The pressure is real
Note-taking, summarising, looking things up, correspondence. Exactly the work where AI saves time, and exactly the work that eats the day. A ban does not solve that; it moves it to devices you cannot see.
Responsible AI use in care
You want to give AI room. Not lose the thread.
See which AI tools are actually in use and decide which applications fit your organisation. Help clinicians work carefully while they are busy, and then see whether those agreements hold up in practice.
14 days free, no credit card. Rolled out across your organisation within the hour.
"Awareness fades when you're busy. That's why we use BeeSensible." Debby Elfrink, Operations director, Speck Pompen
Your care organisation 
Microsoft 365 Copilot Allowed 
ChatGPT Limited use 
Perplexity
Microsoft 365 Copilot Allowed ChatGPT Limited use Perplexity Autoscriber Allowed
Noteless
Attendi
Nabla
Heidi Health
Abridge No decision yet
Patient name Treatment plan Patient identifier Medication list Referral letter
Your care organisation Microsoft 365 Copilot Allowed Abridge No decision yet Noteless Nabla
Patient name
Treatment plan
Patient identifier
Medication list
Referral letter
Plus everything else that is running
Microsoft 365 Copilot Allowed Abridge No decision yet Noteless Nabla No prompts in the dashboard. No per-employee view. Everything processed inside the EU.
What this is about
AI reaches the floor faster than policy can follow it.
A doctor has Copilot tighten a letter. A nurse tries ChatGPT for a handover. A clinician hears from a colleague about a new tool for note-taking. The secretariat uses AI for patient correspondence.
None of that happens because people want to be careless. AI solves real problems in a sector under real pressure. In a Dutch survey of 890 healthcare professionals, slightly more than half were using AI at work by the end of 2025; among nurse practitioners it was more than eight in ten. Two thirds felt insufficiently prepared for it.
So the question shifts. Not: is AI allowed here? But: how do you give thousands of professionals room to use AI without losing sight of which applications are becoming part of care itself?
The provider carries the responsibility
Care providers who put generative AI into care delivery are responsible for careful implementation and careful use alike. The Dutch health inspectorate expects that attention before purchase, during rollout and after go-live.
You can only steer on what you see
You can approve one tool and advise against another. Whether that happens in practice, whether something else is used alongside it, and whether the safe alternative actually gets chosen appears in no policy document.
From approving to steering
You can approve AI. That still does not tell you how it is used.
Say Copilot is approved, people have been informed, and ChatGPT may not carry patient information. On paper that is clear. Then the questions start. Is Copilot actually used? Is ChatGPT quietly used alongside it? Which new applications are appearing? Do people know why something is or is not allowed? And is the safe alternative chosen when it counts?
Policy has no answer to those. These four steps do.
01 See 02 Decide 03 Help 04 Substantiate
01See
First know what is running.
BeeSensible sees when AI tools are opened and shows, at organisation level, which applications turn up inside your walls and how that usage develops. Not who asked what: which tools exist, how often they are used, and which ones are new.
That makes BeeSensible less a monitor on your people and more a sensor for technological change in your organisation.
- Which applications appear, and where is usage growing?
- Which tool was used for the first time this week?
- What share of AI usage runs through what you approved?
AI adoption
68%
81 of 120 seats AI-active this month
Prompts sent
1,596
22% vs previous 30 days
AI tools in use
7
2 newly discovered this period
Safe adoption
71%
of AI use via allowed tools
How often AI is used
Daily3428%Weekly3025%Occasionally1714%Not active3933%
Computed on-device and reported as anonymous counts, never per person.
What AI is used for
Analysis & knowledge354
Summarizing353
Writing communication258
Detections over timeLast 30 days
12,438+18% vs the previous period
Detections by platform
78% adjusted
8,124
81% adjusted
3,210
74% adjusted
812
Most encountered data types
4,212
2,930
1,486
1,104
612
SensitiveHighly sensitive
An impression of the AI tools catalogue. The tools and their risk scores come from the product's own catalogue; the verdict in the last column is your organisation's to set.
The catalog
865 AI tools assessed for risk, and more arrive every week
You should not have to research a tool before you can decide about it.
Before you can decide anything about a tool, you need to know what it does with your data: where the vendor sits, whether it trains on what you type, whether incidents are known. We worked that out for 865 tools, and more arrive every week. What is left is the question only you can answer: is this allowed here, and under what condition?
The GDPR asks for a record of processing, NIS2 for a view of your suppliers, and the EU AI Act for demonstrable AI literacy. Because every observed tool is recorded with its vendor, hosting region and training policy, and carries a decision from your organisation, you can answer at any moment.
