A training
Makes people aware on the day itself.
Knowledge is no guarantee of behaviour. A highlight at the moment the BSN sits in the text field helps at that moment.
AI governance software Netherlands
AI governance software from the Netherlands: a view of AI use, without surveillance of people.
AI governance software helps an organisation keep its AI use responsible and demonstrable. Buyers who look for a Dutch vendor usually have a reason: they want processing in Europe by European companies, a measurement that holds up under the GDPR, and a design a works council can accept. BeeSensible is made in the Netherlands and built around those expectations. It shows which AI tools are in use, records a decision per tool, shows that decision at the moment of work and substantiates it with figures without a user id, processed on its own servers at European providers.
app.beesensible.eu/shadow-ai/risk
AI tools in use
7
Newly discovered
2
The problem
Everyone uses AI. The question is whether you may measure it, and how.
Most organisations have an AI policy and a tool they bought. What they lack is a view of what happens next to it that a data protection officer and a works council can support. Much of the software in this category was built for a view per employee, processed at a provider under US law. In the Netherlands that is exactly where the objections start.
Measuring soon looks like monitoring
Many tools answer "which AI is in use" with a list per person. Under the GDPR that is processing you have to justify, and under Dutch law a facility suited to monitoring staff is a matter for the works council.
The data crosses a border twice
A prompt with a national identifier or a client name that lands in a US AI tool is one problem. Governance software that stores that same prompt at a US provider is a second.
The decision never reaches the text field
A policy on the intranet does not help at the moment someone with a deadline opens a tool. And someone who pastes a citizen service number into a prompt does so out of haste, not defiance.
Features
What to expect from Dutch AI governance software.
The same features as in the wider category, plus the questions that count extra in the Netherlands. Per row, what BeeSensible does fully, partly and not at all.
| Feature | What it does | BeeSensible |
|---|---|---|
| Discover AI tools | See which AI services are opened in the organisation, including the ones nobody requested. | Yes Through the browser extension, domain only, at most once a day per device, without a user id. |
| Record policy per tool | A decision per tool: allowed, limited use, not allowed or no decision yet. | Yes Everything starts at "no decision yet". The risk score from the catalogue of 865 tools is advice; the organisation chooses. |
| Notice at the moment of work, in Dutch and English | Show the decision at the moment someone opens a tool, with the allowed alternative first. | Yes A notice in the browser, in Dutch or English. People can always continue. |
| Recognise Dutch data types | Highlight the BSN (the Dutch citizen service number), IBAN, phone numbers, names, addresses and medical details while someone types. | Yes In Dutch and English text, in the apps you already work in. Which types are highlighted where is set per detection profile. |
| Processing in Europe | Know where typed text goes, who owns the servers and which law applies. | Yes Own servers at Scaleway in Amsterdam and Hetzner in Germany: European companies, ISO 27001 certified hosting. Text is processed in memory and discarded at once. |
| Measurement without a profile per employee | Know how many people use AI and with which tools, without knowing who. | Yes The figures on AI use carry no user id. Department insight only from 5 people and 7 days. |
| Substantiation per framework | Map figures to measures under the GDPR and NIS2, and show which measure is not substantiated. | Yes The accountability view, switched on per organisation, with an honest "not substantiated" status. |
| Documents for the DPO and the works council | Documentation the organisation can use to assess the processing and put it to the works council. | Partly A processing agreement with every customer, a product DPIA on request, and documentation of what is and is not processed. The DPIA for your deployment and the conversation with the works council remain the organisation's work. |
| Per-employee view | See who uses which tool and what someone typed. | No Deliberately not. No drill-down per person, no content, no user id in the streams. |
| Block or enforce | Make a tool technically inaccessible or rewrite text automatically. | No Deliberately not. The decision is shown, not enforced. The employee keeps their hands on the keyboard. |
What it does not do
For a DPO and a works council, the limit matters as much as the feature.
This is what BeeSensible does not do, and it is a choice you can put to the works council.
- No user id in the figures on AI use. The organisation sees "three people use AI daily", never who.
- No storage of prompts or typed text. Detection runs in memory, is discarded at once, and involves no external AI service.
