Training
Lays the foundation: what counts as sensitive data, and what the rules are.
BeeSensible helps people apply that knowledge: a BSN in the text field is highlighted as they type.
AI governance software Netherlands
Dutch AI governance software that your DPO and works council can support.
Why look for a Dutch vendor? Usually for three reasons: processing in Europe by European companies, measurement that holds up under the GDPR, and a design a works council can accept. BeeSensible is made in the Netherlands and built around those expectations. It shows which AI tools are in use, records a decision for each tool and shows that decision when someone opens the tool. The figures carry no user ID and are stored on our own servers, hosted by European providers.
Prefer to try it yourself? 14 days free, no credit card.
app.beesensible.eu/insights/compliance
AI tools in use
7
Newly discovered
2
The problem
Everyone uses AI. Are you allowed to measure it?
Most organisations have an AI policy and a tool they bought. What they lack is a view of what happens alongside it, in a form a DPO and a works council can support. Much of the software in this category is built around a per-employee view, with data processed by a provider subject to US law. In the Netherlands, that is where the objections start.
Measuring quickly starts to look like monitoring
Many tools answer "which AI is in use" with a list per person. Under the GDPR, that is processing you have to justify. Under Dutch law, a facility suited to monitoring staff is a matter for the works council.
The data crosses a border twice
A prompt with a citizen service number (BSN) or a client name that ends up in a US AI tool is one problem. Governance software that stores that same prompt with a US provider is a second.
The decision never reaches the text field
A policy on the intranet is not always to hand while people work. And a BSN in pasted text is easy to miss.
Features
Which features AI governance software in the Netherlands needs, and what BeeSensible covers.
The same features as in the wider category, plus the questions that carry extra weight in the Netherlands. For each row, whether BeeSensible covers it fully, partly or not at all.
| Feature | What it does | BeeSensible |
|---|---|---|
| Discover AI tools | See which AI services are opened in the organisation, including the ones nobody requested. | Yes Through the browser extension. Only the tool's domain, without a user ID. |
| Record policy per tool | A decision per tool: allowed, limited use, not allowed or no decision yet. | Yes Everything starts at "no decision yet". The risk score from the catalogue of over 1,000 tools is advice; the organisation chooses. |
| Notices in Dutch and English when a tool is opened | Show the decision when someone opens a tool, with the allowed alternative first. | Yes A notice in the browser, in Dutch or English. People can still continue, unless the organisation has chosen otherwise. |
| Recognise Dutch data types | Highlight BSNs, IBANs, phone numbers, names, addresses and medical details as someone types. | Yes In Dutch and English text, in the apps you already work in. In each detection profile, you choose which types are highlighted, and where. |
| Processing in Europe | Know where typed text goes, who owns the servers and which law applies. | Yes Our own servers at Scaleway in Amsterdam and Hetzner in Germany: European companies, with ISO 27001 certified hosting. Text is processed in memory and discarded straight away. |
| Measurement without a profile per employee | Know how many people use AI and with which tools, without knowing who. | Yes The figures on AI use carry no user ID. Department figures only appear for groups of at least 5 people, over at least 7 days. |
| Accountability per provision | Six figures per period, mapped to provisions of the GDPR, NIS2 and the AI Act, and shows, for each provision, what the figures do not cover. | Yes The Accountability screen, switched on per organisation. A missing figure is never shown as a zero. |
| Documents for the DPO and the works council | Documentation the organisation can use to assess the processing and put it to the works council. | Partly A data processing agreement (DPA) with every customer, a product DPIA on request, and documentation of what is and is not processed. The DPIA for your own deployment and the conversation with the works council are still up to the organisation. |
| Per-employee view | See who uses which tool and what someone typed. | No Deliberately not. No drill-down per person, no content, no user ID in the figures. |
| Block or enforce | Make a tool technically inaccessible or rewrite text automatically. | Partly BeeSensible does not block on its own: it shows the decision, and the organisation chooses whether people can still go ahead with a tool that is not allowed, and how warnings and masking are set up. |
What it does not do
What BeeSensible does not do, so your DPO and works council know up front.
