Control over AI
Start free trial
Decide · In depth

Assess the risks before you allow an AI tool.

Anyone who wants to allow an AI tool needs to know what happens to the data, where the vendor sits and what is known about incidents. BeeSensible collects those facts for over 1,000 AI tools and summarises them in a risk score. This page explains how, so you know what the score gives you and what it does not.

What we collect

Per tool, the facts a decision needs.

Vendor and ownership

Who makes the tool, the parent company and the country of establishment.

Hosting and jurisdiction

Where data is processed and which law applies there.

Training policy

Whether the tool trains on input, and whether you can opt out.

Processing agreement

Whether the vendor offers one. Many free versions do not.

Certifications

ISO 27001, SOC 2 and similar, as the vendor publishes them.

Incidents with a source

Data breaches and lawsuits, with the source. Where a verified source is missing, it says so.

AI register

DeepSeek

DeepSeek

Decision

Decision

Decision
Priya Nair, 11 February 2026
Reason
Trains on everything that goes in and runs outside the EU. Use Copilot for the same work. Change
Designated alternative
Microsoft 365 Copilot Change

Not in the register yet. Make a decision to add it.

About the tool

From the BeeSensible catalog, not editable here.

RiskCritical · 90/100BeeSensible's estimate, not a legal judgement · reviewed on 18 Sept 2026

Data governance (5): trains on input, no opt-out, no processing agreement. Jurisdiction (5): vendor and hosting in China, under local access laws. Compliance (5): no certification found. Incidents (5): a public database exposure in 2025, with a source. Integration (2): web app only. Vendor trust (3): ownership documented, model open.

Vendor

Vendor
DeepSeek
Country
China
Kind of tool
General assistant

Data

Trains on input
Yes
Hosting and region
China
Processing agreement from the vendor
Not available

Regulation

EU AI Act
Limited risk
Certifications
Unknown

The classification is about the tool itself; which obligations apply depends on your use.

AI register

ChatGPT

OpenAI

Decision

Decision

Decision
Lucía Ortega, 8 September 2025
Use cases
Analysis & knowledge, Summarizing, Writing communication, CV screening Change1 use case can fall under the EU AI Act
Reason
Widely used; the business account runs through the company subscription. No client files, no personal data of clients. Change
State
In use at your organisationNo longer in use: the registration is kept with an end date and the decision stays as it is.
No longer in use

Responsible

  • Lucía OrtegaOwner
  • Daniel WhitfieldIT
  • Ingrid HansenPrivacy
Change

Documents

  • Processing agreementIn place · 14 Mar 2026 · Open ↗Processing agreement from the vendor: Available
    Change
  • DPIACarried out · 14 Jun 2026 · Open ↗Personal data at 3 of 4 use cases
    Change
  • AI policy 2026Usage rules or AI policyIn place · 20 Jan 2026 · Open ↗
    Change
  • Internal assessmentCarried out · 1 Sept 2025
    Change
+ Add document

Reassessment

Last reassessment
8 Sept 2026
Next reassessment
8 Sept 2027
Reassessment owner
Lucía Ortega
Start reassessmentChange date or person

About the tool

From the BeeSensible catalog, not editable here.

RiskHigh · 62/100BeeSensible's estimate, not a legal judgement · reviewed on 2 Oct 2026

Data governance (4): the consumer version trains on input unless the user opts out; a processing agreement is available for the business tiers. Jurisdiction (3): vendor in the US, hosting in the US. Compliance (3): SOC 2 Type II and ISO 27001 according to the vendor; EU AI Act transparency duties apply to a general-purpose assistant. Incidents (3): documented incidents with a source, including shared conversations indexed by search engines. Integration (3) and vendor trust (1) follow from what the product does and who supplies it.

Vendor

Vendor
OpenAI
Country
United States
Kind of tool
General assistant

Data

Trains on input
Opt-out
Hosting and region
United States
Processing agreement from the vendor
Available

Regulation

EU AI Act
Limited risk
Certifications
SOC 2 Type II, ISO 27001

The classification is about the tool itself; which obligations apply depends on your use.

⤓ Download pdf

The facts about DeepSeek and ChatGPT, as they appear in the file. Demonstration.

Risk assessment

How a tool gets its score.

Every tool in the catalog is scored on six dimensions, each from 1 to 5, where higher means more risk. The dimensions do not weigh the same: what the vendor does with your data counts heaviest.

Data governance

Weight 6

How the vendor handles your data: whether it trains on your input, offers a processing agreement, and where data is stored.

Jurisdiction

Weight 4

Legal risk from where the vendor and its data live. Countries allowing state access or lacking GDPR adequacy score higher.

Compliance

Weight 3

Alignment with GDPR and the EU AI Act, plus recognised certifications such as ISO 27001 and SOC 2.

Incidents

Weight 3

History of breaches, leaks or misuse tied to this tool. More or more serious documented incidents score higher.

Integration scope

Weight 2

How much access the tool asks for: from a standalone chat box up to connectors and actions inside your own systems.

Vendor trust

Weight 2

Transparency about ownership and the underlying model, track record and maturity of the company.

From score to risk band

Low below 40 Medium 40 to 59 High 60 to 79 Critical 80 and above

DeepSeek

Critical 90/100

DeepSeek · China

Why this assessment

  • · Trains on your input by default.
  • · Vendor jurisdiction (CN) allows state access; no GDPR adequacy.
  • · No data-processing agreement (DPA) available.

Incidents, with a source

  • 2025 · Public share links indexed by search engines source
  • 2025 · Regulator blocked the app over data transfers to China source

Where a tool has a history, that history is listed with a link to the source. When a verified source is missing, the product says so in as many words. That keeps it a fact rather than a rumour.

Variants

The free and the business version are two tools.

ChatGPT free and ChatGPT for business differ in training policy, contract and processing agreement. So they sit apart in the catalogue, each with its own score and its own decision. Lookalikes and wrappers that use a known name are recognised for what they are.

The EU AI Act

An indication, not a legal judgement.

Every tool carries an indication under the EU AI Act: high, limited or minimal risk, depending on the use, or not classifiable. That is about the tool as offered. Whether your use falls under a high-risk category depends on what you use it for; that is for the organisation to assess, and you record it in the register.

What the score is not

The score is information; the decision is yours.

Not a decision

A high score does not set a tool to not allowed. Every tool starts on "no decision yet" and there is no default policy per band.

Not a judgement on your use

The score is about the tool. A tool with a low score can still be unsuitable for your use case, and the other way round.

Not a guarantee

We assess on what vendors publish and what verified sources say. What is not known is shown as unknown, not as safe.

Not static

The catalogue is continuously curated. A tool not in it yet can already get a decision.

Back to Decide

Assess your own tools with these facts.

Roll out BeeSensible and see within a day which tools are in use, with the catalogue next to them. Fourteen days free, no credit card.

Try 14 days free

14 days free, no credit card. Rolled out across your organisation within an hour.

Portrait of Rens Timmermans of BeeSensible

Would you rather someone showed you?

Rens, BeeSensible

I am happy to give you a twenty-minute tour. Leave your details and I will find a moment that suits you. Calling or emailing works just as well.

[email protected] +31 6 52 19 22 33

Rather talk to someone first? Book a call.

Want a live demo, or a quote for 100+ users? Leave your details and we'll be in touch within one business day.