Excel or a SharePoint list
A row per tool, maintained by whoever has time.
Describes the day the list was made. Every new tool needs someone to notice it, look it up and enter it.
AI register
An AI register with the AI tools your organisation actually uses.
An AI register is an overview of the AI tools an organisation uses: for each tool, the vendor, where it processes data, how risky it is, what the organisation decided and which conditions and documents go with it. In Excel, such an AI register shows what the organisation knows about. What is actually used is a different list, and usually a longer one. BeeSensible links a catalogue of over 1,000 assessed AI tools to what it sees people using in the browser. Every tool in use appears in the Inbox automatically, with the facts attached. Whatever you allow is registered straight away. So no tool in use is missing from the AI register, and nobody has to put the list together by hand.
Prefer to try it yourself? 14 days free, no credit card.
app.beesensible.eu/register
The problem
Your AI register is done. How do you keep it current when new tools arrive every week?
Most organisations start their AI register in a spreadsheet: a row per tool, a column for the vendor, one for the decision. That works, until the first question the list cannot answer: what else are people using?
The list only knows what was requested
A register fills up with tools someone requested or bought. The free account, the AI feature inside an existing tool and last month's new service are not in it.
Every row takes research
Where does the vendor process data, does it train on input, is there a data processing agreement (DPA), are there known incidents? For each tool, that is an afternoon of searching. A year later, the answer is out of date.
The decision is in the list, not at the desk
A register describes what is allowed. Someone opening a tool does not check the spreadsheet first. The decision only reaches the employee when it appears as they open the tool.
Features
What belongs in an AI register, and what BeeSensible covers.
An AI register is more than a list of names. These are the parts that belong in it, and for each one, whether BeeSensible covers it fully, partly or not at all.
| Feature | What it does | BeeSensible |
|---|---|---|
| Discover tools | See which AI services are opened in the organisation, including services nobody registered. | Yes Through the browser extension. Only the tool's domain, with no user ID. |
| Register filled from use | Tools used in the organisation appear in the Inbox automatically; a tool you allow gets a register entry straight away. | Yes Allowing a tool registers it: an allowed tool gets its own page in the AI register. The catalogue of over 1,000 AI tools provides the background information. |
| Vendor and country per tool | Who the vendor is, which country it is in, where it hosts data, whether it trains on input and whether a DPA is available. | Yes Plus sector, category, access model and certifications. The catalogue is kept up to date continuously. |
| Risk assessment | A score and a band per tool, as advice for the decision. | Yes Six weighted dimensions, score up to 100, bands Low, Medium, High and Critical. Known incidents are listed, with a source. |
| Decision per tool | Record what the organisation has decided: allowed, limited use, not allowed or no decision yet. | Yes Everything starts at "no decision yet". Nothing is pre-selected; BeeSensible never decides for you. |
| Inbox of new tools | Newly discovered tools that still lack a decision, in one list. | Yes With a count in the navigation and an email every morning when new tools arrive. One tool at a time; allowing a tool opens its register entry. |
| Add your own tools | Include an internal or self-built AI system that is not in the catalogue. | Yes With the same fields as the rest. It can then be chosen as the alternative in a notice. |
| Owners, use cases, documents and review | Record for each tool who is responsible, what it is used for, which documents belong to it and when the decision is reviewed. | Yes Owners with a role, use cases with their EU AI Act category, and the DPA and DPIA with a status. A review after a year, with an email reminder beforehand. The Measured tab compares what BeeSensible sees with what is recorded. |
| Record of processing activities (Article 30 GDPR) | Describe processing of personal data: purpose, categories, recipients, retention period. | No A different register for a different purpose. The AI register refers to it and does not replace it. |
| Export to PDF or CSV, or an API | Take the register outside BeeSensible, for an auditor or a GRC tool. | Partly The register exports as a PDF report over a period and as CSV. There is no public API. |
What it does not do
What this AI register does not take care of for you.