These are deliberate design choices, and you can put them to the works council.
- No user ID and no stored text. The organisation sees "three people use AI daily", never who or what they typed.
- No decision on the organisation's behalf. Every tool starts at "no decision yet"; the risk score is advice.
- No DPIA on your behalf. BeeSensible supplies the documents; the assessment is for the controller to make.
The approach
From seeing AI use to proving your policy works, with the works council involved from the start.
See, decide, help, substantiate: four steps that follow each other and then start again. In the Netherlands, the first step often starts before rollout, with the question of what is processed.
1 See
Which AI is running
Every AI tool people open comes into view, counted anonymously. Explain to the works council beforehand what is processed: the tool's domain, no person, no content.
2 Decide
A decision per tool
Allowed, limited use on a condition you write yourself, not allowed, or deliberately no decision yet. The organisation chooses; the catalogue with vendor, country of processing and risk score helps.
3 Help
The decision, when someone opens the tool
Anyone who opens a tool the organisation has decided on sees that decision in the browser, with the alternative first. A BSN or IBAN in a prompt is highlighted as they type.
4 Substantiate
What happened next
The share of AI use through allowed tools and how often a notice was followed. Accountability maps those figures to provisions of the GDPR, NIS2 and the AI Act, and shows, for each provision, what the figures do not cover.
and again How the cycle works
Why this approach
How this fits with training, monitoring and blocking.
Each of the three has a place. BeeSensible shows which AI is in use in a way a DPO and a works council can support, and helps people while they work.
Employee monitoring
Records, person by person, who uses which tool.
A facility suited to monitoring, and so a matter for the works council. You do not need it to see what is going on across the organisation.
Blocking AI
Shuts off the known tools.
Without a workable alternative, people find another route, such as their phone, and you lose sight of it.
Frequently asked questions
What people ask before they choose.
Is BeeSensible a Dutch product?
Yes. BeeSensible is made in the Netherlands, the detection handles Dutch and English text, and the notices and dashboard are available in both languages.
Does the Dutch works council have to consent?
Article 27 of the Dutch Works Councils Act (WOR) gives the works council a right of consent over monitoring facilities. Those are facilities suited to observing or checking the conduct or performance of employees. Whether BeeSensible falls under that is for the organisation to assess, preferably together with the council. The design helps that conversation: no user ID in the figures on AI use, no content, no drill-down per person. Involve the works council before rollout. The documentation describes what is and is not processed.
How does it relate to the GDPR and the Dutch supervisory authority?
The organisation is the controller, BeeSensible the processor, and a DPA is signed with every customer. The product DPIA is available on request. BeeSensible keeps counts, types, apps, timestamps and choices; typed text is processed in memory and discarded at once. That puts data minimisation and accountability into practice. Whether your deployment is lawful remains the organisation's assessment. The supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Does the detection recognise Dutch data types?
Yes. BSNs and IBANs are recognised by fixed rules; names, addresses and medical details by trained models, in Dutch and English text. In each detection profile, you choose which types are highlighted, and where: for each app or group of apps. Languages other than Dutch and English are not supported.
Where is the data processed?
On our own servers at Scaleway in Amsterdam and, for the models, at Hetzner in Germany. Those are European companies, not European regions of a US cloud, and both are ISO 27001 certified. BeeSensible itself holds no certification.
Can we use it outside the Netherlands?
Yes. The interface is available in Dutch and English, and processing works the same way for every customer.
Further reading
More on the GDPR, the works council and measuring without tracking.
See which AI tools are running, without tracking anyone.
Every module is included. What your DPO and works council will want to know is in the documentation, ready before you start.
14 days free, no credit card. Rolled out across your organisation within an hour.
