Letting AI in
Explaining advice, summarising files, lifting the quality of correspondence: exactly the work where AI wins time and can raise the standard.
AI governance for financial services
You answer for your AI use. Including outside the approved environment.
See which AI tools are actually in use across your organisation and decide per tool what fits. Help advisers and handlers when client data goes into a prompt, and show that those agreements are followed.
14 days free, no credit card. Rolled out across your organisation within the hour.
"Awareness fades when you're busy. That's why we use BeeSensible." Debby Elfrink, Operations director, Speck Pompen
Your organisation 
Microsoft 365 Copilot Allowed 
ChatGPT Limited use 
Perplexity
Microsoft 365 Copilot Allowed ChatGPT Limited use Perplexity Akur8 Allowed
Cytora
Gradient AI
Indico Data
Sixfold No decision yet
EvolutionIQ
Customer name Policy details Bank account number National identifier Claim file
Your organisation Microsoft 365 Copilot Allowed Akur8 Allowed Cytora Indico Data
Customer name
Policy details
Bank account number
National identifier
Claim file
Plus everything else that is running
Microsoft 365 Copilot Allowed Akur8 Allowed Cytora Indico Data No prompts stored. No per-employee view. Everything processed inside the EU.
What this is about
Client data is the work here. Not a by-product.
A mortgage adviser has an advice note made clearer. A claims handler asks a chatbot to summarise a file. Someone on the service desk pastes a complaint into an AI tool to turn it into a proper letter.
In this sector almost every piece of text holds something you would not share lightly: incomes, national identifiers, account numbers, policy details, medical information in a disability claim. So the question moves from whether AI is allowed to which AI, with what data, and whether you can show it.
Meeting your duty of care
You answer for how client information is handled and for the quality of your advice. A vendor reading along somewhere in the chain is a risk you carry yourself.
Being demonstrably in control
Supervisors ask for control that works, not only for policy. What happens in an input field appears in no process description.
Policy and practice
Policy gets written once. Usage changes every month.
Organisations have an AI policy, an approved environment and usually a training. What is missing is sight of the tools that quietly arrive, and someone beside the adviser when a client file goes into an AI tool.
BeeSensible makes that connection, in four steps that keep coming back around.
01 See 02 Decide 03 Help 04 Substantiate
01See
Know what your organisation has picked up along the way.
Not only the applications IT holds a licence for. BeeSensible sees when AI tools are opened and shows, at organisation level, which ones appear and how usage develops, without reading prompts and without building a file on anyone.
- Which tools are in use, and by how many people?
- Which ones surfaced for the first time this month?
- What share of the usage runs through what you approved?
AI adoption
68%
81 of 120 seats AI-active this month
Prompts sent
1,596
22% vs previous 30 days
AI tools in use
7
2 newly discovered this period
Safe adoption
71%
of AI use via allowed tools
How often AI is used
Daily3428%Weekly3025%Occasionally1714%Not active3933%
Computed on-device and reported as anonymous counts, never per person.
What AI is used for
Analysis & knowledge354
Summarizing353
Writing communication258
Detections over timeLast 30 days
12,438+18% vs the previous period
Detections by platform
78% adjusted
8,124
81% adjusted
3,210
74% adjusted
812
Most encountered data types
4,212
2,930
1,486
1,104
612
SensitiveHighly sensitive
An impression of the AI tools catalogue. The tools and their risk scores come from the product's own catalogue; the verdict in the last column is your organisation's to set.
The catalog
865 AI tools assessed for risk, and more arrive every week
You should not have to research a tool before you can decide about it.
Before you can decide anything about a tool, you need to know what it does with your data: where the vendor sits, whether it trains on what you type, whether incidents are known. We worked that out for 865 tools, and more arrive every week. What is left is the question only you can answer: is this allowed here, and under what condition?
The GDPR asks for a record of processing, NIS2 for a view of your suppliers, and the EU AI Act for demonstrable AI literacy. Because every observed tool is recorded with its vendor, hosting region and training policy, and carries a decision from your organisation, you can answer at any moment.
See the catalog-
Which tools are in use, and for what
Every observed tool is in the register, with vendor, country, hosting region, training policy and the kind of work it is used for.