An AI register in software quickly gives the impression it takes care of everything. This is what BeeSensible does not do.
- Not a record of processing activities. The GDPR requires a separate record of processing activities; the AI register exists alongside it.
- No automatic decision. The risk score is advice; every tool starts at "no decision yet".
- No link to a GRC tool. Exports are a PDF report and a CSV file.
The approach
How the AI register fills itself from actual use.
See, decide, help, substantiate. The AI register is the result of the first two steps, and the reason the last two are possible.
1 See
The list starts from what is there
Every AI tool someone opens in the browser comes into view, with vendor, country and risk assessment from the catalogue attached. New tools appear in the Inbox.
2 Decide
A decision per tool
With the facts from the catalogue, the organisation chooses: allowed, limited use on a condition it writes itself, not allowed, or decide later. Allowing a tool registers it, with use cases, owners, documents and a review date.
3 Help
The decision, when someone opens the tool
Anyone who opens a tool the organisation has decided on sees that decision in the browser, with the allowed alternative first. People can still continue, unless the organisation has chosen otherwise.
4 Substantiate
The AI register keeps itself honest
New tools are added as soon as they are used, and each review comes round again automatically.
and again How the cycle works
Why this approach
Why Excel, the record of processing activities or a GRC tool won't give you a current AI register.
Each of these three has a place. None of them knows which AI tools are used outside the list.
The GDPR record of processing activities
Describes processing of personal data, with or without AI.
Related, not the same. It is about data, not tools, and says nothing about an AI service without personal data.
A GRC tool
A module for AI systems alongside risks, controls and audits.
Good for administration, blind to actual use. The list is filled by people, not by what happens in the browser.
Frequently asked questions
What people ask before they choose.
What is an AI register?
In short: the place where you answer which AI is in use in your organisation, and under what conditions. The table above shows what belongs in it.
What should an AI register contain?
For each tool: vendor, country and hosting region, whether the tool trains on input, whether a DPA is available, a risk assessment and an EU AI Act classification. Then the organisation's decision, the condition, the use cases and whether they involve personal data, the people responsible, the documents (DPA, DPIA, internal assessment) and a review date. The article below has an example.
Is an AI register mandatory?
Not as one universal register for every organisation. The AI Act has registration and documentation duties that depend on your role and the systems you deploy. The GDPR requires a record of processing activities as soon as a tool processes personal data. What applies to whom is in the article below. Apart from that, most organisations keep an AI register because otherwise they do not know what is being used.
Who owns the AI register?
The organisation decides. In practice, ownership usually lies with IT, the CISO or the privacy officer, with a person responsible for each tool in the department that uses it. BeeSensible records for each tool who owns it and who is involved from IT, privacy or security, and reminds them when the review is due.
Should ChatGPT and Copilot be in the AI register?
Yes, as soon as they are used. The general assistants process the most text and therefore the most personal data. In BeeSensible the consumer and business tiers of the same tool are separate rows with their own score, so the decision can differ per tier.
How do you keep an AI register current?
By filling it from what actually happens, rather than from what was requested. BeeSensible notices when an AI tool is opened in the browser, keeps new tools in the Inbox until there is a decision, and records a review date for each tool.
Can I export the AI register?
Yes, as a PDF report over a period (overview, per tool, usage, signals and history) and as CSV. In the dashboard you search and filter on what needs attention.
Does the AI register replace the record of processing activities?
No. The record of processing activities under Article 30 GDPR describes processing of personal data. An AI register describes tools and decisions. An AI tool that processes personal data belongs in both, with a reference each way. The AI register is useful input for the record of processing and for a DPIA.
Further reading
Everything about the AI register, from fields to obligations.
See within a day what belongs in your AI register.
Every module is included. The catalogue is ready; actual use fills in the rest of the AI register.
14 days free, no credit card. Rolled out across your organisation within an hour.
