Excel or a SharePoint list
A row per tool, maintained by whoever has time.
Describes the day the list was made. Every new tool needs someone to notice it, look it up and enter it.
AI register software
AI register software: a register with the tools that are actually there.
An AI register is the overview of the AI tools an organisation uses, with per tool who the vendor is, where it processes, how risky it is and what the organisation has decided about it. In Excel, such a register shows what the organisation knows about. What is actually used is a different list, and usually a longer one. BeeSensible links a catalogue of 865 assessed AI tools to the use observed in the browser, so the register contains the tools that are really there without anyone typing them in.
app.beesensible.eu/shadow-ai/catalog
865 tools
The problem
The register is complete on the day it is delivered. After that it falls behind.
Most organisations start with a spreadsheet: a row per tool, a column for the vendor, one for the decision. That works, until the first question the list cannot answer: what else are people using?
The list only knows what was requested
A register fills up with tools someone requested or bought. The free account, the AI feature inside a tool that was already in use and the service that did not exist last month are not in it.
Every row takes research
Where does the vendor process, does it train on input, is a data processing agreement available, are there known incidents? Per tool that is an afternoon of searching, and a year later the answer is out of date.
The decision is in the list, not at the desk
A register describes what is allowed. Someone opening a tool does not check the spreadsheet first. The decision only reaches the employee when it appears at the moment of work.
Features
What to expect from AI register software.
A register is more than a list of names. These are the features that belong to it, with an honest note on what BeeSensible does fully, partly and not at all.
| Feature | What it does | BeeSensible |
|---|---|---|
| Discover tools | See which AI services are opened in the organisation, including services nobody registered. | Yes Through the browser extension. Domain only, at most once a day per device, with no user id. |
| Register filled from use | The tools used in the organisation appear in the register without anyone entering them. | Yes A catalogue of 865 AI tools, linked to observed use. With presets for all tools, shadow AI, tools with activity and new tools. |
| Vendor and country per tool | Who the vendor is, which country it is in, where it hosts, whether it trains on input and whether a data processing agreement is available. | Yes Plus sector, category, access model and certifications. The catalogue is continuously curated. |
| Risk assessment | A score and a band per tool, as advice for the decision. | Yes Six weighted dimensions, score up to 100, bands Low, Medium, High and Critical. Known incidents are listed, with a source. |
| Decision per tool | Record what the organisation has decided: allowed, limited use, not allowed or no decision yet. | Yes Everything starts at "no decision yet". Nothing is pre-selected; BeeSensible never decides for you. |
| Inbox of new tools | Newly discovered tools that still lack a decision, in one list. | Yes With a live count in the navigation. Several tools can be decided at once. |
| Add your own tools | Include an internal or self-built AI system that is not in the catalogue. | Yes With the same fields as the rest, and selectable afterwards as the alternative in a notice. |
| Owner, purpose and review date | Record per tool who is responsible, what the tool is used for and when the decision is reviewed. | Partly What AI is used for is visible at organisation level, in seven categories. An owner and a review date per tool are recorded elsewhere. |
| Record of processing activities (Article 30 GDPR) | Describe processing of personal data: purpose, categories, recipients, retention period. | No A different register with a different question. The AI register refers to it and does not replace it. |
| Export to Excel or PDF, or an API | Take the register outside BeeSensible, for an auditor or a GRC tool. | No There is no export and no public API for the AI module. The register lives in the dashboard. |
What it does not do
What this register is not.
A register in software quickly gives the impression it takes care of everything. This is what BeeSensible does not do.
- Not a record of processing activities. The GDPR asks for its own record of processing; this is the list of AI tools and decisions that sits next to it.
- No automatic decision. The risk score is advice. A tool's status is always the organisation's choice, and it starts at "no decision yet".
- No per-employee view. The usage figures reach the servers without a user id. The register shows that a tool is used, never by whom.
- No blocking. A tool with status "not allowed" stays reachable; the employee sees the decision and can continue.
- No exports, no public API and no digest emails for the AI module.
- No legal obligation as a sales argument. Whether your organisation must keep an AI register depends on your role and the systems you deploy.
The approach
The register fills itself in four steps.
See, decide, help, substantiate. The register is the result of the first two, and the reason the last two are possible.
1 See
The list starts from what is there
Every AI tool someone opens in the browser comes into view in the catalogue, with vendor, country and risk assessment already attached. New tools appear in the inbox.
2 Decide
A decision per tool
With the assessment as advice, the organisation chooses: allowed, limited use with its own condition, not allowed, or deliberately not yet.
3 Help
The decision appears at the moment of work
Someone who opens a tool with a decision behind it sees that decision in the browser, with the allowed alternative first. Continuing is possible.
4 Substantiate
The register keeps itself honest
New tools are added as soon as they are used, tools without a decision stay visible, and the share of use through allowed tools shows whether the register is followed.
and again How the cycle works
Why this approach
Against the four ways organisations keep track today.
Each of these four has a place. None of the four knows which tools are used next to the list.
The GDPR record of processing
Describes processing of personal data, with or without AI.
Related, not the same. It is about data, not tools, and says nothing about an AI service that no personal data goes into.
A GRC tool
A module for AI systems next to risks, controls and audits.
Good for the administration, blind to the use. The list is filled by people, not by what happens in the browser.
Keeping nothing
Trusting that the tool you bought is the only one.
Works until someone asks which AI is in use. Then the answer is an estimate.
Frequently asked questions
What people ask before they choose.
What is AI register software?
Software that maintains the overview of AI tools in an organisation: per tool the vendor, the country, the risk assessment and the organisation's decision. BeeSensible fills that overview from a catalogue of 865 assessed tools and the use observed in the browser, so the list contains the tools that are actually there.
Is an AI register mandatory?
Not as one universal register for every organisation. The AI Act has registration and documentation duties that depend on your role and the systems you deploy, and the GDPR asks for a record of processing as soon as a tool processes personal data. Exactly what applies to whom is in the article below. Apart from that, most organisations keep a register because otherwise they do not know what is being used.
What is recorded per tool?
Vendor, country, sector, category, access model, certifications, whether the tool trains on input, whether a data processing agreement is available, where it hosts, an EU AI Act classification, known incidents with a source, safer alternatives, a risk score across six dimensions and the organisation's decision. The consumer and business tiers of the same tool are separate rows with their own score.
Can I add a tool that is not in the catalogue?
Yes. An organisation adds its own or internal tools with the same fields. Such a tool can then be set as the alternative a notice points to.
Can I export the register?
No. There is no export to Excel or PDF and no public API for the AI module. The register lives in the dashboard, with search and filters on risk band, sector, category, vendor country, access model, tag and certification.
Does this replace the record of processing activities?
No. The record of processing under Article 30 GDPR describes processing of personal data. An AI register describes tools and decisions. An AI tool that processes personal data belongs in both, with a reference each way.
Further reading
The register, from fields to obligations.
See within a day which tools belong in your register.
Fourteen days free, every module, no credit card. The catalogue is ready; the use fills in the rest.
14 days free, no credit card. Rolled out across your organisation within the hour.
