The AI register: decision and status
Allowing is registering. The four decisions, where you make them, what the register holds afterwards and what a tool page shows.
Allow an AI tool, with or without limits, and it is in the AI register from that moment on. The register is your organisation's own file: per tool the decision, what you use it for, who is responsible, which documents belong to it, which detection profile applies, when the next review is due and what has changed since. The catalog (the All tools view) is what BeeSensible knows about a tool; the register is what you decided and recorded about it.
AI register in the dashboardAt the top of the menu, with the Inbox right below it while tools are waiting for a decision.The four decisions
Every tool starts at No decision yet. BeeSensible never decides for you and never pre-selects a button; the risk band and the catalog facts are information, the decision belongs to the organisation.
| Decision | What it means |
|---|---|
| Allowed | People can use the tool. They see no notice. |
| Limited use | Allowed within a condition you write yourself, such as "General questions are fine, no personal or customer data." Employees see that sentence when they open the tool. A few common wordings are ready to pick; short and concrete works best. |
| Not allowed | You would rather people use something else. Anyone opening the tool sees a notice with the designated alternative. |
| No decision yet | The organisation has not decided. A tool in use without a decision sits in the Inbox. |
Under review is not a fifth decision. It parks one: Decide later takes the tool out of the Inbox without recording anything, and it waits in the Under review view until you decide.
Where you decide
The same decision is available in three places, with the same buttons: Allow, Allow with limits, Disallow and Decide later.
- In the Inbox, one tool at a time.
- In the catalog, the All tools view, per tool or for a selection at once.
- On the tool page, in the Decision card. That is where you change a decision in the status itself, with Change.
After a decision the dashboard shows "Decision recorded" with Undo, which puts things back the way they were. A registration the decision created, and nobody has completed yet, leaves the register again; a completed registration stays.
Each decision records who made it and when. In the Decision card you can add a Reason: internal, why the organisation decided this. It goes into the history. For a decision that predates the register the card reads "Decider not recorded".
The views
The register is one list with four views, each at its own address:
| View | What it holds |
|---|---|
Allowed (/register) | Every tool that is allowed or allowed with limits, with its registration. |
Under review (/register/under-review) | Tools you have yet to decide on; they wait here, not in the Inbox. |
Not allowed (/register/not-allowed) | Tools you do not allow, with the visits of the last 30 days, when the decision was made and the designated alternative. |
All tools (/catalog) | The BeeSensible catalog, see Catalog and risk. |
Columns and filters
The Allowed view shows per tool the columns Tool, Status (In use, Under review or Retired), Use cases, Detection profile, Responsible and Reassessment. Above the list: search, Export (CSV) and Add a tool.
| Filter | What you see |
|---|---|
| In use | Tools you currently use. |
| To complete | Registrations without a use case or without a responsible person. |
| Due for reassessment | Tools whose review is overdue or coming up. |
| Documents open | Tools where the processing agreement or the DPIA is not arranged yet. |
| Out of use | Tools with an end date. |
| Needs attention | Everything from the four filters above together, with the reason per tool: Review overdue, Review due soon, Use case missing, Owner missing, Processing agreement open or DPIA open. |
Home shows the same counts under "To do in AI Governance".
Completing a registration
Allowing creates the registration but does not fill it in. After the decision a notice reads "{tool} is allowed and in the AI register", with the button Complete the registration. You are already listed as responsible and the first reassessment is in a year.
- Use cases: what do you use this tool for? Choose the use cases, or adopt what BeeSensible already saw. See Use cases.
- Responsible people: who is responsible? You are already listed; add anyone else who belongs here.
- Documents: which documents belong to it? Record what exists; the rest can follow later. See Responsible people and documents.
You can finish after any step; the registration then shows under To complete until it has at least one use case and one responsible person.
In use and out of use
A tool's state in the register is separate from its decision. A tool you no longer use goes to Retired with Take out of use: it gets an end date and the history is kept. A tool never leaves the register. Take back into use reverses it. A retired tool gets no more reassessment reminders; if people still visit it, the Measured tab says so.
The tool page
Every tool with a decision has its own page (/register/tool?website=...), including a tool that is not, or no longer, in the register. Five tabs; a tool without a registration has four (no Use cases):
| Tab | What it shows |
|---|---|
| Overview | The Decision card (decision, who decided and when, reason, condition, designated alternative, risk), the state, and as cards: use cases in brief, Responsible (who is in charge, with a role), Documents (processing agreement, DPIA and other documents, with status, date and link), Review, and "About the tool": vendor, country, kind of tool, processing agreement from the vendor, hosting and region, trains on input, certifications and the EU AI Act classification, from the catalog and not editable here. |
| Policy | What the employee sees on opening, the detection profile that applies, and whether masking in this tool deviates from the organisation. See Policy per tool. |
| Use cases | What you use the tool for, with departments and whether personal data is processed. |
| Measured | What BeeSensible saw of the tool, next to what you recorded. |
| History | Every change, with who and when. |
Measured: recorded next to seen
The Measured tab puts what BeeSensible saw of the tool in the last 30 days next to what you recorded. When they match it reads "No signals: what you recorded matches what BeeSensible sees." When they differ, each signal shows what was recorded, what was seen and a button to the part where you update it.
| Signal | When it appears |
|---|---|
| "{use case} occurs, but is not recorded" | BeeSensible measures a kind of use that is not recorded as a use case. |
| "{use case} is recorded, but does not occur" | A measured use case is recorded but was not seen in the period. |
| "Personal data is being found" | No use case says personal data is processed, or no use cases are recorded yet. |
| "Personal data found, DPIA not settled" | Personal data is found and the DPIA is still open. |
| "Critical data sent without change" | Data marked as critical in your detection profile was sent without the employee changing it. For standard data the signal reads "Sensitive data sent without change". |
| "Retired, but still visited" | A tool with an end date is still being used. |
Below the signals come the facts: usage (visits), what for (the measured kinds of use next to your use cases), what was detected in prompts and in documents anonymised for this tool, and what happened to it: changed before sending, not changed and not sent, or sent without change. All of it in counts, never who or what was typed. For a tool BeeSensible does not help in, the tab reads "BeeSensible does not help in this tool, so there is no data about what was entered." Usage figures appear from 5 active users.
History
The History tab is a table with Date, Who, What, From and To. It holds every change to the decision, the condition, the preferred alternative and the reason, and to the registration: responsible people, use cases, documents, detection profile, out of use, the completed reassessment with its note, and any deviation from the masking policy for this tool. What BeeSensible did on its own, such as creating the registration when a tool was allowed, is listed under "system".
When you look at demo data, the register says so above the list, and nothing is saved. The register exports as CSV and as a PDF; see The register as PDF and CSV. The review is described in Review.
