When is an AI application high-risk under the AI Act?
High risk attaches to an AI system's intended purpose, not its technology. Which Annex III entries affect an employer, and what Article 6(3) exempts.
Read the article Topic
Compliance and AI
What the GDPR, the AI Act, NIS2, ISO 27001, and sector rules mean once your team uses AI.
Quick answer
Compliance frameworks rarely mention AI by name, but they all apply the moment staff paste personal or confidential data into an AI tool. The GDPR governs personal data, the AI Act governs the system, NIS2 raises governance and incident duties, and ISO 27001, the BIO, and NEN 7510 ask for organisational measures and awareness. The shared practical answer is data minimisation at the point of typing.
Most rules that organisations live by were written before everyday generative AI. They still apply. A national ID in a prompt is personal data under the GDPR. A care file in a chatbot is special-category data under NEN 7510. An incident with a public AI tool can become a reporting duty under NIS2.
These guides translate each framework into the same practical question: which data may leave your organisation, and how do you keep the rest out of an AI tool. They cover the GDPR, the EU AI Act, NIS2, ISO 27001, and the BIO and NEN 7510 for government and healthcare.
The common thread across all of them is data minimisation and awareness at the moment data is shared. A signal in the text field, so the person typing can mask or remove sensitive data before they send, supports the organisational measures these frameworks ask for, without reading the content of private chats.
Articles in this topic
How do you demonstrate AI literacy?
An attendance list covers the day of the course; an auditor asks about the Monday after. Three kinds of evidence for AI literacy and what each one shows.
Read the article
AI literacy for school staff: what does the AI Act ask of schools?
Article 4 of the AI Act applies to schools too, without requiring a course or certificate. What it does ask, and what 'sufficient' means for each role in a school.
Read the article NEN 7510 in 2026: the new standard, the deadlines and what to do now
What the revised NEN 7510:2024 asks of Dutch healthcare providers, the February 2027 certification deadline and how the Cyberbeveiligingswet fits in.
Read the article Does every employee need AI training?
Article 4 asks for measures suited to each role and context, not one course for everyone. What applies to every employee, what differs by role and what else it takes.
Read the article The Netherlands has its NIS2 law: what applies from 15 August
From 15 August 2026 the Dutch NIS2 law imposes duties of care, reporting and registration on more than 8,000 organisations. The timeline and what to do now.
Read the article AI literacy in 2026: what is actually required of organisations?
Article 4 of the AI Act prescribes no course, certificate or number of hours. What it does say, what "sufficient" means for each role and what to record.
Read the article
AI in financial services: protecting client data under supervision
Meeting notes full of account numbers end up in ChatGPT in seconds. What that means for a regulated firm, and how to stay on top of it without banning AI.
Read the article
Is an AI register mandatory under the EU AI Act?
No, not as a single register that every organisation must keep. The registration and documentation duties the AI Act and the GDPR do impose, and why a register is worth keeping anyway.
Read the article The EU AI Act for employers: what do you have to do in practice?
Most employers use AI rather than build it. What the AI Act asks of you as a result, what applies today, what applies from December 2027 and where ChatGPT fits in.
Read the article Is AI literacy mandatory?
Yes, since 2 February 2025. What Article 4 of the AI Act asks after the Digital Omnibus, what fits each role and what it does not require: no certificate or minimum hours.
Read the article Anonymising, pseudonymising, masking: three words, three consequences
Only genuinely anonymised data falls outside the GDPR. Pseudonymising and masking are useful, but they change none of your obligations. What to use when.
Read the article ChatGPT and the AI Act: what changes for users at work?
The heavy duties rest with OpenAI, not with you. What the AI Act does change for anyone using ChatGPT at work, and what your organisation needs to put in place.
Read the article
Approving an AI tool: what to ask the vendor
Six questions, with what a usable answer looks like and what an evasive one looks like. Built to be used in a call, not filed in a folder.
Read the article The AI register and the ICT third-party register: keeping them in step
The DORA register of ICT third parties and the AI register list the same vendors. How to avoid duplicate work and keep both up to date with what is actually used.
Read the article
Do you need a data processing agreement for an AI tool?
If an AI vendor processes personal data on your behalf, a data processing agreement is usually mandatory. When you need one and what has to be in it.
Read the article Who is responsible for AI literacy: HR, IT or the DPO?
The duty sits with the organisation, not with one department. What HR, IT and the DPO are each responsible for, who keeps the evidence and why "the DPO will handle it" fails.
Read the article
AI and DORA: where AI tools fit in your ICT risk management
Under DORA, the chatbot an adviser found for herself is also a third-party ICT service. Where AI tools fit in ICT risk management, and what to record.
Read the article Can one AI tool be both low and high risk?
Yes. The risk depends on what you use the tool for, which data goes in and which account it runs under. The AI Act looks at purpose, not at the name.
Read the article
AI literacy in municipalities: who needs to know what?
What counts as sufficient AI literacy differs by role. What the front desk, policy advisers, youth care, IT and the board need to know, and how a municipality shows it.
Read the article
GDPR and AI: which measures does the law require for AI use?
The GDPR does not mention AI, but it applies as soon as personal data goes into an AI tool. Here are the seven measures, from lawful basis and minimisation to a DPIA.
Read the article AI governance and the BIO baseline: where AI use fits
The BIO never mentions AI. Everyday AI use in a municipality lands in four themes it already has: classification, suppliers, awareness and logging.
Read the article NIS2 and AI: what does the directive mean for your AI use?
NIS2 raises the bar on cybersecurity, governance and incident reporting. Why AI tools are part of your attack surface and supply chain, and what follows from that.
Read the article ISO 27001 and AI: how does AI use fit into your ISMS?
ISO 27001 does not mention AI, but it does ask for policy, classification, supplier management, awareness and leak prevention. How to bring AI use within those controls.
Read the article BIO and NEN 7510: AI and privacy in government and healthcare
Government works with the BIO, healthcare with NEN 7510. Both demand strict handling of sensitive data. What that means once staff start using AI tools.
Read the article FAQ
Common questions
Do these frameworks mention AI directly?
Mostly not. The GDPR, NIS2, ISO 27001, the BIO, and NEN 7510 predate everyday generative AI, but they apply as soon as personal or confidential data enters an AI tool. The EU AI Act is the one framework written specifically for AI systems.
What is the practical measure they all share?
Data minimisation and awareness at the point of use. Keep personal and confidential data out of prompts, document what you do, and make the safe path the easy path so people follow it under time pressure.
Is BeeSensible itself certified?
The infrastructure BeeSensible runs on is ISO 27001 certified. BeeSensible itself is not certified. BeeSensible supports your measures by making sensitive data visible before it is sent, but it does not replace your own compliance work.
See how BeeSensible works
Sensitive data gets a marking while you type, in the tools your team already works in. You decide what happens before you send.
