Letting AI in
Research, summarising, a first draft: exactly the work where AI wins time. A firm that shuts it down loses that time, and the people who wanted to win it.
AI governance for legal organisations
AI is becoming part of legal work. Your duty of confidentiality does not travel with it.
See which AI tools your firm or department actually uses and decide per tool what fits. Help people when case information goes into a prompt, and show that those agreements are genuinely followed.
14 days free, no credit card. Rolled out across your organisation within the hour.
"Awareness fades when you're busy. That's why we use BeeSensible." Debby Elfrink, Operations director, Speck Pompen
Your firm 
ChatGPT Limited use 
Microsoft 365 Copilot Allowed 
Claude
ChatGPT Limited use Microsoft 365 Copilot Allowed Claude CoCounsel Allowed
Lexis+ AI
Ironclad AI
Spellbook
Legora
Robin AI No decision yet
Client name Witness statement Case file Correspondence Draft agreement
Your firm Microsoft 365 Copilot Allowed CoCounsel Allowed Lexis+ AI Legora
Client name
Witness statement
Case file
Correspondence
Draft agreement
Plus everything else that is running
Microsoft 365 Copilot Allowed CoCounsel Allowed Lexis+ AI Legora No prompts stored. No per-employee view. Everything processed inside the EU.
What this is about
Confidentiality stays yours, even when the tool belongs to someone else.
A lawyer has a draft tightened. An associate asks a chatbot to summarise a due diligence memo. Somebody tries a contract review tool that came up at a conference.
None of that is reckless. These are small efficiencies in work that runs against the clock. But for the firm the question shifts: not whether AI is used, but which AI, with what case information, and whether the agreements you made are holding.
Protecting privilege
Case files hold information a client entrusted to you under a duty that reaches further than a processing agreement. That duty does not travel to a vendor.
Being able to show what you did
An AI protocol is quickly written. What happened in an input field at half past seven on a Thursday evening is not in it.
Policy and practice
The protocol is in the handbook. The choice happens in an input field.
Firms and departments have rules, an approved research environment and sometimes a training. What is missing is sight of the tools that quietly arrive, and someone beside the lawyer when case information goes into an AI tool.
BeeSensible makes that connection, in four steps that keep coming back around.
01 See 02 Decide 03 Help 04 Substantiate
01See
Know what is running inside your firm.
Not only the research environment you hold a licence for. BeeSensible sees when AI tools are opened and shows, at firm level, which ones appear, without reading prompts and without building a file on anyone.
- Which tools are in use, and by how many people?
- Which ones surfaced for the first time this month?
- What share of the usage runs through what you approved?
AI adoption
68%
81 of 120 seats AI-active this month
Prompts sent
1,596
22% vs previous 30 days
AI tools in use
7
2 newly discovered this period
Safe adoption
71%
of AI use via allowed tools
How often AI is used
Daily3428%Weekly3025%Occasionally1714%Not active3933%
Computed on-device and reported as anonymous counts, never per person.
What AI is used for
Analysis & knowledge354
Summarizing353
Writing communication258
Detections over timeLast 30 days
12,438+18% vs the previous period
Detections by platform
78% adjusted
8,124
81% adjusted
3,210
74% adjusted
812
Most encountered data types
4,212
2,930
1,486
1,104
612
SensitiveHighly sensitive
An impression of the AI tools catalogue. The tools and their risk scores come from the product's own catalogue; the verdict in the last column is your firm's to set.
The catalog
865 AI tools assessed for risk, and more arrive every week
You should not have to research a tool before you can decide about it.
Before you can decide anything about a tool, you need to know what it does with your data: where the vendor sits, whether it trains on what you type, whether incidents are known. We worked that out for 865 tools, and more arrive every week. What is left is the question only you can answer: is this allowed here, and under what condition?
The GDPR asks for a record of processing, NIS2 for a view of your suppliers, and the EU AI Act for demonstrable AI literacy. Because every observed tool is recorded with its vendor, hosting region and training policy, and carries a decision from your organisation, you can answer at any moment.
See the catalog-
Which tools are in use, and for what
Every observed tool is in the register, with vendor, country, hosting region, training policy and the kind of work it is used for.
