A training
Makes people aware on the day of the training.
Changes little about what someone does under time pressure. A notice at the moment of work does.
AI governance software
AI governance software for the AI use that is actually happening.
AI governance software helps an organisation keep its AI use responsible and demonstrable. Most vendors come from model management, data science, GRC or security. BeeSensible covers the part that plays out in almost every organisation: the everyday use of ChatGPT, Copilot, Gemini and hundreds of other AI services by employees. Which tools are in use, what has been decided about them, do people know that decision while they work, and can you show the policy is followed.
app.beesensible.eu/shadow-ai
AI tools in use
7
Newly discovered
2
The problem
There is a policy and a preferred tool. And then there is everything else.
Most organisations have an AI policy and a tool they bought. What they lack is the view underneath: which other AI tools people use, which of those were never assessed, and whether the policy on paper matches the working day.
The inventory is out of date
A list of approved tools describes the day it was written. New AI services appear daily, often as a feature inside a tool that was already in use.
The decision never reaches the employee
A policy on the intranet does not help at the moment someone with a deadline opens a tool. The question "is this allowed?" is asked in the text field, not in the handbook.
Nobody can show it works
A regulator, auditor or works council does not ask for the policy. They ask what happened since. Without figures the answer is an assumption.
Features
What to expect from AI governance software.
The category is wide. These are the features that belong to governing everyday AI use, with an honest note on what BeeSensible does fully, partly and not at all.
| Feature | What it does | BeeSensible |
|---|---|---|
| Discover AI tools | See which AI services are opened in the organisation, including the ones nobody requested. | Yes Through the browser extension, domain only, counted anonymously, at most once a day per device. |
| See AI use | How many people use AI, how often, with which tools and for what. | Yes At organisation level, with no user id in the figures. |
| Risk information per tool | An assessment of what a tool does with input, where it processes and what is known about incidents. | Yes A catalogue of 865 tools, six weighted dimensions, score up to 100, as advice. |
| Record policy | A decision per tool: allowed, limited use, not allowed or no decision yet. | Yes Every tool starts at "no decision yet". BeeSensible never chooses for you. |
| Inform employees | Show the decision at the moment someone opens a tool, with the allowed alternative first. | Yes A notice in the browser. People can always continue. |
| Make sensitive data visible | Highlight names, national identifiers, IBANs and other sensitive data while someone types. | Yes In the apps you already work in. Text is processed in memory and discarded immediately. |
| Aggregated reporting | Figures per framework (GDPR, NIS2) that show which measure works and which is not substantiated. | Yes The accountability view, switched on per organisation. |
| Model validation and bias testing | Assess whether a model you built or bought is fair and accurate. | No A different category, for organisations that build models or deploy high-risk systems. |
| Block or enforce | Make a tool technically inaccessible or rewrite text automatically. | No Deliberately not. The employee keeps their hands on the keyboard. |
What it does not do
Clear about the limit.
A category page that promises everything cannot be trusted. This is what BeeSensible does not do, by choice.
- No model validation, no bias testing, no conformity assessment of high-risk systems.
- No blocking. Someone who opens a tool that is not allowed sees the decision and can still continue.
- No automatic decisions. A risk score is advice; a tool's status is always the organisation's choice.
- No per-employee view. Dashboards show counts, types, apps and choices, never who.
- No storage of typed text. Detection runs in memory on our own servers at European providers.
- No compliance guarantee. The figures substantiate measures; they certify nothing.
The approach
See first, then decide, then help, then substantiate.
Four steps that follow each other and then start again. Jumping from seeing straight to evidence skips the person.
1 See
Which AI is really running
Every AI tool people open comes into view, counted anonymously, with a risk assessment attached.
2 Decide
A decision per tool
Allowed, limited use with your own condition, not allowed, or deliberately no decision yet. The organisation chooses.
3 Help
The decision at the moment of work
Someone who opens a tool with a decision behind it sees that decision, alternative first. Sensitive data gets a highlight while they type.
4 Substantiate
What happened next
The share of AI use through allowed tools, how often a notice was followed, and which measure is not yet substantiated.
and again How the cycle works
Why this approach
Against what most organisations have already tried.
Training, classic DLP, blocking and waiting each have a place. None of the four answers which AI is in use and whether the policy is followed.
Classic DLP
Looks at files and network traffic, mostly after the fact.
Does not see a paste into an AI tool, or only once the text has gone.
Blocking AI
Feels safe and moves the use to personal phones.
The risk does not disappear, only the view of it.
Doing nothing
Trusting the policy and good intentions.
Works until the first question from a regulator or a customer.
Frequently asked questions
What people ask before they choose.
What is AI governance software?
Software that helps an organisation keep its AI use responsible and demonstrable: which AI systems and services are in use, what has been decided about them, how that decision reaches people and whether it is followed. Some vendors focus on models and high-risk systems; BeeSensible focuses on the everyday use of existing AI services by employees.
Is this the same as an AI register?
An AI register is one part of it. BeeSensible links a catalogue of 865 AI tools to the use observed in the organisation, so the register shows what is actually going on rather than what was once written down.
Does BeeSensible track individual employees?
No. The figures on AI use reach the servers without a user id. An administrator sees that three people use AI daily, never who. Typed text is processed in memory and discarded immediately.
Does it work with Microsoft Copilot?
Yes. Copilot is one of the apps in which sensitive data gets a highlight, and one of the tools you record a decision for. Many organisations use BeeSensible precisely to see which other AI tools are in use next to Copilot.
Does it help with the AI Act and the GDPR?
It supports them. The accountability view maps figures to measures per framework, with an honest "not substantiated" where the figures say nothing. It does not certify compliance and does not replace a DPIA or legal assessment.
Further reading
The reasoning, one question at a time.
See within a day which AI tools are running in your organisation.
Fourteen days free, every module, no credit card. Deploy the extension centrally; employees keep working as usual.
14 days free, no credit card. Rolled out across your organisation within the hour.