- No blocking. A "not allowed" decision is shown; the employee can continue.
- No decision on the organisation's behalf. Every tool starts at "no decision yet"; the risk score is advice.
- No department figures below the threshold of 5 people and 7 days in standard mode.
- No compliance guarantee and no DPIA in your place. The figures substantiate measures; the assessment stays with the controller.
- No model validation and no conformity assessment of high-risk systems.
The approach
See, decide, help, substantiate. With the works council and the DPO from the start.
Four steps that follow each other and then start again. In the Netherlands the first step often begins before rollout, with the question of what exactly is processed.
1 See
Which AI is really running
Every AI tool people open comes into view, counted anonymously. Put to the works council beforehand what is processed: the tool's domain, no person, no content.
2 Decide
A decision per tool
Allowed, limited use with your own condition, not allowed, or deliberately no decision yet. The organisation chooses; the catalogue with vendor, country of processing and risk score helps.
3 Help
The decision at the moment of work
Someone who opens a tool with a decision behind it sees it in the browser, alternative first. A BSN or IBAN in a prompt gets a highlight while they type.
4 Substantiate
What happened next
The share of AI use through allowed tools, how often a notice was followed, and per measure under the GDPR or NIS2 whether the figures carry it.
and again How the cycle works
Why this approach
Against what Dutch organisations have already tried.
Training, employee monitoring, blocking and waiting each have a place. None of the four shows which AI is in use in a way a DPO and a works council can support.
Employee monitoring
Records per person who uses which tool.
A facility suited to monitoring, so a matter for the works council, and processing you have to justify under the GDPR. Not needed to see what is going on across the organisation.
Blocking AI
Shuts the known tools.
Moves the use to the phone and removes the view. The BSN goes along.
Doing nothing
Trusting the policy and good intentions.
Works until the first question from the DPO, a customer or the Dutch Data Protection Authority.
Frequently asked questions
What people ask before they choose.
Is BeeSensible a Dutch product?
Yes. BeeSensible is made in the Netherlands, the detection handles Dutch and English text, and the notices and dashboard are available in both languages. Processing runs on its own servers at Scaleway in Amsterdam and Hetzner in Germany.
Does the Dutch works council have to consent?
Article 27 of the Dutch Works Councils Act (WOR) gives the works council a right of consent over arrangements for facilities aimed at or suited to observing or checking the conduct or performance of employees. Whether BeeSensible falls under that is for the organisation to assess, preferably together with the council. The design helps that conversation: no user id in the figures on AI use, no content, no drill-down per person. We advise involving the works council before rollout; the documentation describes exactly what is and is not processed.
How does it relate to the GDPR and the Dutch regulator?
The organisation is the controller, BeeSensible the processor, and a processing agreement is signed with every customer. The product DPIA is available on request. What BeeSensible keeps is counts, types, apps, timestamps and choices; typed text is processed in memory and discarded at once. That makes data minimisation and accountability concrete. Whether your deployment is lawful remains the organisation's assessment, and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is the supervisor.
Does the detection recognise Dutch data types?
Yes. The BSN and IBAN fall under the fixed rules, names, addresses and medical details under the trained models, in Dutch and English text. Which types are highlighted where is set per detection profile, per app or per group of apps. Languages other than Dutch and English are not supported.
Where is the data processed?
On own servers at Scaleway in Amsterdam and, for the models, at Hetzner in Germany. Those are European companies, not European regions of a US cloud, and both are ISO 27001 certified. BeeSensible itself holds no certification. Organisations that prefer to run detection on the device itself can do so through the desktop app; that is a per-organisation setting we switch on at request.
Can we use it outside the Netherlands?
Yes. The detection handles Dutch and English, the interface is available in both, and the processing at Scaleway and Hetzner is the same for every customer. Other languages are not supported.
Further reading
The Dutch questions, one at a time.
See within a day which AI tools are running in your organisation, without tracking anyone.
Fourteen days free, every module, no credit card. What your DPO and works council want to know is in the documentation, before you start.
14 days free, no credit card. Rolled out across your organisation within the hour.
