A new employee at an insurer asks her team leader whether she can use Perplexity to look up policy terms. The team leader knows Copilot is allowed, because there is a licence for it. She knows nothing about Perplexity, so she says: "Better not, for now." The new employee uses it anyway, at home on her own laptop.
Which AI tools employees may use is a decision the organisation takes. It is not printed on the tool. An organisation that has not decided is not being strict; it is leaving every team leader to work it out alone.
A tool is not "safe" or "unsafe" in itself. The same chatbot can be used to rewrite an internal email or to summarise a client file, on a free account or on a business licence backed by a data processing agreement. That makes four different situations, with the same tool in all four.
So "is this allowed?" is a question for the organisation, not for the vendor. The vendor tells you what happens to your data. What you do with that information is your own judgement, weighed against the work people do, the data that passes through the tool and what has already been agreed. The AI Act requires organisations that deploy AI systems to make sure their staff are sufficiently AI-literate. Knowing which tools the organisation has allowed, and why, is the most practical place to start.
#How do you build the list?
Four steps, in this order. The temptation is to start at step two.
Take stock of what is already there. Not the tools you know about, but the tools people actually open. That list is almost always longer than expected, and it includes tools nobody ever decided to buy: a transcription tool someone tried out in a meeting, a browser extension, an AI feature in software you already had.
Give every tool a status. Four are enough: allowed, limited use, no decision yet, not allowed. What each one means is set out in our article on the four statuses for AI tools. What matters most is that every tool has exactly one, including the ones you have yet to look at.
Write the condition down. "Limited use" means nothing without the sentence that follows it. "No personal data" is a condition. "Internal meetings only, with the participants informed" is a condition. "Use with care" is not. Our article on what not to share with AI covers what may and may not go into a prompt, whatever the tool; the condition for each tool comes on top of that.
Bring the list to the work. A list in a PDF on the intranet gets read once, on someone's first day. The decision has to be visible when someone opens the tool, because that is when the question comes up. This is what a list looks like when it lives where the tools are used rather than in a document:
A few example decisions, with the tools deliberately left unnamed, because the decision varies from one organisation to the next.
Because a ban does not take the work away. Someone who has to summarise a forty-page report still has the report when the tool is off limits. So the work finds another way: a personal account, a personal phone, a tool nobody knows about. That is exactly the kind of use that falls out of sight and outside any data processing agreement, as our article on blocking AI without an alternative describes.
A list with alternatives works differently. "Not this one, use that one" is a decision people can follow without interrupting their work. But the approved alternative does have to be a real one: suited to the same kind of work, and roughly as easy to use. Replacing a chatbot with "ask a colleague" is not an alternative.
A study by KPMG and the University of Melbourne of 48,000 workers in 47 countries (2025) found that 58 per cent intentionally use AI at work and 57 per cent keep it hidden from their employer. A list that only bans things gives those 57 per cent no reason to come out into the open. A list that names an allowed alternative for each banned tool does.
#Is a free account different from a business account?
Yes, and this is the distinction most often missing from a list. A free or personal account runs on consumer terms: what you type can be used for training unless the user switches that off, there is no data processing agreement and the organisation cannot configure anything centrally. A business licence for the same tool excludes training by default and comes with a data processing agreement. OpenAI states that split explicitly for ChatGPT Business, Enterprise and the API, and the other major vendors draw the line in a similar place.
For your list, this means that "ChatGPT: allowed" is not a decision. "ChatGPT on the business licence: allowed; ChatGPT on a free account: not allowed, use the licence" is one. The difference between the two accounts is explained in free versus business AI accounts.
New AI tools appear every day, and existing software gains AI features without anyone taking a decision. So the list will never be complete. That is not a problem, as long as you know the status of a tool that is not on it yet.
That status is "No decision yet". It is neither a ban nor an approval, and it should be visible to anyone who opens the tool, with a request to enter only public information for the time being. What you still need is a short process for reaching a decision: who looks at the tool, how quickly and on what basis.
A municipality had allowed Copilot and considered the matter settled. An inventory showed Perplexity, ChatGPT and three specialist tools in use alongside it, two of which had not been recorded anywhere. That was not an incident. It showed how quickly a one-off list falls behind what people actually do, and that "No decision yet" is a status you need.
BeeSensible matches a catalogue of over 1,000 AI tools against the tools being opened in the organisation. An administrator can see which of them still have no decision and records the decision, with a condition or an alternative; the employee then sees that decision when they open the tool. The usage data contains no user ID and no content. The AI tools product page shows how that works in the product.
How to write those decisions into a policy people will actually read is covered in our guide to writing an AI policy. The other pieces on this subject are collected on the AI governance topic page.
The next time a colleague asks whether a tool is allowed, the answer is not "better not" but "check the list, and if it isn't on there, it has no decision yet". It is a more modest answer, and it keeps the use in view.
