Use cases, also under the EU AI Act
What you use a tool for: measured use cases; regulated use cases, which flag where the EU AI Act may apply; and your own use cases.
A use case describes what you use an AI tool for, for example summarising meeting notes or screening CVs. You record the use cases for each tool on the Use cases tab of the tool page in the AI register. This matters because what the EU AI Act asks of you depends partly on how you use a tool. A registration without a use case appears under To complete.
Three types of use case
Measured by BeeSensible. BeeSensible classifies the first prompt of a conversation as one of seven types of use and discards the prompt immediately afterwards, so that only the label is counted. The seven types are Writing communication, Marketing & content, Summarizing, Rewriting & editing, Translating, Coding & technical and Analysis & knowledge. Once you record one of these use cases, the Measured column shows how many prompts belong to it.
Regulated. These are use cases in which AI plays a part in a decision about people. They may fall under the EU AI Act and therefore need an assessment by your own organisation. BeeSensible does not measure these use cases. They are listed by domain, with an EU AI Act badge.
| Domain | Examples | May fall under |
|---|---|---|
| HR and work | Screening CVs, Comparing candidates, Evaluating employees, Monitoring employees | Annex III, point 4 (employment and workforce management): high risk |
| Education | Admission or selection, Assessing level or performance, Exam proctoring and fraud | Annex III, point 3 (education and training): high risk |
| Financial services | Assessing creditworthiness, Loans or financing, Insurance risk or pricing | Annex III, point 5 (essential services, including credit and insurance): high risk |
| Public sector | Eligibility for a benefit or service, Prioritising requests, Risk profiles | Annex III, point 5 (public benefits and services): high risk |
| Law, enforcement and migration | Legal decision support, Risk of crime or reoffending, Assessing migration, asylum or visa | Annex III, points 6 to 8 (law enforcement, migration and justice): high risk |
| Biometrics, emotion and profiling | Biometric identification or categorisation, Emotion recognition, Inferring sensitive characteristics, Social scoring | The prohibited practices (Article 5) or Annex III, point 1 (biometrics and emotion recognition). Have this assessed first. |
Your own. If your use is not on the list, choose Add your own use case and describe it in your own words, for example "Initial screening of applicants", together with who uses the tool for this and how. BeeSensible does not measure your own use cases, and the register says so.
Recording use cases
Choose from the list
Open Choose use cases and tick what you use the tool for; you choose at least one. Use cases that are already recorded are marked "already recorded".
If BeeSensible sees use that has not been recorded yet, this is shown as well, for example "Regular use that looks like Summarizing (42 prompts). Add it as a use case?" Choose Add as use case to add it to the registration.
Choose the departments
For each use case, choose the departments it applies to, or Whole organisation. If your organisation has no departments yet, set them up first under Organisation.
Answer the question about personal data
The registration asks: "Is personal data processed in this use case?" Think of names, email addresses or CVs. You choose Not known yet, Yes, personal data is processed or No, no personal data is processed. If you choose Yes, you note briefly under Which personal data what data is involved, for example "CVs, customer contact details".
Personal data and the DPIA
To help you answer, the question shows what BeeSensible has found in the tool, for example "Sensitive data found 17 times in ChatGPT in the last 30 days, mostly name and email address. This applies to the whole tool." Detections belong to the tool as a whole rather than to a single use case, and they never include the content of what was typed. The answer to the question is yours to give.
If you answer Yes, a data protection impact assessment (DPIA) may be needed. You record where it stands in the Documents card. One DPIA covers all use cases of the tool. Until the DPIA is in place, the tool appears under Documents open.
Measured says a recorded use case does not occur
BeeSensible has not seen the use case in prompts during the last period. That can be correct, for example when the tool is used only occasionally or when it is a tool in which BeeSensible does not measure. If you still use the tool in this way, keep the use case. The review takes you through the list of use cases again.
Every change to a use case goes into the tool's history. In the CSV export each use case has its own row.
