An IT admin at an accounting firm keeps a spreadsheet of which AI tools are allowed. Two columns: the tool, and yes or no. A colleague asks whether she can use Claude to rewrite a draft letter. Claude is not on the list. Does that mean no, not looked at yet, or yes because it is not banned? The admin knows, the colleague does not, and two desks over it is read differently again.
That is why two statuses do not work. What works is four: allowed, limited use, not allowed, and no decision yet. The last one is where every tool starts, and that is not a weakness of the list but the most honest thing in it.
Why do yes and no fall short?
A two-flavour list only describes the tools someone has thought about. That is usually a dozen or so, while people open several dozen, and new ones appear faster than an organisation can assess them. The largest group of tools therefore sits in neither column, and that is the group people guess about.
The second problem is in the yes. Many decisions are not yes or no but yes with a condition: ChatGPT, but only on the business account. A transcription tool, but not for customer calls. In a two-column list that condition disappears into a comment nobody reads, or the tool lands on no because a half yes does not fit.
And a no that stands on nothing moves the use to a private account on a personal phone. Blocking makes the risk invisible; it does not make it smaller. A no therefore needs to carry an alternative, and that does not fit in two columns either.
What does each status mean, and when do you pick it?
| Status | What it means | When you pick it | What you record with it |
|---|---|---|---|
| Allowed | Free to use within the general rules on data | The tool has been assessed, the vendor's terms fit, and there is a business account or an equivalent agreement | The account type the decision applies to |
| Limited use | Usable within one condition the organisation writes itself | The tool suits part of the work, or only under an agreement that is not self-evident | The condition, in one sentence someone can follow |
| No decision yet | The organisation has not recorded anything about this tool | Always, as the starting point. Every tool begins here, including one nobody requested | Date first seen, and who does the assessment |
| Not allowed | The organisation would rather people use something else | The assessment produces a reason that outweighs the convenience, and there is an alternative | The alternative, and the reason in one sentence |
The right-hand column is the one that makes the difference. A status without what belongs to it is a colour; with the condition, the alternative or the date attached, it is a decision someone can act on.
Why is no decision yet an honest status?
Because it is true. Nothing has been decided about most tools, and a list that hides that pretends the organisation has assessed more than it has. No decision yet tells the colleague from the opening exactly what she wanted to know: nobody has looked at this yet, and this is what you do in the meantime.
It is also useful, because it is a backlog. Everything sitting at no decision yet that is actually in use is an assessment still to be done. That is the model called default-deny: nothing is allowed merely because it happens not to be banned, and every decision is an explicit act of the organisation. The questions for that assessment are in approving an AI tool: what to ask the vendor.
No decision yet is not a ban. The status comes with an instruction someone can follow at once: public information only, and this is where you request the assessment. In the meantime the organisation remains the controller for everything that does go in, decision or not; a status does not change that.
What does limited use carry that the others do not?
A condition, and the organisation writes it itself. "Business account only." "No client personal data." "Code only, no customer data in the prompt." One sentence, because at the moment of work nobody reads a paragraph.
This is the status that lets an organisation be generous without becoming careless. A ban on ChatGPT is strict and gets worked around. A limited use with the condition "business account" is exactly as strict as needed, and most people follow a condition they understand.
Is a risk score the same as a decision?
No, and that distinction is the reason the statuses exist. A risk score summarises what is known about a vendor: where processing runs, whether input is used for training, which certifications exist, which incidents are known. That is advice. The decision belongs to the organisation, because only the organisation knows what the tool is used for.
Two tools in the same band can therefore rightly get different statuses. A tool with a high score used only for public text can be limited use. A tool with a low score that is allowed to read the entire personnel file deserves a harder look than the score suggests.
BeeSensible works the same way: every tool in the catalog of 865 AI tools carries a risk score across six dimensions, shown as advice next to the four statuses. Every tool starts at no decision yet, no button comes pre-selected, and an admin records the decision. This is what that overview looks like, with the observed use next to it:
