A survey
Asks people which tools they use.
Gives a snapshot of what people remember and dare to say.
Shadow AI software
Shadow AI software: see which AI tools people use, without tracking people.
Shadow AI is AI that people started using on their own: a service anyone can start, that the organisation has not approved, and that was actually used in the last thirty days. Shadow AI software makes that use visible at organisation level, so you can decide per tool what fits. BeeSensible does this from the browser, with only the tool's domain, without a user id, and with a catalogue of 865 assessed AI tools to base the decision on.
app.beesensible.eu/shadow-ai/risk
AI tools in use
7
Newly discovered
2
The problem
Everyone knows it happens. Nobody knows exactly what.
People use AI because it makes their work easier. That is not disobedience. The problem is that the organisation does not know which tools, with which account, and whether sensitive data goes in.
The survey finds six tools, the browser forty
Questionnaires and invoices show what people remember and what was bought. Free accounts, AI features inside existing tools and browser extensions fall outside.
Blocking moves the problem
A blocked tool is opened on the phone. The use continues, the view is gone, and the sensitive file goes along.
Tracking is not allowed, and not needed
To know which tools are in use you do not need to know who uses them. Yet many tools build a file per person, which is exactly what the GDPR and the works council do not want.
Features
What to expect from shadow AI software.
From discovery to decision to seeing whether the decision lands. With what BeeSensible does fully, partly and not at all.
| Feature | What it does | BeeSensible |
|---|---|---|
| Discovery | Notice that an AI service is opened, including one that did not exist yesterday. | Yes Known AI sites and pages that behave like a chatbot. Domain only, once a day per device. |
| Inbox of new tools | Only the newly discovered tools that still need a decision, in one list. | Yes Bulk decisions are possible; nothing is pre-selected. |
| Risk assessment | Per tool: what happens with input, where it is processed, under which law, and which incidents are known. | Yes A catalogue of 865 tools, six weighted dimensions, bands from Low to Critical. |
| Policy compliance | The share of AI use that runs through allowed tools, with its trend. | Yes Plus the "requires action" list: not-allowed tools still in use, fast growers, tools without a decision. |
| Notice at the moment of work | Show the decision when someone opens the tool, with the allowed alternative. | Yes Calm, in the browser, with the option to continue. |
| Network or proxy traffic | Intercept or reroute AI traffic at the network layer. | No No internet traffic goes through a proxy. BeeSensible works in the browser and on the device. |
| Per-employee view | See who uses which tool and how often. | No Deliberately not. The usage streams carry no user id. |
| Blocking | Technically cut off access to a tool. | No Deliberately not. A "not allowed" decision is shown, not enforced. |
What it does not do
A view of the use, not surveillance of people.
Shadow AI software is often confused with employee monitoring. This is where BeeSensible stops.
- No user id in the figures on AI use. The organisation sees "three people use AI daily", never who.
- No content. No prompts, no page titles, no paths. Only the tool's domain.
- No blocking and no rerouting of traffic.
- No automatic decision based on a risk score. Everything starts at "no decision yet".
- No reporting per team below the threshold of five people and seven days.
The approach
From hundreds of tools to a handful of decisions.
Shadow AI is not an incident you resolve but a stream you keep up with. This is what that looks like in practice.
1 See
Everything that appears comes into view
Known AI tools and new services, counted anonymously. The inbox shows only what still lacks a decision.
2 Decide
A status per tool
With the catalogue's risk assessment as advice you choose: allowed, limited use, not allowed, or decide later.
3 Help
The decision reaches the employee
Whoever opens a tool with a decision behind it sees that decision with the alternative first. Continuing is possible.
4 Substantiate
See whether it lands
How much use goes through allowed tools, how often the alternative was chosen, and which tools keep growing.
and again How the cycle works
Why this approach
The alternatives, and what they miss.
Every organisation has already tried one of these four.
Network monitoring
Watches traffic to known AI domains.
Misses home working, phones and AI features inside tools that are already allowed.
Blocking
Shuts the known tools.
Moves the use and makes it invisible.
Employee monitoring
Records who uses what.
Collides with the GDPR and the works council, and is not needed for organisation-wide insight.
Frequently asked questions
What people ask before they choose.
What is shadow AI?
AI that people started using on their own initiative: a service anyone can start, that the organisation has not approved, and that was actually used in the last thirty days. A tool that only works with a licence or SSO is not shadow AI, even if it is used.
How does BeeSensible discover an AI tool?
The browser extension notices when someone is on an AI tool: a known AI site, or a page that behaves like a chatbot. It reports only the domain, at most once a day per device, with no user id, path or content. That only happens when the organisation's AI module and analytics setting are on.
Is shadow AI the same as unauthorised use?
No. Much shadow AI is use of tools the organisation has not decided about yet. That is an honest status, not a violation. Only once the organisation chooses "not allowed" does use of that tool become a deviation from policy.
Could the works council object?
A works council has a say over facilities suited to monitoring employees. BeeSensible is designed not to be one: no user id in the usage streams, no content, no drill-down per person. Put that design to the works council; the documentation describes exactly what is and is not processed.
What happens when someone opens a tool that is not allowed?
That person sees a calm notice in the browser with the organisation's decision and the allowed alternative first. Continuing is possible. How often that happens counts in the figures, without who.
Further reading
The shadow AI cluster.
See within a day which AI tools run next to your policy.
Fourteen days free, every module, no credit card. After two weeks you know which tools there are, which are new, and which still lack a decision.
14 days free, no credit card. Rolled out across your organisation within the hour.
