Catalog and risk
What the catalog tells you about over 1,000 AI tools: the facts, a risk score over six dimensions and an indication under the EU AI Act.
The catalog is the All tools view under the AI register: every AI tool BeeSensible knows, with what is known about it and an estimate of its risk. It is an information source. What you decide and record about a tool lives in the AI register, your own file.
The number: over 1,000 tools, each assessed for risk. A new tool in the catalog always starts at No decision yet for you.
All tools in the dashboardThe catalog, under AI register in the menu; also where you add your own tool.Search and filter
Search covers tool, vendor, domain or former name; one typo is forgiven. Four quick filters carry a count: All, In use without a decision (self-serve tools used in your organisation without a yes from you), With activity (everything seen in your organisation, with a second selector per decision) and New (added to the catalog in the last 30 days). The Filters button offers Risk level, Sector, Category, Vendor country, Tag, Certification and Access.
The list opens on visits in your organisation, highest first; every column header sorts. Lookalikes, wrappers and discontinued tools are left out by default unless you use them or decided on them; Also show lookalikes, wrappers and discontinued tools brings them in. Search always covers everything.
A row carries a label when needed: New for a tool BeeSensible just added (with a dismissible note at the top saying how many), Own for a tool of yours, and "edited" next to a decision that differs from the catalog.
Tick rows (shift-click for a range, or Select all) and a bar appears at the bottom with the four decisions for the whole selection. Allow with limits asks for the condition first.
What a tool is
Click a row for the analysis. The Overview tab opens with the use in your organisation (visits in 30 days, or "Use of this tool is not visible" when the extension recognises no web address for it) and the Properties: Vendor (with the group it belongs to), Trains on input (Yes, No, Unknown, Opt-in or Opt-out), Data residency, Retention, Integration, DPA available, Certifications, Underlying model, Access and Also known as.
Under What is this? sits the product kind: Original (own brand, identifiable vendor), Wrapper (gives access to someone else's model under its own name), Lookalike (carries the name of a well-known product, but is not from that vendor) or Not yet established. A tool that no longer exists stays in the catalog with a status: Unreachable, Discontinued (earlier use and decisions stay) or Merged ("Merged into …"). A decision about one product is not a decision about another; after a merge you take it again.
Variants of this product puts the same product in its different plans side by side, such as ChatGPT and ChatGPT Business. Risk and decision apply per variant; the free tier points to the business one.
The risk score
The Risk & compliance tab shows the band with its score and, under Why this assessment, the reasons. The Risk breakdown scores six dimensions, each from 1 to 5 (higher is more risk), and weights them:
| Dimension | Weight | What it measures |
|---|---|---|
| Data governance | 6 | Whether the vendor trains on your input, offers a DPA and where data is stored |
| Jurisdiction | 4 | Where the vendor and the data are; state access and the lack of an adequacy decision weigh more |
| Compliance | 3 | Alignment with the GDPR and the EU AI Act, plus certifications |
| Incidents | 3 | Documented breaches or misuse involving the tool |
| Integration scope | 2 | How much access the tool asks for, from a standalone chat box to connectors into your systems |
| Vendor trust | 2 | Transparency about ownership and model, track record and maturity |
The sum runs to 100 and falls into a band: Low below 40, Medium 40 to 59, High 60 to 79, Critical from 80. Every assessment carries the label "BeeSensible's estimate, not a legal judgement", the date it was reviewed and how well it is backed: verified with the vendor, partly verified, inferred from public sources or based on comparable tools. Incidents are listed with a source; where it is missing, the row says "source missing".
The band informs, it does not decide. There is no default policy per band; what a band means for you, you decide per tool.
The EU AI Act
A separate EU AI Act card gives an indication per tool: High risk (with the Annex III category it may fall under), Limited risk (a transparency duty), Minimal risk, Depends on use or Not classifiable. The card carries the reservation "Not legal advice; based on the vendor's documented intended use". The classification is about the tool; which duties apply to you depends on your use cases, and that assessment is yours.
Alternatives and usage
The Alternatives tab shows Allowed alternatives: tools with the same function that you allow, lowest risk first. With Add an alternative you pin the one you prefer; it shows as Pinned at the top and is the tool the notice points to when someone opens a tool that is not allowed.
When the tool has visits, Usage shows the visits over time and what it is used for, with the same headline figures as on the tool page; see Usage.
Adding your own tool
Add your own tool puts a tool of yours next to the catalog, for example your own environment such as "Veilig werken met AI". You fill in the same properties; the risk level you pick yourself or have computed from the six dimensions. The tool appears with the badge Own, in your catalog only, and can be picked as an alternative.
How the catalog is kept
The catalog is continuously curated. A domain the extension sees at an organisation that is not in the catalog yet lands in a central review queue; there it is linked to an existing tool, added as a new tool with the full fact sheet, or rejected. While that runs, the tool sits in your Inbox as Not assessed yet, and you can decide already. What was in the catalog is never deleted; it gets a status.
Every change to a catalog entry is recorded: what changed, when and by which route. That is the catalog's history. Your own decisions about a tool are in the history on its tool page in the register.
