Decide which AI tools your organisation can use responsibly.
Employees use ChatGPT, Copilot and all kinds of other AI tools. But which of them suit the work they use them for? Where is the data processed, what risks are known, and what have you already agreed? The AI register brings that information together and records, for each tool, what is and isn't allowed.
Prefer to try it yourself? 14 days free, no credit card.
The AI register in the dashboard. Demonstration with a fictional organisation.
Assess an AI tool on the facts.
Before you allow a tool, you want to know what happens to the data that goes in, where the vendor is based and what terms apply. Researching that tool by tool takes days.
BeeSensible collects that information for over 1,000 AI tools: vendor and parent company, hosting, whether the tool trains on input, whether a data processing agreement (DPA) is available, certifications, known incidents with a source, and a risk score across six dimensions. Free and business versions are listed as separate tools.
You don't start from scratch, and you can back up every decision. The assessment and the decision stay with your organisation; BeeSensible never chooses for you.
All tools: the catalogue, with this organisation's decision for each tool. Demonstration.
Decide for each tool what is allowed, and on what terms.
There are four possible decisions, and every tool starts at "no decision yet". Nothing is pre-selected, and there's no default policy per risk band.
The tool goes into the register, with the admin as the person responsible and a review due in a year.
Allowed on a condition you write yourself, such as "No customer data." Employees see that sentence when they open the tool.
Point people to an alternative; the notice puts it first. Whether they can still continue is up to you. That's what this organisation decided for DeepSeek, with Microsoft 365 Copilot as the alternative.
Where every tool starts. Need to know more first? Choose Decide later: the tool leaves the Inbox and moves to Under review, still without a decision. Every decision can be reversed.
This organisation's record for DeepSeek: not allowed, with the reason and the alternative.
Bring the decision to the people who use the tool.
A decision in the register only helps once people come across it. You'll also want to set what happens to an ID number in a prompt, and which data counts as critical.
You decide which notice people see when they open a tool, which data types are recognised and how strictly, and how masking is set up. That applies across the organisation, and for ChatGPT, Claude and Gemini you can set exceptions per tool.
Your policy lives in one place, and people come across it as soon as they open a tool or paste data. The documentation describes every setting.
Policy > Masking (the settings) and Policy > Detection profiles. Demonstration with fictional settings.
Keep the register up to date, without a spreadsheet.
A spreadsheet register is out of date the day it's finished. New tools never make it in, a DPA expires unnoticed, and nobody remembers why something was allowed.
In BeeSensible, allowing a tool means registering it. Every allowed tool gets a record: the decision and who made it, the use cases, the people responsible, the documents (DPA, DPIA, usage rules), the detection profile and a review date. What BeeSensible measures is shown alongside.
That keeps the register current: a new tool waits in the Inbox until you decide, outstanding documents stay visible, and the person responsible gets an email before the review is due. You can export it as PDF or CSV.
Click through ChatGPT's record, as this organisation keeps it.
Clickable demonstration. The organisation, the people and the figures are fictional.
Overview
Decision, use cases, people responsible, documents and review date. Anything outstanding is shown at the top.
Policy
The notice people see on opening, the detection profile, and for each masking feature whether the tool follows the organisation-wide setting.
Use cases
What the tool is used for, by department, and how many prompts BeeSensible saw.
Measured
What BeeSensible saw, compared with what is recorded. Any difference shows up as a signal.
History
Every change: date, who, what, from and to.
What the register adds to your record of processing activities and your DPIA.
Not a record of processing activities
The record required by Article 30 GDPR describes processing activities. The AI register describes tools and decisions. A tool that processes personal data belongs in both.
Not a legal judgement
The indicative EU AI Act classification covers the tool and the use case. Which obligations apply is for your organisation to judge.
No decision on your behalf
The risk score and the facts are there to inform you. The decision, the condition and the alternative are the organisation's.
See which tools belong in your register.
The catalogue is ready; actual use fills in the rest. Want to see a completed record first? Book a demo.
14 days free, no credit card. Rolled out across your organisation within an hour.