-
Which of them fit your policy
One decision per tool: allowed, limited use, not allowed, or no decision yet. Nothing is silently approved; the decision is always yours.
-
What you do to uphold that policy
Anyone opening a tool you have decided something about sees it at that moment, right in the page. That the notice appeared is counted, without content and without a name, so you can show the mechanism actually reached people.
The overview does not establish that you comply with the law. It shows which measures you can substantiate with measurements, and which you cannot. The judgement stays with you.
02Decide
A search engine is not a document analyst.
A tool that searches public case law calls for a different judgement than one where whole files get uploaded. Per tool you see the vendor, the country, the data processing agreement, certifications, documented incidents, a risk score across six dimensions and a separate reading under the EU AI Act. We supply the facts; the firm records the decision.
- Allowed
- Fits our boundaries, including with case information.
- Limited use
- Fine for research and text. No client or case data.
- No decision yet
- Newly surfaced, not yet assessed.
- Not allowed
- With an approved alternative alongside it, where one exists.
03Help More about document anonymisation
A lawyer should not have to know the protocol by heart.
When someone opens a tool you have decided about, they see that decision with the reason behind it, and the alternative that does fit. When they paste case information into a supported AI tool, party names, matter numbers, amounts and company numbers get marked as they type.
Masking or removing takes one click. BeeSensible does not block and changes nothing by itself: the lawyer stays the one making the judgement, as it should be.
BeeSensible notice
No decision yet No decision yet on Robin AI
Your organisation has not made a decision on this tool yet. Do not share personal data or confidential business information here.
Use instead
Open CoCounselAlso allowed: Lexis+ AI ·Microsoft 365 Copilot
Continue anyway
Only enter public information here
BeeSensible notice
Not allowed Robin AI is not allowed here
Your organisation does not allow this tool for work. Use an allowed alternative.
Use instead
Open CoCounselAlso allowed: Lexis+ AI ·Microsoft 365 Copilot
Hold to continue anyway
BeeSensible notice
Limited use Robin AI is allowed here, with limits
Your organisation allows this tool with limits. Only use it with anonymised data.
Use instead
Open CoCounselAlso allowed: Lexis+ AI ·Microsoft 365 Copilot
Hold to continue anyway
GeminiDefault1 / 3Draw box
Matter summary - acquisition
Matter number 2026/0418-HZ, client Veldkamp Groep (company number 34281907), contact Bram Kuiper.
The counterparty is represented by Annelies Bouwmeester. The purchase price is 2,750,000 euro, payable in two instalments.
8 items will be removedPreviewAnonymise (8)
04Substantiate
Show the agreement is more than a paragraph in the handbook.
How often was a marking acted on? How often did someone take the approved research environment instead of a free chatbot? What share of AI usage now runs through tools you said yes to?
That movement becomes visible in counts and patterns, without ever showing what an individual lawyer wrote. Usable towards the partnership, a client who asks, or your own insurer.
Warnings about tools
Shown the moment someone opens a tool you have not decided on, or have limited or disallowed. About the tool itself, not about what gets typed into it.
148
warnings shown
61%
chose an alternative
Not allowed52 times
38 alternative9 held through
Limited use44 times
21 alternative15 held through
No decision yet52 times
31 alternative14 clicked through
alternative openedcontinued anyway
Browser use only. Counted at most once per tool per day. Group figures only, never who.
Sent despite warning
1,120
Detected, not adjusted, and still sent.
Critical sent despite warning
214
14% of critical detections
OutcomesLast 30 days
9,702
adjusted before sending
78% of 12,438 detections
Masked7,428(60%)
Removed2,274(18%)
Sent despite warning1,120(9%)
No action recorded1,616(13%)
Accountability GDPRNIS2
- Substantiated
Data minimisation at input
Sensitive data marked and handled before sending
- Substantiated
Register of AI services
Vendor, classification, and a decision per tool
- Partial
Appropriate technical measures
Detection active on the supported applications, handling still below the norm
- Not substantiated
Personal data breach notification
BeeSensible provides the signal, not a reporting process to the regulator
A Thursday at the firm
Risk rarely looks like risk.