-
Which of them fit your policy
One decision per tool: allowed, limited use, not allowed, or no decision yet. Nothing is silently approved; the decision is always yours.
-
What you do to uphold that policy
Anyone opening a tool you have decided something about sees it at that moment, right in the page. That the notice appeared is counted, without content and without a name, so you can show the mechanism actually reached people.
The overview does not establish that you comply with the law. It shows which measures you can substantiate with measurements, and which you cannot. The judgement stays with you.
02Decide
A writing assistant is not an underwriting model.
A tool that rewrites a letter calls for a different judgement than one that helps decide on acceptance or a claim. Per tool you see the vendor, the country, the data processing agreement, certifications, documented incidents, a risk score across six dimensions and a separate reading under the EU AI Act.
That reading matters more than average here: applications touching creditworthiness and risk assessment of people can fall more heavily under the regulation. We supply the facts, you record the decision.
- Allowed
- Fits our boundaries, including with client data.
- Limited use
- Fine for text and explanation. Do not enter client or file data.
- No decision yet
- Newly surfaced, not yet assessed.
- Not allowed
- With an approved alternative alongside it, where one exists.
03Help More about document anonymisation
An adviser should not have to know the policy by heart.
When someone opens a tool you have decided about, they see that decision with the reason behind it, and the alternative that does fit. When they type into a supported application, names, national identifiers, IBANs, amounts and policy details get marked as they write.
Masking or removing takes one click. BeeSensible does not block and changes nothing by itself.
BeeSensible notice
No decision yet No decision yet on EvolutionIQ
Your organisation has not made a decision on this tool yet. Do not share personal data or confidential business information here.
Use instead
Open Akur8Also allowed: Cytora ·Microsoft 365 Copilot
Continue anyway
Only enter public information here
BeeSensible notice
Not allowed EvolutionIQ is not allowed here
Your organisation does not allow this tool for work. Use an allowed alternative.
Use instead
Open Akur8Also allowed: Cytora ·Microsoft 365 Copilot
Hold to continue anyway
BeeSensible notice
Limited use EvolutionIQ is allowed here, with limits
Your organisation allows this tool with limits. Only use it with anonymised data.
Use instead
Open Akur8Also allowed: Cytora ·Microsoft 365 Copilot
Hold to continue anyway
GeminiDefault1 / 3Draw box
Advice report - mortgage
Applicant Nadia Willemsen, born 29 September 1988, national ID 206481937, living at Rozenstraat 8 in Deventer.
Gross annual income 58,400 euro. Repayment runs from NL91 ABNA 0417 1643 00. Contact via [email protected].
9 items will be removedPreviewAnonymise (9)
04Substantiate
Control you can show, not only describe.
How often was a marking acted on? How often did someone take the approved environment? What share of AI usage now runs through tools you said yes to? And which kinds of sensitive data still keep turning up?
Those figures exist to back up your measures and steer where it matters. At organisation level, never per employee, and without a single prompt having been kept.
Warnings about tools
Shown the moment someone opens a tool you have not decided on, or have limited or disallowed. About the tool itself, not about what gets typed into it.
148
warnings shown
61%
chose an alternative
Not allowed52 times
38 alternative9 held through
Limited use44 times
21 alternative15 held through
No decision yet52 times
31 alternative14 clicked through
alternative openedcontinued anyway
Browser use only. Counted at most once per tool per day. Group figures only, never who.
Sent despite warning
1,120
Detected, not adjusted, and still sent.
Critical sent despite warning
214
14% of critical detections
OutcomesLast 30 days
9,702
adjusted before sending
78% of 12,438 detections
Masked7,428(60%)
Removed2,274(18%)
Sent despite warning1,120(9%)
No action recorded1,616(13%)
Accountability GDPRNIS2
- Substantiated
Data minimisation at input
Sensitive data marked and handled before sending
- Substantiated
Register of AI services
Vendor, classification, and a decision per tool
- Partial
Appropriate technical measures
Detection active on the supported applications, handling still below the norm
- Not substantiated
Personal data breach notification
BeeSensible provides the signal, not a reporting process to the regulator
A Tuesday at the office
Risk rarely looks like risk.
