An IT admin at an accounting firm keeps a spreadsheet of which AI tools are allowed. Two columns: the tool, and yes or no. A colleague asks whether she can use Claude to rewrite a draft letter. Claude is not on the list. Does that mean no? Not looked at yet? Or yes, because it is not banned? The admin knows and the colleague does not. Two desks away, someone reads it differently again.
That is why two statuses do not work. Four do: allowed, limited use, not allowed and no decision yet. The last one is where every tool starts, and that is not a weakness of the list but the most honest thing in it.
Why do yes and no fall short?
A yes-or-no list only covers the tools someone has thought about. That is usually a dozen or so, while people open several dozen, and new ones appear faster than an organisation can assess them. The largest group of tools therefore sits in neither column, and that is the group people guess about.
The second problem is in the yes. Many decisions are not yes or no but yes with a condition: ChatGPT, but only on the business account. A transcription tool, but not for customer calls. In a two-column list that condition disappears into a comment nobody reads, or the tool ends up as a no because a qualified yes does not fit.
And a no with nothing behind it simply moves the use to a personal account on someone's own phone. Blocking makes the risk invisible; it does not make it smaller. So a no needs to come with an alternative, and that does not fit in two columns either.
What does each status mean, and when do you pick it?
| Status | What it means | When you pick it | What you record with it |
|---|---|---|---|
| Allowed | Free to use within the general rules on data | The tool has been assessed, the vendor's terms are acceptable and there is a business account or an equivalent agreement | The account type the decision applies to |
| Limited use | Usable under one condition set by the organisation | The tool suits part of the work, or is acceptable only on terms people would not assume by default | The condition, in one sentence someone can follow |
| No decision yet | The organisation has not recorded anything about this tool | Always, as the starting point. Every tool begins here, including one nobody requested | Date first seen, and who does the assessment |
| Not allowed | The organisation would rather people use something else | The assessment produces a reason that outweighs the convenience, and there is an alternative | The alternative, and the reason in one sentence |
The right-hand column is what matters. A status without its details is just a colour; with the condition, the alternative or the date attached, it is a decision someone can act on. For "Not allowed", the reason is often a fact you can point to. Take the consumer version of Grok: shared chats ended up in Google search results, and it comes without a data processing agreement.
Why is "No decision yet" an honest status?
Because it is true. Nothing has been decided about most tools, and a list that hides that pretends the organisation has assessed more than it has. "No decision yet" tells the colleague in the opening exactly what she wanted to know: nobody has looked at this yet, and this is what you do in the meantime.
It is also useful, because it doubles as a backlog. Every tool marked "No decision yet" that is actually in use is an assessment still to be done. This is the model known as default-deny: nothing is allowed merely because it happens not to be banned, and every decision is a deliberate act by the organisation. The questions for that assessment are in our article on what to ask the vendor when approving an AI tool.
"No decision yet" is not a ban. The status comes with an instruction someone can follow at once: public information only, and this is where you request the assessment. In the meantime the organisation remains the controller for everything that does go in, decision or not; a status does not change that.
What does "Limited use" have that the others do not?
A condition, and the organisation writes it itself. "Business account only." "No client personal data." "Code only, no customer data in the prompt." One sentence, because nobody reads a paragraph in the middle of a task.
This is the status that lets an organisation be generous without becoming careless. A ban on ChatGPT is strict and gets worked around. "Limited use" with the condition "business account" is exactly as strict as it needs to be, and most people follow a condition they understand.
Is a risk score the same as a decision?
No, and that distinction is the reason the statuses exist. A risk score summarises what is known about a vendor: where processing runs, whether input is used for training, which certifications exist, which incidents are known. That is information. The decision belongs to the organisation, because only the organisation knows what the tool is used for.
Two tools in the same band can therefore rightly get different statuses. A tool with a high score that is used only for public text can reasonably be set to "Limited use". A tool with a low score that is allowed to read the entire personnel file deserves a harder look than the score suggests.
BeeSensible works the same way: every tool in the catalogue of over 1,000 AI tools carries a risk score across six dimensions, shown as information next to the four statuses. Every tool starts as "No decision yet", no option is pre-selected and an administrator records the decision. This is what that overview looks like, with the observed use next to it:
