A CISO at a healthcare organisation puts two lists side by side. On the left, the AI register: eleven rows, all assessed, each with an owner and a date. On the right, an overview of the AI services opened in the browser over the last thirty days: nineteen domains. Eight of them do not appear in the register.
Those eight are not violations. They are the gap between what the organisation knows and what happens, and that gap is the work. Getting from the right-hand list to a register that is correct takes four steps: observe, assess, record a status, and let the register grow out of those decisions.
What does a manual register show, and what does it not?
A manual register is filled in by people who know about a tool: the buyer, the owner of an application, someone who submitted a request. So it describes what the organisation knows. Which fields belong in it and how it relates to the record of processing is in an AI register: what it is and what you record in it.
What falls outside it has a name. Shadow AI is AI use that meets three conditions: the tool can be started without purchasing or an administrator, the organisation has taken no decision about it, and it has actually been used in the last thirty days. That last condition keeps the list short. A tool someone opened once is not a governance question.
People rarely report this use on their own, and not out of bad faith. In the study by KPMG and the University of Melbourne among 48,000 workers in 47 countries (2025), 57 percent say they hide AI use from their employer. A register that relies on reporting therefore describes what people dare to report.
Step 1: how do you observe without tracking people?
The question the register asks is which tools are used and need a decision. For that question the service's domain is enough: that an AI tool was opened in the organisation, which one, and how often. Who did it adds nothing.
That is not a concession but the boundary of the measurement. As soon as you record the person too, a count of services turns into a record of people, with everything that brings under the GDPR and towards the works council. That distinction is worked out in AI monitoring versus employee monitoring. Which methods do and do not see the use, from network logs to the browser, is in how do you find out which AI tools employees actually use.
Two things stay out of view: the phone without the extension, and AI features that appear inside existing software without a domain of their own. For the second, the vendor's announcement is the only signal.
Step 2: what do you do with a newly discovered tool?
It arrives in the one place that holds only the tools still waiting for a decision: first seen in this period, nothing recorded yet. That is the backlog, and it is smaller than the catalogue of everything that exists. In most organisations it is a few dozen domains, not thousands.
Assessment goes faster when the facts about the vendor are already alongside: country of establishment, whether it trains on input, which certifications it holds, which incidents are known and sourced, and a risk score that sums that up. The score is advice. Two tools with the same score can rightly end up with different statuses, because the use inside the organisation differs. How you weigh that use is in how to assess the risk of an AI tool.
The Dutch Data Protection Authority has reported several data breach notifications in which employees had entered personal data into an AI chatbot, and advises organisations to make agreements on whether a tool may be used and which data may go in. That agreement starts with a decision per tool.
Step 3: which status do you record?
One of four: allowed, limited use, no decision yet, not allowed. Limited use carries a condition the organisation writes itself in one sentence, such as "only with the business account". Not allowed carries the alternative people may use instead. Why two statuses are too few is in four statuses for AI tools.
No decision yet remains an honest outcome throughout. It says the organisation has seen the tool and is still looking at it. That is different from not allowed, and anyone who lumps the two together ends up forbidding everything that is new.
A decision that only lives in the register does not reach the work floor. One that appears at the moment someone opens the tool, with the alternative next to it, does. That is the moment the register turns from a record into behaviour.
Step 4: what register comes out of this?
| Step | What happens | What the register gains |
|---|---|---|
| Observe | The domain of an opened AI service, at most once per day per device | A row at "no decision yet", with the date of first observation |
| Assess | The facts about the vendor next to the use inside the organisation | Vendor, country, training policy, risk band, known incidents |
| Decide | One of four statuses, with a condition or an alternative | Decision, date, who took it |
| Maintain | A new tool or new use reappears in the backlog | Review on a trigger, instead of on the calendar |
Back to the healthcare organisation. A week later, the eight unknown domains have a status. Three are allowed: a translation service and two tools that already ran through the business account but had never been written down. Two are limited use, on the condition that no client data goes in. One transcription tool is not allowed, with the approved meeting tool as the alternative. Two are still on no decision yet, because the department's owner has not looked at them. No incident, but a register that now describes the working day.
What the table does not deliver is the application layer: who owns the tool, what it is used for and which data goes in. That remains people's work, and it is the layer where the risk lives. Observation fills the register; it does not replace it.
BeeSensible connects a catalogue of 865 AI tools, each with vendor, country, certifications, training policy and a risk score across six dimensions, to the use observed in the organisation. The extension reports only the domain, with no user id and no content. Newly discovered tools without a decision sit in the dashboard's inbox, where an administrator records the status; every tool starts at "no decision yet" and BeeSensible never chooses on the organisation's behalf. What that looks like per tool is below and on the AI tools page.
