An IT admin at an accountancy firm with sixty staff keeps the AI register in Excel. Twelve rows, nine columns, a second tab for changes. It has worked for a year, and the partners asking whether there is "not a tool for this" mildly annoys him.
He has a point, partly. Excel is enough while the list is short, changes little and one person keeps it who knows first-hand what is in use. It breaks in four places, and software only fixes those if the rows come from somewhere other than the admin's keyboard. Which fields belong in the register is covered in an AI register: what it is and what you record in it; this piece is about where you keep it.
When is Excel enough?
At ten to twenty tools, one owner, and decisions that rarely change. The nine columns fit in a spreadsheet, the four statuses make a drop-down, and everyone can open the file without a login or training.
There are more reasons to leave it that way. You own the format. There is no extra vendor, no contract and no new row in your own register. And a spreadsheet that is accurate beats software nobody updates.
The condition is that the owner knows what is in use. In a firm of sixty people on one site, where the admin hands out the accounts and most tools go through him, that holds for a while.
Where does a spreadsheet break?
At discovering new tools. A spreadsheet only knows what someone put in it. New rows come from a survey or a report, and people do not report everything: in the 2025 study by KPMG and the University of Melbourne, 57 percent of employees hide their AI use from their employer. Not out of bad faith, but because it does not feel like something worth reporting. Which sources do see something, and what each one misses, is in how do you discover which AI tools employees actually use.
At the review. A date in a cell does not ring. A vendor's terms change, a tool gains a feature that reads files, and the row stays exactly as it was filled in a year ago. Why that is structural is in why an AI tool catalogue ages the moment you print it.
At the decision on the work floor. The register lives in a SharePoint folder. The employee is in a browser tab wondering whether this is fine. The two never meet. A spreadsheet can record a decision, but it cannot show it at the moment it counts, and that moment is where a list of approved tools has to do its work.
At versions. Who changed this decision, when, and what did it say before? A file called AI-register_v7_final.xlsx does not answer that question, and an auditor will ask it.
How do the two compare?
| Question | Spreadsheet | Software |
|---|---|---|
| Getting started | Today, no procurement | Contract, setup, and a new row in your own register |
| Format | Yours, matches your record of processing | The vendor's; check what you can export |
| Discovering new tools | Only what someone reports | Only if the software observes use; a register module you type into sees nothing either |
| Review | A date in a cell | A reminder to the owner, if the owner is recorded per row |
| Decision at the moment of work | No | Only if the decision appears where the employee works, in the browser |
| Version history | Manual, on a second tab | Built in, if the software dates and attributes decisions |
| Several owners | One file, one person managing it, or everyone in it at once | Roles per row |
| At ten tools and one owner | Enough | More than you need |
| At a hundred tools and six departments | Costs more time than it returns | Needed, provided it is fed |
Why is software not automatically better?
Because there are three kinds, and two of them do not solve the spreadsheet's problem.
The first is a GRC tool: policies, risks and controls in one place, with the AI register as a list inside it. Good for record-keeping and for the link to the record of processing. But you still type the rows yourself, so discovering new tools does not change.
The second is a register module with a login. Nice fields, drop-downs, an export button. It is Excel with a vendor attached.
The third kind takes its rows from what is observed in the organisation: which AI tools are opened, how often, and whether a decision exists. That is the only kind that touches the first breaking point, and it gives you the question to ask any vendor: where do new rows come from? If the answer is "you enter them", you are buying a spreadsheet.
At the accountancy firm the difference became visible when it took over a smaller practice. That practice had its own habits and its own tools, and nobody there knew a register existed. The admin heard about two of them by chance, in a conversation about a client file. Nobody had done anything wrong. The spreadsheet simply had no way of knowing.
BeeSensible is the third kind. The extension reports only the domain of an opened AI tool, at most once per day per device, with no user id and no content, and checks it against a catalogue of 865 assessed tools. An administrator sees which tools still have no decision, records the decision, and that decision then appears in the browser when someone opens the tool. There is no export to a GRC tool; an organisation that uses such a suite as its system of record maintains it alongside. More is on the AI tools page.