09:25
Mortgage advice
An adviser has AI make a note clearer. Income, national ID and account number are still in the pasted text.
11:50
Claims
A file goes into a chatbot with its context for a summary. Medical information travels along that nobody deliberately shared.
14:10
Client contact
A complaint is turned into a proper letter with AI, policy number and full address included.
16:35
Back office
Someone tries a new document recognition tool a colleague was enthusiastic about. The vendor has not been assessed.
Nobody here is dodging the policy. They are helping a client. That is why help while the work happens beats one more instruction.
The rules you already sit inside
Fits obligations that already apply.
GDPR
Financial data, and sometimes more
Incomes, national identifiers and account numbers are personal data; in disability or claims work health information comes with it, under a heavier regime. Regulators note that users enter that data themselves while using generative AI.
BeeSensible marks that data before it is shared and gives aggregate insight into what happened afterwards.
EU AI Act
Not every application weighs the same
Applications touching creditworthiness and risk assessment of people can fall more heavily under the regulation than a writing assistant. The catalogue holds an EU AI Act reading per tool, separate from our own risk score.
A current register of the AI services in use is the start of that. Classifying your own applications stays your work.
Control
Demonstrable, not only described
Supervisors and internal audit ask for measures that work, and for evidence. In the Netherlands the Cybersecurity Act has applied since 15 August 2026 to organisations in scope.
BeeSensible supplies figures on actual AI usage and on what happens after a marking. The risk analysis and the judgement stay with the organisation.
The question that always comes
Getting a grip without building a second risk file.
“So to know what my people do with client data, you are going to keep their prompts?”
No.
A central database of prompts from this sector is not a solution but a new risk: client data, incomes and sometimes health information in one place. That is why the product is built so the content never settles anywhere.
The full story in the Trust Center- Detection runs on our own servers at European providers, in working memory, and the text is discarded straight after.
- No external AI service is involved: nothing goes to ChatGPT, Google, or any other party.
- Prompts do not reach the dashboard. Not shortened, not as an example.
- The usage data holds no user id. What an individual colleague did cannot be reconstructed afterwards.
- Reporting is counts and patterns, never a per-employee view.
How it is put together
One process, four parts.
The first three can be bought on their own, so you can start with one.
Before you look further
The questions people ask first.
Does BeeSensible read along with what our advisers type?
No. The text is checked to mark sensitive data, and then not kept. It goes to our own servers at European providers, is checked in working memory and discarded straight after. No external AI service is involved.
Can administrators see which colleague got a marking?
No. For markings, documents and notices, who it was is not recorded, so it cannot be looked up afterwards either. The dashboard has no per-employee view of any kind. At most the department is stored, and only if you switch those insights on, with a minimum group size.
Does BeeSensible block AI tools?
Never. It also never changes what someone wrote by itself. Your colleague sees what was found and what your organisation decided about that tool, and chooses. If something was sent anyway despite a marking, that gets counted, without content and without a name.
Does BeeSensible assess our own models?
No. The catalogue covers third-party AI services your people use. An underwriting model you had built falls outside it: that is your AI system, with your classification and your validation.
Can we record our own condition per tool?
Yes. A verdict carries the note your colleague sees the moment they open it. So a tool that is fine but not with client data says exactly that.
Where does BeeSensible run?
On our own servers at European providers: the application and the database at Scaleway in Amsterdam, the models at Hetzner in Germany. European companies rather than a European region of an American cloud, so there is no US parent that can be ordered to hand data over. The text is checked there in working memory and discarded straight after. What reaches the dashboard are counts and attributes, never content.
How much work is the rollout?
Not much. No proxy, no change to your network. The extension runs in Chrome and Edge and deploys centrally through Intune; the desktop app installs silently in the background. With a managed rollout your organisation is up inside an hour.
Does detection recognise European financial data?
Yes. The engine works in Dutch and English and recognises IBANs, VAT and company numbers, national identifiers, amounts, salaries and policy numbers among others. Which of those get marked, and how heavily, you set per profile.
Start by seeing
Give AI room. Keep sight of what goes into it.
Within two weeks you can see which AI tools are in use across your organisation, and build from there: decide, help, substantiate.
14 days free, no credit card. Rolled out across your organisation within the hour.
