: Internal data only (not customer data)
│ ├─ Summary: "Upload CSV/JSON data. Get analysis, charts, code."
│ ├─ Cost: $30/month (ChatGPT Enterprise)
│ ├─ Approval status: ⚠️ Approved (conditions apply)
│ └─ Conditions: No customer data. DLP integration prevents accidental uploads.
│
├─ 3. Claude Advanced Analysis (Claude 3 Opus)
│ ├─ Category: Data Analysis
│ ├─ Status: Approved
│ ├─ Data classification limit: Internal data (good for complex analysis)
│ ├─ Summary: "Deep analysis of data and documents. Best for detailed insights."
│ ├─ Cost: $30/month (Claude Enterprise)
│ ├─ Approval status: ✅ Approved
│ └─ Get access: Click to request
│
├─ 4. DataRobot (Machine Learning Platform)
│ ├─ Category: Data Analysis / Advanced
│ ├─ Status: Experimental
│ ├─ Summary: "AutoML platform. Build predictive models without coding."
│ ├─ Cost: $500K/year
│ ├─ Approval status: 🔄 Pilot (not yet approved for general use)
│ └─ Learn more: Pilot team is evaluating. Request to join pilot.

Filters (on left sidebar):
├─ Status: Approved / Approved with conditions / Experimental / Pending
├─ Cost: Free / <$50/month / $50-$500/month / >$500/month
├─ Data classification allowed: Public only / Internal / Confidential / Restricted
├─ Department: Marketing / Engineering / Finance / All
├─ Setup time: <1 day / 1-7 days / >1 week
└─ Sort by: Most popular / Newest / Cost / Approval date

Result: Employee can filter to "Approved + Free + Setup <1 day" and see Google Sheets AI is the best match.

Example 3: Catalog as Source of Truth for Compliance Reporting

Scenario: Auditor asks "How many AI tools does your organization use? Which are approved?"

Catalog provides instant report:

AI Tool Inventory (as of March 20, 2024):

Total tools: 8
├─ Approved: 5
├─ Approved with conditions: 2
├─ Experimental: 1
└─ Pending approval: 0

Approved tools (5):
├─ 1. Claude Enterprise (Anthropic) - Approved 2024-01-15
├─ 2. ChatGPT Enterprise (OpenAI) - Approved 2024-01-20
├─ 3. GitHub Copilot (GitHub/Microsoft) - Approved 2023-06-01
├─ 4. Google Sheets AI (Google) - Approved 2023-12-01 (built-in)
└─ 5. Gemini Enterprise (Google) - Approved 2024-03-10

Approved with conditions (2):
├─ 1. Perplexity Pro - Approved 2024-02-15 (conditions: no customer data, DLP integration)
└─ 2. Midjourney - Approved 2024-03-01 (conditions: marketing team only, no brand logos)

Experimental (1):
└─ DataRobot - Pilot in progress (projected approval Q3 2024)

All tools meet security criteria:
├─ SOC 2 Type II: 7 of 8
├─ GDPR compliant: 7 of 8
├─ HIPAA compliant: 0 of 8 (not healthcare-focused organization)
├─ Data non-retention: 7 of 8

Training and certification:
├─ All approved tools have training modules
├─ 245 employees have completed Claude training (as of 2024-03-20)
├─ 180 employees have completed ChatGPT training
├─ 520 employees have completed GitHub Copilot training
├─ Certification expiration: Annual renewal required

Shadow AI discovered (Q1 2024):
├─ ChatGPT free tier (estimated 60 users; down from 100 users Q4 2023)
├─ Claude free tier (estimated 20 users; down from 50)
├─ Perplexity free (estimated 30 users; will decrease after approval of Perplexity Pro)
├─ Other: 10 users (various unapproved tools)
├─ Total shadow AI: ~120 users (Q1 2024) down from 200 users (Q4 2023)
├─ Trend: Shadow AI adoption decreasing 20-30% per quarter as approved tools improve

Audit conclusion:
├─ Organization has strong AI governance
├─ Approved tools cover primary use cases
├─ Training is in place
├─ Shadow AI is decreasing
├─ Recommend: Continue current approach; expand pre-approved list for faster adoption

Anti-Patterns

Anti-Pattern 1: Catalog is a Compliance Artifact, Not a Marketing Tool

Catalog exists but is buried in SharePoint. No email announcement. No homepage. No discovery. Employees don't know it exists. Shadow AI continues.

