An IT admin at an accountancy firm with sixty staff keeps the AI register in Excel. Twelve rows, nine columns, a second tab for changes. It has worked for a year, and he is mildly annoyed when the partners ask whether there "isn't a tool for this".
He partly has a point. Excel is enough while the list is short, changes little and is kept by one person who knows first-hand what is in use. It breaks in four places, and software only fixes those if the rows come from somewhere other than the admin's keyboard. Which fields belong in the register is covered in our guide to the AI register; this article is about where you keep it.
When is Excel enough?
With ten to twenty tools, one owner and decisions that rarely change. The nine columns fit in a spreadsheet, the four statuses fit in a drop-down and everyone can open the file without a login or training.
There are more reasons to leave it that way. You own the format. There is no extra vendor, no contract and no new row in your own register. And a spreadsheet that is accurate beats software nobody updates.
The condition is that the owner knows what is in use. In a firm of sixty people on one site, where the admin hands out the accounts and most tools go through him, that holds for a while.
Where does a spreadsheet break?
Discovering new tools. A spreadsheet only knows what someone put in it. New rows come from a survey or a report, and people do not report everything: in the 2025 study by KPMG and the University of Melbourne, 57 per cent of employees hide their AI use from their employer. Not out of bad faith, but because it does not feel like something worth reporting. Our guide to discovering which AI tools employees actually use covers which sources do see something and what each one misses.
Reviews. A date in a cell sends nobody a reminder. A vendor's terms change, a tool gains a feature that reads files and the row stays exactly as it was filled in a year ago. That is inevitable, as our article on why an AI tool catalogue ages the moment you print it explains.
Showing the decision while people work. The register lives in a SharePoint folder. The employee is in a browser tab wondering whether this is allowed. The two never meet. A spreadsheet can record a decision, but it cannot show it at the moment it counts, and that moment is where a list of approved tools has to do its work.
Version history. Who changed this decision and when, and what did it say before? A file called AI-register_v7_final.xlsx does not answer that question, and an auditor will ask it.
How do the two compare?
| Question | Spreadsheet | Software |
|---|---|---|
| Getting started | Today, no procurement | Contract, set-up and a new row in your own register |
| Format | Yours, matches your record of processing | The vendor's; check what you can export |
| Discovering new tools | Only what someone reports | Only if the software observes use; a register module you type into sees nothing either |
| Review | A date in a cell | A reminder to the owner, if the owner is recorded per row |
| Decision shown while people work | No | Only if the decision appears where the employee works, in the browser |
| Version history | Manual, on a second tab | Built in, if the software dates and attributes decisions |
| Several owners | One file: one person manages it, or everyone edits it at once | Roles per row |
| At ten tools and one owner | Enough | More than you need |
| At a hundred tools and six departments | Costs more time than it saves | Needed, provided it is fed |
Why is software not automatically better?
Because there are three kinds, and two of them do not solve the spreadsheet's problem.
The first is a GRC tool: policies, risks and controls in one place, with the AI register as a list inside it. Good for record-keeping and for tying the register to the record of processing activities. But you still type the rows in yourself, so nothing changes when it comes to discovering new tools.
The second is a register module with a login. Nice fields, drop-downs, an export button. It is Excel with a vendor attached.
The third kind takes its rows from what is observed in the organisation: which AI tools are opened, how often and whether a decision exists. That is the only kind that addresses the first weak point, and it gives you the question to ask any vendor: where do new rows come from? If the answer is "you enter them", you are buying a spreadsheet.
At the accountancy firm, the difference became clear when it took over a smaller practice. That practice had its own habits and its own tools, and nobody there knew a register existed. The admin heard about two of those tools by chance, in a conversation about a client file. Nobody had done anything wrong. The spreadsheet simply had no way of knowing.
BeeSensible is the third kind. The extension reports only the domain of an opened AI tool, at most once per day per device, with no user ID and no content, and checks it against a catalogue of over 1,000 assessed tools. An administrator sees which tools still have no decision and records one; that decision then appears in the browser when someone opens the tool. There is no direct integration with GRC tools. The register can be exported as CSV and as PDF, so an organisation that uses such a suite as its system of record can carry the data across. There is more on the AI register page.
