Responsible people and documents
Who is responsible for a tool and in which role, and which documents belong to it, such as the processing agreement and the DPIA, with status, date and link.
Every registration in the AI register has at least one responsible person, and you can add the documents that belong to the tool, such as the processing agreement and the DPIA. This means that for each tool you can find out who is responsible and which arrangements have been recorded. You find both in the Responsible and Documents cards on the Overview tab of the tool page.
Responsible people
Whoever allows a tool is added automatically as Owner and as the reassessment owner. You then add the other people involved with the tool, for example someone from IT or the privacy officer.
Pick a person
Choose Add person and select a member of your organisation. If the person is not part of your organisation in BeeSensible, choose Someone else (not a member) and type their name. A member receives an email when the reassessment is coming up, as the admins do; someone added by name only does not receive that email.
Assign a role
Choose Owner, IT, Privacy or Security. If none of these four roles fits, choose Other role and type the name of the role yourself.
Save
You can only save once there is at least one responsible person. If you later remove the last one, the tool appears under To complete with the reason "Owner missing".
You choose the reassessment owner separately, in the Reassessment card. Review explains how this works.
Documents
To record a document, choose Add document. You pick the type of document, give it a title and set its status. A date and a link are optional; a link must start with https://. Later, Open takes you to the document and Change lets you update its details.
| Type | Statuses |
|---|---|
| Processing agreement | Not known yet, In place, Missing, Not needed |
| DPIA | Not known yet, Carried out, Needed, not done yet, Not needed |
| Internal assessment | Not known yet, Carried out, Still to do, Not needed |
| Usage rules or AI policy, Contract with the vendor, Other document | Not known yet, In place, Missing, Not needed |
A tool has one processing agreement and one DPIA, and that single DPIA covers all use cases of the tool. Until they are recorded, you see "Not recorded yet" with a Record button.
BeeSensible does not store any files itself. The register keeps track of which documents exist, with the type, title, status, date and a link to where the document is kept, for example in your document management system. These details also go into the PDF of the register.
What is still open
Under Still open, the tool shows what still needs to be arranged. For documents, these messages can appear there:
- "The processing agreement is not arranged yet."
- "Personal data is processed and the DPIA is not arranged yet." This message appears when a use case says personal data is processed. If BeeSensible itself finds personal data in the tool, the same signal appears on the Measured tab.
Tools with an open item like this appear in the Documents open filter and count on Home as "with a document open". As soon as you set the document's status to In place, Carried out or Not needed, the message disappears.
The vendor offers a processing agreement, but the register says it is still open
Both are correct. The line "Processing agreement from the vendor: Available" comes from the catalogue and only means that the vendor offers such an agreement. BeeSensible does not know whether you have concluded one. You record that yourself by setting the Processing agreement document to In place, with a date and a link.
Every change to responsible people and documents goes into the tool's history. The review takes you through the documents as a separate step.