See the catalog-
Which tools are in use, and for what
Every observed tool is in the register, with vendor, country, hosting region, training policy and the kind of work it is used for.
-
Which of them fit your policy
One decision per tool: allowed, limited use, not allowed, or no decision yet. Nothing is silently approved; the decision is always yours.
-
What you do to uphold that policy
Anyone opening a tool you have decided something about sees it at that moment, right in the page. That the notice appeared is counted, without content and without a name, so you can show the mechanism actually reached people.
The overview does not establish that you comply with the law. It shows which measures you can substantiate with measurements, and which you cannot. The judgement stays with you.
02Decide
Not every AI application calls for the same policy.
Rewriting a public text is not the same as summarising a patient record. And an application bought deliberately for clinical note-taking is different again from a general chatbot. Per tool you see the vendor, the country, the data processing agreement, certifications, documented incidents, a risk score across six dimensions and a separate reading under the EU AI Act.
The judgement about purpose, suitability and risk stays with the organisation. BeeSensible does not sit above that but beside it: we supply the facts, you record the decision.
- Allowed
- Fits our boundaries, including inside the care process.
- Limited use
- Fine for general text support. Do not enter patient information.
- No decision yet
- Newly found, not yet assessed.
- Not allowed
- With an approved alternative alongside it, where one exists.
03Help More about document anonymisation
A clinician should not have to know the policy by heart.
When someone opens a tool you have decided about, they see that decision with the reason behind it, and the alternative that does fit. When they type into a supported application, sensitive data is marked as they write: a name, a national ID, a diagnosis, a medication.
Masking or removing takes one click. BeeSensible does not block and changes nothing by itself. That is how your policy moves from somewhere on the intranet to the moment it matters.
BeeSensible notice
No decision yet No decision yet on Heidi Health
Your organisation has not made a decision on this tool yet. Do not share personal data or confidential business information here.
Use instead
Open AutoscriberAlso allowed: Attendi ·Noteless
Continue anyway
Only enter public information here
BeeSensible notice
Not allowed Heidi Health is not allowed here
Your organisation does not allow this tool for work. Use an allowed alternative.
Use instead
Open AutoscriberAlso allowed: Attendi ·Noteless
Hold to continue anyway
BeeSensible notice
Limited use Heidi Health is allowed here, with limits
Your organisation allows this tool with limits. Only use it with anonymised data.
Use instead
Open AutoscriberAlso allowed: Attendi ·Noteless
Hold to continue anyway
GeminiDefault1 / 3Draw box
Referral letter - cardiology
Dear colleague, I am referring Mohammed El Idrissi, born 11 March 1992, national ID 184629375, to your clinic at St. Catherine's Hospital.
Known with type 2 diabetes mellitus and hypertension. Takes metformin 850 mg twice daily.
9 items will be removedPreviewAnonymise (9)
04Substantiate
See where policy works, and where practice says otherwise.
Say ChatGPT is on limited use. Three months in, usage of the approved alternative is climbing and notices about tools that are not allowed are mostly acted on. But one ward keeps producing markings for sensitive data.
Now you have something to act on. Perhaps the instruction is unclear. Perhaps the alternative is impractical. Perhaps that workflow needs something the policy never anticipated. That is how substantiating leads back to seeing.
Warnings about tools
Shown the moment someone opens a tool you have not decided on, or have limited or disallowed. About the tool itself, not about what gets typed into it.
148
warnings shown
61%
chose an alternative
Not allowed52 times
38 alternative9 held through
Limited use44 times
21 alternative15 held through
No decision yet52 times
31 alternative14 clicked through
alternative openedcontinued anyway
Browser use only. Counted at most once per tool per day. Group figures only, never who.
Sent despite warning
1,120
Detected, not adjusted, and still sent.
Critical sent despite warning
214
14% of critical detections
OutcomesLast 30 days
9,702
adjusted before sending
78% of 12,438 detections
Masked7,428(60%)
Removed2,274(18%)
Sent despite warning1,120(9%)
No action recorded1,616(13%)
Accountability GDPRNIS2
- Substantiated
Data minimisation at input
Sensitive data marked and handled before sending
- Substantiated
Register of AI services
Vendor, classification, and a decision per tool
- Partial
Appropriate technical measures
Detection active on the supported applications, handling still below the norm
- Not substantiated
Personal data breach notification
BeeSensible provides the signal, not a reporting process to the regulator
A Tuesday on the ward
Risk rarely looks like risk.
08:20
Outpatient clinic
A doctor has AI tighten a referral letter. The name, the date of birth and the diagnosis are still in the pasted text.
11:05
Inpatient ward
A nurse pastes notes into a chatbot to draft a handover. More record context travels along than the question needs.