Fix: Promote the catalog. Email announcement. Homepage banner. Slack integration. Make approved tools discoverable and appealing.

Anti-Pattern 2: Catalog Has Outdated Information

Tool is approved in January. Catalog is updated in January. Tool has a security incident in March. Catalog is not updated. Employees read "Claude is approved" in April and don't know there was an issue.

Fix: Maintain catalog discipline. Monthly or quarterly reviews. Update when tools change significantly.

Anti-Pattern 3: Catalog Lists Tools But Not Data Classification Limits

Catalog says "ChatGPT is approved." But for what data? Employee uploads customer email (including names and account numbers) and it's a violation. Catalog should have been clear: "Not for customer data."

Fix: For every approved use case, specify data classification limits. Example: "Writing is approved for public/internal data. Not for customer PII."

Anti-Pattern 4: Provisioning Requires Complex Manual Process

Catalog says "Request access." Requester clicks button. Gets email: "Email IT. We'll review your request and get back to you in 5 days." By day 5, employee has already used ChatGPT free tier.

Fix: Self-service provisioning via SSO. One-click access for low-risk tools. Auto-provisioning, not manual approval.

Anti-Pattern 5: Catalog Doesn't Address Employee Questions

Employees have questions: "Is Claude better than ChatGPT?" "Can I use Claude for customer data?" "What if I accidentally upload sensitive data?" Catalog doesn't answer these. Employees get frustrated.

Fix: Comprehensive FAQ. Comparison tools. Examples. Support contact.

Human Judgment Checkpoints

• 
  Is your catalog discoverable? Can employees find it without email? Can they search for "AI tools for writing" and get results?
• 
  Does your catalog make approved tools easier than unapproved tools? Provisioning time < 1 hour. One-click access. Direct links. Better than manually signing up for ChatGPT free tier.
• 
  Is training mandatory before access? If employees can get access without training, they'll use tools unsafely.
• 
  Are data classification limits clear for every tool? Every approved use case should specify: "Safe for internal data. Not safe for customer data."
• 
  Is your catalog maintained? Or is it a static artifact updated once a year? Monthly review at minimum.
• 
  Does the catalog address common questions and concerns? FAQ, comparisons, examples, support links.

Key Takeaways

• 
  A catalog is marketing for governance: Good design, clear language, easy access drive adoption of approved tools more than monitoring/blocking unapproved tools.
• 
  Structure catalog as machine-readable data: JSON, YAML, database. Not a spreadsheet. Enable search, filtering, programmatic queries.
• 
  Organize by category and use case: Employees should find the tool they need in <5 minutes. Search, filters, categories all help.
• 
  Be explicit about data classification limits: "Safe for public/internal. Not for customer data." Remove ambiguity.
• 
  Make provisioning easy: One-click access. Self-service. SSO integration. <1 hour turnaround for low-risk tools.
• 
  Training is mandatory, not optional: Employees must understand tool capabilities, limitations, and data risks before use. Certification on completion.
• 
  Use examples and comparisons: Show what tools can do. Compare tools so employees understand differences. Reduce decision paralysis.
• 
  Maintain the catalog actively: Monthly or quarterly reviews. Update when tools change. Remove outdated tools. Update training as tools evolve.
• 
  Promote the catalog: Email announcement. Homepage banner. Slack integration. Word of mouth from early users. Don't assume employees will find it.
• 
  Use catalog as audit trail: "How do employees know which tools are approved?" Answer: "The AI tool catalog." Auditors are satisfied. Governance is documented.