Catalog and risk
What the catalogue tells you about over 1,000 AI tools: the facts, a risk score across six dimensions and an initial classification under the EU AI Act.
The catalogue is the All tools view in the AI register. It holds over 1,000 AI tools, each with the facts about the tool and its vendor and an estimate of the risk. You use the catalogue to look a tool up before you decide about it, to decide on several tools at once and to add a tool of your own. A tool that is new to your organisation always starts at No decision yet.
All tools in the dashboardThe catalogue, under AI register in the menu; this is also where you add your own tool.Search and decide
You can search by tool name, vendor, domain or former name, and the search finds the tool even if you make one typo. The quick filters let you choose between All, In use without a decision, With activity (everything seen in your organisation) and New (added in the last 30 days). Under Filters you can narrow the list further, for example by risk level, sector and vendor country.
The list is sorted by the number of visits in your organisation. Lookalikes, wrappers and discontinued tools only appear if someone in your organisation uses them, if you have already decided about them, or if you switch on Also show lookalikes, wrappers and discontinued tools.
To decide on several tools at once, tick their rows. Shift-click selects a range and Select all selects the whole list. You then pick a decision at the bottom that applies to the whole selection. If you choose Allow with limits, the dialog first asks for the condition employees will see.
Tool details
Click a row to open the tool. The Overview tab shows how often the tool was visited in your organisation in the last 30 days and, under Properties, the facts about the tool, such as Vendor, Trains on input, Data residency and DPA available.
Types of tool, statuses and variants
What is this? tells you what kind of tool it is. An Original is a tool under the vendor's own brand. A Wrapper offers another party's model under its own name. A Lookalike uses the name of a well-known product but comes from a different vendor. If this is not yet clear, it says Not yet established.
A tool that no longer exists keeps a status: Unreachable, Discontinued or Merged (shown as "Merged into …"). For a discontinued tool, the use and the decisions are kept. Because a decision applies to one product, you need to decide again after a merge.
Variants of this product puts the plans of the same product side by side, such as ChatGPT and ChatGPT Business. Each variant has its own risk score and its own decision.
The risk score
The Risk & compliance tab shows the risk band and the score, with the reasons under Why this assessment. The Risk breakdown gives six dimensions a score from 1 to 5 each, where a higher score means more risk, and weights them as follows:
| Dimension | Weight | What it measures |
|---|---|---|
| Data governance | 6 | Training on input, data processing agreement, storage location |
| Jurisdiction | 4 | Where vendor and data are based, state access |
| Compliance | 3 | GDPR, EU AI Act, certifications |
| Incidents | 3 | Documented breaches or misuse |
| Integration scope | 2 | How much access the tool asks for |
| Vendor trust | 2 | Transparency, track record |
The weighted total has a maximum of 100 and sets the band: Low below 40, Medium from 40 to 59, High from 60 to 79 and Critical from 80 upwards. Every assessment carries the line "BeeSensible's estimate, not a legal judgement", a date and how well the estimate is supported. Every incident has a source; where it is missing, it says "source missing".
The risk band is information and comes with no default policy. What a band means for your organisation is something you decide tool by tool.
The EU AI Act
The EU AI Act card gives an initial classification of the tool under the EU AI Act: High risk (with the Annex III category), Limited risk, Minimal risk, Depends on use or Not classifiable. This classification is not legal advice. Which obligations apply to you depends on what you use the tool for, your use cases, and that assessment is yours to make.
Alternatives and your own tools
The Alternatives tab lists allowed tools with the same function, with the lowest-risk tool first. Add an alternative pins your preferred one, and the notice for a disallowed tool then points to that alternative. How often the tool was visited is on the Usage tab; Usage explains those figures.
Add your own tool puts an internal tool next to the tools in the catalogue, for example your own environment such as "Working safely with AI". You fill in the properties and either choose the risk level yourself or have it calculated. The tool carries the Own label, is visible only to your organisation and can be chosen as an alternative.
How BeeSensible maintains the catalogue
When the extension sees a domain that is not in the catalogue yet, BeeSensible reviews it. The domain is then linked to an existing tool, added as a new tool with a full fact sheet, or rejected. Until that review is done, the tool shows in your Inbox as Not assessed yet. Nothing is ever removed from the catalogue, and every change is recorded.