13:40
Treatment team
Someone tries a new voice-driven note-taking tool a colleague was enthusiastic about. The vendor has not been assessed.
16:15
Secretariat
A patient letter is made easier to read with AI. Useful, and it saves time. Only the national ID is still in there.
Nobody here is dodging the policy. They are doing their work in a day that is too full. That is why help while the work happens beats one more instruction.
The rules you already sit inside
Fits obligations that already apply.
Supervision
Careful implementation and careful use
Care providers putting generative AI into care delivery are responsible for both. The Dutch health inspectorate names applications such as automatic consultation notes, record summaries and support for patient correspondence, and asks for attention before purchase, during rollout and afterwards.
BeeSensible does not check AI output and does not make clinical AI safe. It does make visible which applications are becoming part of the work, so you can decide about them deliberately.
GDPR
Health data is a special category
Data about health carries a heavier regime, and on top of that sits medical confidentiality. That does not mean processing is never allowed: inside an application built and approved for it, it can be exactly what the work requires.
Which is why BeeSensible marks rather than blocks. The professional sees what is in the text and decides what fits the application they are using.
Security standards
Supporting, not replacing
The Dutch healthcare standard NEN 7510 gives organisations a management system and controls for information security, with risk analysis and demonstrable control at its heart. Since 15 August 2026 the Dutch Cybersecurity Act applies on top of that for the organisations in scope.
BeeSensible supports measures inside such an approach with insight into actual AI usage and aggregate figures on what happens after a marking. The standard itself does not ask for our statistics.
The question that always comes
Not more surveillance of clinicians. Better sight of the system.
“So to know what my people do with patient information, you are going to keep their prompts?”
No.
You could solve AI governance by logging prompts and tracking user activity. Then you build a database full of highly sensitive information, and a system that can follow individual staff. In healthcare that is precisely what you do not want.
The full story in the Trust Center- Which tools are used? You see that.
- How much sensitive data is recognised, and of what kind? You see that.
- What happened after a marking or a notice? You see that.
- What a nurse typed on Tuesday at 14:03? You do not, and neither do we.
- The text is checked in working memory on our EU servers and discarded at once.
How it is put together
One process, four parts.
The first three can be bought on their own, so you can start with one.
Before you look further
The questions people ask first.
Does BeeSensible read along with what clinicians type?
No. The text is checked to mark sensitive data, and then not kept. It goes to our own servers at European providers, is checked in working memory and discarded straight after. No external AI service is involved.
Can managers see who got a marking?
No. For markings, documents and notices, who it was is not recorded, so it cannot be looked up afterwards either. The dashboard has no per-employee view of any kind. At most the department is stored, and only if you switch those insights on, with a minimum group size.
Does BeeSensible block AI tools?
Never. It also never changes what someone wrote by itself. Your colleague sees what was found and what your organisation decided about that tool, and chooses. If something was sent anyway despite a marking, that gets counted, without content and without a name.
So patient data may never go into an AI tool?
That is your call, not ours. Inside an application built and approved for it, with a processing agreement and a lawful basis, processing patient data can be exactly what the work requires. BeeSensible helps people act carefully in the context of the moment; it does not keep personal data out of AI categorically.
Does BeeSensible check whether the AI output is correct?
No, and we should not claim otherwise. Incorrect AI output is a real risk in care, but judging it stays human work and belongs to the application itself. BeeSensible is about which applications are used, what verdict attaches to them, and what data goes in.
Where does BeeSensible run?
On our own servers at European providers: the application and the database at Scaleway in Amsterdam, the models at Hetzner in Germany. European companies rather than a European region of an American cloud, so there is no US parent that can be ordered to hand data over. The text is checked there in working memory and discarded straight after. What reaches the dashboard are counts and attributes, never content.
How much work is the rollout?
Not much. No proxy, no change to your network. The extension runs in Chrome and Edge and deploys centrally through Intune; the desktop app installs silently in the background. With a managed rollout your organisation is up inside an hour.
Does this make us compliant with NEN 7510 or the GDPR?
Not automatically, and nobody should promise that. BeeSensible can support measures inside such an approach and shows their working in figures. The risk analysis, the lawful basis, the DPIA and the judgement about what is appropriate stay with the organisation.
Does detection work on clinical terms?
Yes. The engine works in Dutch and English and recognises, besides names, national identifiers and addresses, also diagnoses, medications, doses, lab values and procedures. Which of those get marked, and how heavily, you set per profile.
Start by seeing
Give AI room. Keep sight of how it is used.
Within two weeks you can see which AI tools are in use across your organisation, and build from there: decide, help, substantiate.
14 days free, no credit card. Rolled out across your organisation within the hour.
