At a housing association, a reminder pops up in the IT administrator's calendar: review AI register. He opens the spreadsheet. The last edit was made eight months ago, by a colleague who has since left. Since then the meeting tool has started summarising calls, and nobody has added a row for it.
That is how a register goes stale: not on the day you write it, but on the day something changes at a vendor or inside the organisation. Keeping it current takes three things: triggers that force a review, a rhythm as a safety net and a second source that supplies the tools nobody reported. The fields a row holds are covered in our guide to the AI register; this piece is about what comes after.
Which triggers force a review?
A review date on the row is a safety net. The real changes come from outside the calendar, and they take five forms.
| Trigger | What changes | What you check |
|---|---|---|
| New feature at the vendor | The tool can suddenly read documents, record meetings or search the web | Data use and purpose; whether the condition on "Limited use" still holds |
| Acquisition or changed terms | New owner, new jurisdiction, new sub-processors, new training policy | Vendor, data processing agreement (DPA), where processing takes place |
| Incident at the vendor | A data breach, a flaw in the sharing feature, a regulator stepping in | Whether the decision stands, and whether employees need to do anything |
| New use inside the organisation | Another department, another purpose, other data | Whether this is a new row, and who becomes its owner |
| Different account type | From free to business, or the reverse | DPA, model training, admin controls; usually a separate row |
The first is the quietest. There is no request and no invoice: the vendor switches on a feature, and the register row still describes the tool as it was two years ago. Our article on why an AI tool catalogue goes out of date the moment you print it explains why that is structural. The fourth is the one most often missed, because the tool is already in the register. Copilot for internal memos and Copilot for interview notes in HR are one tool and two rows.
What rhythm actually works?
Not a single annual exercise that takes six weeks. That produces a list that is already out of date on the day it is delivered, and the following year nobody does it again.
What does work: every row gets a review date, set by its owner according to risk. A translation tool for public texts can go a year; a transcription tool in HR, closer to six months. On top of that come two fixed checkpoints. Every quarter, the rows marked "No decision yet" and "Limited use": the first because they are a backlog, the second because a condition goes out of date faster than a plain yes or no. And once a year, everything.
That is half an hour per row: are the vendor, data use and purpose still accurate, and what is the new date? Kept that small, it keeps getting done.
Why does an updated register still fall behind?
A register only knows what someone has reported. Every row began as a request, an invoice or a question to the service desk. Anything that comes into use without a request never gets in, and that is most of it. In the 2025 study by KPMG and the University of Melbourne of 48,000 workers in 47 countries, 57 per cent say they hide their AI use from their employer. Not out of bad faith: the tool did the job and nobody had asked.
A vocational college keeps a register of nine rows, each with a review date. The first measurement of which AI services are opened in the browser shows fourteen. The five extra are Perplexity, a tool that generates test questions, a presentation tool with built-in AI, a transcription tool one teacher pays for himself and the free version of ChatGPT alongside the business one. None of the five is an incident, because nothing had been decided about any of them. The register was up to date, for the nine rows it knew about.
What is the difference between updating a register and feeding it?
A register you update changes when someone remembers. A register that is fed gets new rows from what actually happens: an AI tool that is opened in the organisation and has no decision yet appears on its own, with the date it was first seen. The work shifts from finding tools to deciding about them.
That does not require monitoring people. To know whether a tool needs a decision, the service's domain is enough: that an AI tool was opened in the organisation, which one and how often. Which methods can and cannot see this is covered in our guide to finding out which AI tools employees actually use.
Through the browser extension, BeeSensible reports only the domain of an AI tool that was opened, at most once per day per device, with no user ID and no content. Newly discovered tools without a decision land in the dashboard's Inbox, where an administrator records a decision one tool at a time; to decide on several tools at once, use the catalogue. The catalogue of over 1,000 tools is continuously curated. Below is what the AI register shows for each tool.
