A CISO at a healthcare organisation puts two lists side by side. On the left, the AI register: eleven rows, all assessed, each with an owner and a date. On the right, an overview of the AI services opened in the browser over the last thirty days: nineteen domains. Eight of them do not appear in the register.
Those eight are not violations. They are the gap between what the organisation knows and what actually happens, and that gap is the work. Getting from the right-hand list to an accurate register takes four steps: observe, assess, record a status and let the register grow out of those decisions.
What does a manual register show, and what does it not?
A manual register is filled in by people who know about a tool: the buyer, the owner of an application, someone who submitted a request. So it describes what the organisation knows. Our guide to the AI register covers which fields belong in it and how it relates to the record of processing activities.
What falls outside it has a name. Shadow AI is AI use that meets three conditions: the tool can be started without going through procurement or an administrator, the organisation has taken no decision about it and it has actually been used in the last thirty days. That last condition keeps the list short. A tool someone opened once is not a governance question.
People rarely report this use on their own, and not out of bad faith. In the 2025 study by KPMG and the University of Melbourne of 48,000 workers in 47 countries, 57 per cent say they hide their AI use from their employer. So a register that relies on reporting describes what people feel comfortable reporting.
Step 1: how do you observe without tracking people?
The question the register asks is which tools are used and need a decision. For that question the service's domain is enough: that an AI tool was opened in the organisation, which one and how often. Who opened it adds nothing.
That is not a concession but the limit of the measurement. As soon as you record the person too, a count of services turns into a record of people, with everything that entails under the GDPR and for the works council. AI monitoring versus employee monitoring explores that distinction. Our guide to finding out which AI tools employees actually use covers which methods do and do not pick up the use, from network logs to the browser.
Two things stay out of view: the phone without the extension, and AI features that appear inside existing software without a domain of their own. For the second, the vendor's announcement is the only clue.
Step 2: what do you do with a newly discovered tool?
It arrives in the one place that holds only the tools still waiting for a decision: used in the last thirty days, nothing recorded yet. That is the backlog, and it is smaller than the catalogue of everything that exists. In most organisations it is a few dozen domains, not thousands.
Assessment goes faster when the facts about the vendor are already to hand: country of establishment, whether it trains on input, which certifications it holds, which incidents are known and sourced, plus a risk score that sums that up. The score is advice. Two tools with the same score can rightly end up with different statuses, because the use inside the organisation differs. Our guide to assessing the risk of an AI tool explains how to weigh that use.
The Dutch Data Protection Authority has reported several data breach notifications in which employees had entered personal data into an AI chatbot, and advises organisations to set clear rules on whether a tool may be used and which data may go in. Those rules start with a decision per tool.
Step 3: which status do you record?
One of four: allowed, limited use, no decision yet, not allowed. "Limited use" comes with a one-sentence condition the organisation writes itself, such as "only with the business account". "Not allowed" comes with the alternative people can use instead. Our article on the four statuses for AI tools explains why two statuses are too few.
"No decision yet" remains an honest outcome throughout. It says the organisation has seen the tool and is still looking at it. That is different from "Not allowed", and anyone who lumps the two together ends up forbidding everything that is new.
A decision that only lives in the register does not reach the employee. One that appears at the moment someone opens the tool, with the alternative next to it, does. That is the moment the register turns from a record into behaviour.
Step 4: what kind of register does this produce?
| Step | What happens | What the register gains |
|---|---|---|
| Observe | The domain of an opened AI service, at most once per day per device | A row marked "No decision yet", with the date of first observation |
| Assess | The facts about the vendor, weighed against the use inside the organisation | Vendor, country, training policy, risk band, known incidents |
| Decide | One of four statuses, with a condition or an alternative | Decision, date, who took it |
| Maintain | A new tool or new use reappears in the backlog | Review when something triggers it, not on a fixed schedule |
Back to the healthcare organisation. A week later, the eight unknown domains have a status. Three are allowed: a translation service and two tools that already ran through the business account but had never been written down. Two are set to limited use, on condition that no client data goes in. One transcription tool is not allowed, with the approved meeting tool as the alternative. Two are still marked "No decision yet", because the department's owner has not looked at them. No incident, but a register that now describes the working day.
What the table does not deliver is the application layer: who owns the tool, what it is used for and which data goes in. That is still work for people, and it is the layer where the risk lives. Observation fills the register; it does not replace it.
BeeSensible connects a catalogue of over 1,000 AI tools, each with vendor, country, certifications, training policy and a risk score across six dimensions, to the use observed in the organisation. The extension reports only the domain, with no user ID and no content. Newly discovered tools without a decision land in the dashboard's Inbox, where an administrator records the status; every tool starts with the status "No decision yet" and BeeSensible never decides on the organisation's behalf. You can see what that looks like for each tool below and on the AI tools page.
