Assess the risks before you allow an AI tool.
Before you allow an AI tool, you need to know what happens to the data, where the vendor is based and what incidents are on record. BeeSensible collects those facts for over 1,000 AI tools and sums them up in a risk score. This page explains how, so you know what the score tells you and what it doesn't.
For each tool, the facts you need to decide.
Vendor and ownership
Who makes the tool, the parent company and the country of establishment.
Hosting and jurisdiction
Where data is processed and which law applies there.
Training policy
Whether the tool trains on input, and whether you can opt out.
Data processing agreement
Whether the vendor offers a data processing agreement (DPA). Many free versions don't.
Certifications
ISO 27001, SOC 2 and similar, as published by the vendor.
Incidents with a source
Data breaches and lawsuits, with their source.
The facts about DeepSeek and ChatGPT, as they appear in each tool's record. Demonstration.
Risk assessment
How a tool gets its score.
Every tool in the catalogue is scored on six dimensions, each from 1 to 5, where a higher score means more risk. The dimensions are not weighted equally: what the vendor does with your data counts most.
Data governance
Weight 6How the vendor handles your data: whether it trains on your input, whether it offers a DPA and where the data is stored.
Jurisdiction
Weight 4Legal risk based on where the vendor and its data are located. Countries that allow state access or lack a GDPR adequacy decision score higher.
Compliance
Weight 3Alignment with GDPR and the EU AI Act, plus recognised certifications such as ISO 27001 and SOC 2.
Incidents
Weight 3The tool's history of breaches, leaks or misuse. More documented incidents, or more serious ones, mean a higher score.
Integration scope
Weight 2How much access the tool asks for: from a standalone chat window to connectors and actions inside your own systems.
Vendor trust
Weight 2How open the vendor is about ownership and the underlying model, plus the company's track record and maturity.
From score to risk band
DeepSeek
Critical 90/100DeepSeek · China
Why this assessment
- · Trains on your input by default.
- · Vendor jurisdiction (CN) allows state access; no GDPR adequacy.
- · No data-processing agreement (DPA) available.
Incidents, with a source
- 2025 · Public share links indexed by search engines source
- 2025 · Regulator blocked the app over data transfers to China source
If a tool has a history, it's listed with a link to the source. If there's no verified source, the product says so explicitly. That keeps it a fact, not a rumour.
Free and business versions are separate tools.
The free version of ChatGPT and ChatGPT for business differ in training policy, contract and DPA. That's why the catalogue lists them separately, each with its own score and its own decision. Lookalikes and wrappers that borrow a well-known name are recognised for what they are.
An indicative classification, not a legal judgement.
Every tool carries an indicative EU AI Act classification: high, limited or minimal risk. For some tools it depends on the use, and some can't be classified. The classification is about the tool as it's offered. Whether your use falls into a high-risk category depends on what you use it for; that is for your organisation to assess, and you record it in the register.
The score informs; the decision is yours.
Not a decision
A high score doesn't automatically make a tool Not allowed. Every tool starts at "no decision yet", and there's no default policy per risk band.
Not a judgement on your use
The score is about the tool. A tool with a low score can still be unsuitable for your use case, and vice versa.
Not a guarantee
We base the assessment on what vendors publish and what verified sources say. Anything we don't know is shown as unknown, not as safe.
Not static
The catalogue is kept up to date continuously. A tool that isn't in it yet can still be given a decision.
Assess your own tools with these facts.
Roll out BeeSensible and within a day you'll see which tools are in use, with the catalogue facts alongside.
14 days free, no credit card. Rolled out across your organisation within an hour.
