Regulations and documents
What BeeSensible contributes to compliance with the GDPR, NIS2 and the AI Act, what your organisation still does itself and how to request the data processing agreement.
BeeSensible supports compliance with privacy and AI rules, but does not guarantee it. It does not replace your own privacy assessment, record of processing activities or policy decisions. The customer remains responsible for its own compliance with laws and regulations.
Who is responsible for what?
The customer is the controller; BeeSensible is the processor. We sign a data processing agreement (DPA) with every customer. A product DPIA is available on request; the customer's own DPIA remains the customer's responsibility.
The customer also chooses and documents the legal basis for the processing, for example legitimate interest (Article 6(1)(f) GDPR) or a public task (Article 6(1)(e)). We advise involving the works council before you roll BeeSensible out. BeeSensible is not built to review, profile or monitor employees, and typed text is never used to train a model.
Hosting runs on ISO 27001-certified infrastructure in the EU. BeeSensible itself holds no certification.
What does BeeSensible contribute to each regulation?
- GDPR. Less personal data in AI tools and other apps (data minimisation, Article 5(1)(c)) and security of processing (Article 32(1)). The AI register is input for your record of processing activities (Article 30) and a DPIA (Article 35), not a replacement.
- NIS2 and the Dutch Cybersecurity Act (Cyberbeveiligingswet). Insight into risks and into the vendors behind the AI tools your organisation uses, and awareness among employees.
- AI Act. Support for AI literacy (Article 4) and an indicative classification for each tool and each use case.
The Accountability screen brings this together for a month or a quarter: three topics with two figures each and, for each provision, what the law says, what BeeSensible contributes and what falls outside its scope. It does not show a compliance status: a figure in BeeSensible is not a legal standard.
Requesting documents
The formal DPA, DPIA and subprocessor list are authoritative. Email trust@beesensible.eu for the current versions.
