A survey
Asks people which tools they use.
A snapshot of what people happen to remember that day.
Shadow AI software
Shadow AI software: see which AI tools people use on their own, and decide what fits.
Which AI tools do people use outside the policy? Shadow AI is AI that people have started using on their own: a service anyone can sign up for, that the organisation has not approved, and that was actually used in the last thirty days. Shadow AI software makes that use visible at organisation level, so you can decide for each tool what fits. BeeSensible does this from the browser, with only the tool's domain and no user ID. A catalogue of over 1,000 assessed AI tools helps with the decision.
Prefer to try it yourself? 14 days free, no credit card.
app.beesensible.eu/insights/compliance
AI tools in use
7
Newly discovered
2
The problem
You know people use AI. But which tools, and with what data?
People use AI because it makes their work easier. That is not disobedience. The problem is that the organisation does not know which tools, with which account, and whether sensitive data goes in.
The survey finds six tools, the browser forty
Questionnaires and invoices show what people remember and what was bought. Free accounts, AI features inside existing tools and browser extensions fall outside.
Blocking moves the problem
A blocked tool gets opened on a phone. People keep using it, you lose sight of it, and the sensitive file goes with it.
Tracking is not needed
To know which tools are in use, you do not need to know who uses them. Yet many tools build a profile per person, which is exactly what the GDPR and the works council want to avoid.
Features
Which features shadow AI software needs, and what BeeSensible covers.
From discovery to decision to seeing whether the decision sticks, and for each feature, whether BeeSensible covers it fully, partly or not at all.
| Feature | What it does | BeeSensible |
|---|---|---|
| Discovery | Notice that an AI service is opened, including one that did not exist yesterday. | Yes Known AI sites and pages that behave like a chatbot. Domain only, counted anonymously. |
| Inbox of new tools | Every tool used in the last 30 days that has no decision yet, in one list. | Yes One tool at a time, and nothing is pre-selected. Deciding on several tools at once is done in the catalogue. |
| Risk assessment | For each tool: what happens to input, where it is processed, under which law, and which incidents are known. | Yes A catalogue of over 1,000 tools, six weighted dimensions, bands from Low to Critical. |
| Policy compliance | The share of AI use that runs through allowed tools, with its trend. | Yes On the Compliance screen, with the card "Used, not allowed": tools that are not allowed but still used, and tools without a decision. |
| Notice when a tool is opened | Show the decision when someone opens the tool, with the allowed alternative. | Yes A notice in the browser. People can still continue, unless the organisation has chosen otherwise. |
| Network or proxy traffic | Intercept or reroute AI traffic at the network layer. | No No internet traffic goes through a proxy. BeeSensible works in the browser and in the desktop app. |
| Per-employee view | See who uses which tool and how often. | No Deliberately not. The usage figures carry no user ID. |
| Blocking | Technically cut off access to a tool. | Partly BeeSensible does not block on its own: a "not allowed" decision is shown, and the organisation chooses whether people can still continue after that. |
What it does not do
See how AI is used without tracking employees.
Shadow AI software is often confused with employee monitoring. This is where BeeSensible stops.
- No user ID and no content. The organisation sees which tools are in use and how often, never who or what someone typed.
- No automatic decision. Everything starts at "no decision yet"; the risk score is advice.
- No proxy and no rerouted traffic. BeeSensible works in the browser, and does not block on its own.
The approach
From hundreds of tools to a few decisions.
Shadow AI is not an incident you resolve but a stream you keep up with. This is what that looks like.
1 See
Everything that appears comes into view
Known AI tools and new services, counted anonymously. The inbox shows only what still lacks a decision.
2 Decide
A decision per tool
With the catalogue's risk assessment as advice you choose: allowed, limited use, not allowed, or decide later.
3 Help
The decision reaches the employee
Anyone who opens a tool the organisation has decided on sees that decision, with the alternative first. People can still continue, unless the organisation has chosen otherwise.
4 Substantiate
See whether it sticks
How much use goes through allowed tools, how often the alternative was chosen, and which tools keep growing.
and again How the cycle works
Why this approach
Why a survey or network monitoring does not give the whole picture.
Three common ways to get shadow AI into view, and what each one misses.
Network monitoring
Watches traffic to known AI domains.
Misses home working and AI features inside tools that are already allowed.
Employee monitoring
Records who uses what.
Collides with the GDPR and the works council, and is not needed for organisation-wide insight.
Frequently asked questions
What people ask before they choose.
What is shadow AI?
In short: AI that people use without the organisation having approved it. A tool that only works with a licence or SSO does not count, even if it is used.
How does BeeSensible discover an AI tool?
The browser extension notices when someone is on an AI tool: a known AI site, or a page that behaves like a chatbot. It reports only the domain, with no user ID, path or content, and only when the organisation has switched that measurement on.
Is shadow AI the same as unauthorised use?
No. Much shadow AI is use of tools the organisation has not decided about yet. That is an honest status, not a violation. Only once the organisation chooses "not allowed" does use of that tool deviate from policy.
Could the works council object?
A works council has a say over facilities suited to monitoring employees. BeeSensible is designed not to be one: no user ID in the usage figures, no content, no drill-down per person. Put that design to the works council. The documentation describes what is and is not processed.
What happens when someone opens a tool that is not allowed?
That person sees a notice in the browser with the organisation's decision and the allowed alternative first. They can still continue, unless the organisation has chosen otherwise. How often that happens is counted in the figures, without names.
Further reading
More on shadow AI, from how it arises to what to do.
See which AI tools are running outside your policy, within a day.
Every module is included. After two weeks you know which tools are in use, which are new and which still lack a decision.
14 days free, no credit card. Rolled out across your organisation within an hour.