09:40
Corporate
An associate has AI smooth out a draft agreement. Both party names and the purchase price are still in the text.
11:15
Employment
A matter summary goes into a chatbot with its context. Name, role and the reason for the dispute travel along.
14:25
Real estate
Someone tries a new contract review tool mentioned at a conference. The vendor has not been assessed.
19:30
At home, after hours
One last memo gets finished on a personal account, because the VPN gave up.
Nobody here is dodging the protocol. They are finishing their work. That is why help while the work happens beats one more paragraph in the handbook.
The rules you already sit inside
Fits obligations that already apply.
Professional privilege
Confidentiality is more than a processing agreement
Lawyers carry a duty of confidentiality that reaches beyond data protection law, with legal professional privilege as its counterpart. People working under the lawyer's responsibility fall inside it in practice.
BeeSensible can be a measure that supports it, and shows its working. It does not replace professional judgement.
GDPR
Personal data gets in through people
Once personal data is processed with generative AI, the GDPR can apply. The Dutch data protection authority notes that users enter that data themselves while using it.
That is where BeeSensible sits: making data visible before it is shared, and aggregate insight into what happened afterwards.
EU AI Act
Knowing what you use
People working with AI need to know what it does, and different applications can carry different duties. The catalogue holds an EU AI Act reading per tool, separate from our own risk score.
A register of the AI services in use is the start of that. It does not make you compliant with the regulation.
The question that always comes
Oversight of your own firm, without reading along.
“So to know what my people do with case files, you are going to keep their prompts?”
No.
For a firm under a duty of confidentiality, a central database of prompts is not a solution but a new problem. That is why the product is built so the content never settles anywhere.
The full story in the Trust Center- Detection runs on our own servers at European providers, in working memory, and the text is discarded straight after.
- No external AI service is involved: nothing goes to ChatGPT, Google, or any other party.
- Prompts do not reach the dashboard. Not shortened, not as an example.
- The usage data holds no user id. What an individual lawyer did cannot be reconstructed afterwards.
- Reporting is counts and patterns, never a per-employee view.
How it is put together
One process, four parts.
The first three can be bought on their own, so you can start with one.
Before you look further
The questions people ask first.
Does BeeSensible read along with what our lawyers type?
No. The text is checked to mark sensitive data, and then not kept. It goes to our own servers at European providers, is checked in working memory and discarded straight after. No external AI service is involved.
Can administrators see which colleague got a marking?
No. For markings, documents and notices, who it was is not recorded, so it cannot be looked up afterwards either. The dashboard has no per-employee view of any kind. At most the department is stored, and only if you switch those insights on, with a minimum group size.
Does BeeSensible block AI tools?
Never. It also never changes what someone wrote by itself. Your colleague sees what was found and what your organisation decided about that tool, and chooses. If something was sent anyway despite a marking, that gets counted, without content and without a name.
So case data may never go into an AI tool?
That is your call, not ours. Inside an environment built and assessed for it, processing case information can be exactly what the work requires. BeeSensible helps people act carefully in the context of the moment; it does not keep data out of AI categorically.
Can we record our own condition per tool?
Yes. A verdict carries the note your colleague sees the moment they open it. So a tool that is fine but not with case information says exactly that, instead of pointing at the handbook.
Where does BeeSensible run?
On our own servers at European providers: the application and the database at Scaleway in Amsterdam, the models at Hetzner in Germany. European companies rather than a European region of an American cloud, so there is no US parent that can be ordered to hand data over. The text is checked there in working memory and discarded straight after. What reaches the dashboard are counts and attributes, never content.
How much work is the rollout?
Not much. No proxy, no change to your network. The extension runs in Chrome and Edge and deploys centrally through Intune; the desktop app installs silently in the background. With a managed rollout your organisation is up inside an hour.
What can we show a client or insurer with this?
Figures on actual AI usage, on which tools were assessed and with what verdict, and on what happened after a marking or notice. All at organisation level. What an individual lawyer wrote is not in there, and cannot be got out of it.
Start by seeing
Find out what happens between your AI protocol and the case file.
Start with your own firm. See which AI tools are in use and build from there: decide, help, substantiate.
14 days free, no credit card. Rolled out across your organisation within the hour.
