Decide which AI tools your organisation can use responsibly.
Employees use ChatGPT, Copilot and all kinds of other AI tools. But which are suitable for the work they do with them? Where is data processed, which risks are known, and which agreements have you made? The AI register brings that information together and records per tool what is and is not allowed.
The AI register in the dashboard. Demonstration with a fictional organisation.
Assess an AI tool on the facts.
Before you allow a tool, you want to know what happens to the data that goes in, where the vendor sits and which agreements apply. Finding that out per tool takes days.
BeeSensible collects that information for over 1,000 AI tools: vendor and parent company, hosting, whether the tool trains on input, whether a processing agreement exists, certifications, known incidents with a source, and a risk score over six dimensions. Free and business variants sit apart.
You do not start from zero and can substantiate a decision. The assessment and the decision stay with your organisation; BeeSensible never chooses.
All tools: the catalogue, with this organisation's decision per tool. Demonstration.
Choose per tool what is allowed, and under which condition.
There are four decisions, and every tool starts on "no decision yet". Nothing is pre-selected and there is no default policy per risk band.
The tool goes into the register, with the admin as owner and a review in a year.
Allowed within a condition in your words, such as "No customer data." The employee sees that sentence on opening.
Choose an alternative; the notice puts it first. Whether people can still carry on is your choice. That is how this organisation decided on DeepSeek, with Microsoft 365 Copilot as the alternative.
Where every tool starts. Want to know more first? Choose Decide later: the tool moves to Under review, out of the Inbox, still without a decision. Any decision can be undone.
The DeepSeek file at this organisation: not allowed, with the reason and the alternative.
Bring the agreement to the people who use the tool.
A decision in the register only helps once people come across it. You also want to set what happens to an ID number in a prompt and which data counts as critical.
You decide which notice people see when they open a tool, which data types are recognised and how strictly, and how masking is set up. That applies across the organisation, and for ChatGPT, Claude and Gemini you can make exceptions per tool.
So the policy lives in one place, and people notice it the moment they open a tool or paste data. The available settings are described in the documentation.
Policy > Masking (the settings) and Policy > Detection profiles. Demonstration with fictional settings.
Keep the register current, without a spreadsheet.
A register in a spreadsheet is stale the day it is finished. A new tool never makes it in, a processing agreement expires unnoticed, and nobody remembers why something was allowed.
In BeeSensible, allowing is registering. Every allowed tool gets a file: the decision and who made it, the use cases, the owners, the documents (processing agreement, DPIA, usage rules), the detection profile and a review date. What BeeSensible measures sits next to it.
So the register keeps up: a new tool waits in the Inbox until you decide, open documents stay visible and the owner gets an email ahead of the review. Exports as PDF and CSV.
Click through the ChatGPT file, as it looks at this organisation.
Clickable demonstration. The organisation, the people and the figures are fictional.
Overview
Decision, use cases, owners, documents and review date. Anything open sits at the top.
Policy
The notice on opening, the detection profile, and per masking function whether the tool follows the organisation.
Use cases
What the tool is used for, per department, and how many prompts BeeSensible saw.
Measured
What BeeSensible saw next to what is recorded. Where something differs, it shows as a signal.
History
Every change: date, who, what, from and to.
What the register adds to your record of processing and your DPIA.
Not a record of processing
Article 30 GDPR describes processing. The AI register describes tools and decisions. A tool with personal data belongs in both.
Not a legal judgement
The EU AI Act indication is about the tool and the use case. Which obligations apply is for your organisation to assess.
No decision on your behalf
The risk score and the facts are information. The decision, the condition and the alternative belong to the organisation.
See which tools belong in your register.
The catalogue is ready, use fills in the rest. Rather see a filled-in file first? Ask for a demo.
14 days free, no credit card. Rolled out across your organisation within an hour.
