A legal advisory engagement
Assesses your role, your systems and your obligations.
Indispensable for the assessment. It needs an inventory of which AI is in use, and that inventory ages the moment it is delivered.
EU AI Act compliance software
EU AI Act compliance software: what software can do, and what stays a judgement.
EU AI Act compliance software helps an organisation work on the AI Act. The law places the heaviest obligations on whoever develops AI systems. Most employers develop nothing; they use AI made by others, which makes them a deployer. For that role the part software can carry is manageable: know which AI services are in use, record a decision per tool, show that decision to employees at the moment of work, and show with figures what AI literacy comes to in practice. BeeSensible is a technical aid for that part. It does not judge whether you comply and certifies nothing; that stays with the organisation and its legal adviser.
app.beesensible.eu/shadow-ai/risk
AI tools in use
7
Newly discovered
2
The problem
The law is here, the deadline moved, and the question remains: what do we have to arrange?
Coverage of the AI Act is about providers, conformity assessments and CE marking. For an employer using ChatGPT, Copilot and a recruitment tool, the law is about something smaller and more concrete. That smaller part is where software can help.
The role is unclear
Whoever uses AI from a vendor is a deployer, not a provider. The vendor handles the documentation of the system. What the organisation does with it, and who is responsible for that, remains its own work.
Two obligations already apply, and they ask for evidence
AI literacy (Article 4) and the prohibited practices (Article 5) have applied since 2 February 2025. No certificate is prescribed, but you must be able to answer how you know it works.
High risk often sits in a tool that is already running
AI for recruitment, assessment, promotion or dismissal is listed in Annex III. That function sometimes sits inside an HR system nobody recognised as AI. The Article 26 duties apply to it from 2 December 2027.
Features
What EU AI Act compliance software can and cannot do.
The category runs from GRC suites for providers to a register in a spreadsheet. These are the tasks that belong to the AI Act, with an honest note on which part BeeSensible carries.
| Task | What it involves | BeeSensible |
|---|---|---|
| Inventory of AI services in use | Know which AI tools are opened in the organisation, including the ones nobody requested. | Yes Through the browser extension, domain only, no user id. Every tool in the catalogue of 865 carries an EU AI Act risk field and a risk score. |
| Classification of your own high-risk systems | Determine whether a system you develop or substantially modify falls under Annex III. | No That is legal work based on the intended purpose. The field in the catalogue says something about the tool, nothing about your use of it. |
| Conformity assessment and technical documentation | The provider's obligations: risk management, documentation, CE marking. | No For organisations that develop AI systems or place them on the market. A deployer does not need this, and BeeSensible does not do it. |
| Fundamental rights impact assessment (FRIA) | The assessment that public bodies and a limited group of private organisations carry out for a high-risk system. | No Not in the product. Usable as input: which tools are in use and what has been decided about them. |
| Demonstrate AI literacy | Show that employees know what they may do with AI and which data does not belong in a prompt. | Partly Aggregated figures on behaviour at the moment of work: how often a notice was shown and followed, how often sensitive data got a highlight. No training records, no attendance list. |
| Decision and condition per tool | Record per AI tool what the organisation has decided, with its own condition where that fits. | Yes Allowed, limited use, no decision yet, not allowed. Everything starts at "no decision yet"; BeeSensible never chooses for you. |
| Accountability view per framework | Map figures to measures per legal framework, with a status per measure. | Partly Today for the GDPR and NIS2, with an honest "Not substantiated" status where the figures do not carry a measure. |
| Inform employees | Let employees know what has been decided about an AI tool. | Yes At the moment of work: whoever opens a tool with a decision behind it sees that decision in the browser, allowed alternative first. Continuing is always possible. The Article 26 duty to inform workers before deploying a high-risk system is a conversation with staff and the works council, not a notice. |
What it does not do
An aid, not a verdict.
Whoever buys compliance software sometimes hopes the software will give the answer. BeeSensible does not, and that is how it should be.
- No final legal assessment. Whether you comply with the AI Act is determined by the organisation with its adviser, not by a dashboard.
- No certification and no compliance guarantee. The figures substantiate measures; they prove no compliance.
- No conformity assessment, technical documentation or CE marking. That is work for providers.
- No classification of your own systems. The EU AI Act field in the catalogue describes the tool, not how you deploy it.
- No AI Act as a framework in the accountability view. Today it maps figures to measures for the GDPR and NIS2.
- No blocking and no decision on the organisation's behalf. Every status is the customer's choice, and everything starts at "no decision yet".
The approach
Start with an inventory that is right.
A deployer's obligations all start with the same question: which AI is in use. Then come decision, explanation and substantiation, and then the inventory starts again.
1 See
Which AI is really in use
Every AI tool people open comes into view, counted anonymously, with the EU AI Act field and the risk score from the catalogue attached.
2 Decide
A decision per tool
High risk, prohibited function or ordinary use: that classification is yours to make. In BeeSensible you record per tool what was decided, with a condition where that fits.
3 Help
The decision reaches the employee
Whoever opens a tool with a decision behind it sees that decision. Sensitive data gets a highlight while someone types. That makes AI literacy concrete at the moment it counts.
4 Substantiate
What you can substantiate, and what not
How often a notice was followed, how often a highlight changed something, how much use runs through allowed tools. With "not substantiated" where the figures are silent.
and again How the cycle works
Why this approach
Next to what already exists, not instead of it.
A legal engagement, a GRC suite, a spreadsheet and waiting: each answers a different part of the question. None of the four sees what happens in the browser today.
A GRC suite
Manages policies, risks and controls for the whole organisation.
Built for providers and large programmes. Records what someone enters, does not see what people open.
An AI register in Excel
A list of tools, owners and decisions.
Describes the day it was made. A tool nobody reported is not in it.
Waiting for enforcement
Watching what the regulator does with the first cases.
Articles 4 and 5 have applied since February 2025, and the GDPR never waited.
Frequently asked questions
What people ask before they choose.
What is EU AI Act compliance software?
Software that helps with the obligations under the AI Act. For providers that means risk management, documentation and conformity assessment. For employers that use AI made by others it is a smaller part: knowing which AI is in use, deciding per tool, informing employees and substantiating AI literacy. BeeSensible focuses on that second part.
Are we a provider or a deployer?
If you use an AI system developed by someone else, under your own authority and for your own work, you are a deployer. You become a provider if you develop a system yourself, release one under your own name, or modify an existing system so that it gets a different purpose or a higher risk. For most employers the first role is the only one.
Which obligations already apply?
Since 2 February 2025: measures for AI literacy (Article 4) and the prohibited practices (Article 5), including emotion recognition in the workplace. Since 2 August 2026, the Article 50 transparency rules for anyone deploying a chatbot towards customers. The obligations for high-risk systems under Annex III, such as AI for recruitment and assessment, apply from 2 December 2027 after the Digital Omnibus.
Does BeeSensible make us AI Act compliant?
No, and no software does. BeeSensible shows which AI is in use, records decisions, shows them at the moment of work and delivers figures without a user id. Whether that adds up to compliance is for the organisation and its legal adviser to judge. The accountability view maps figures today to measures for the GDPR and NIS2.
Does it help with high-risk systems in HR?
Partly. BeeSensible shows that a tool is in use and what has been decided about it. Whether that tool is a high-risk system, how human oversight is arranged and what goes into the FRIA remains the organisation's work. The inventory is useful input for that.
Further reading
The AI Act, one question at a time.
Start with the inventory every obligation starts from.
Fourteen days free, every module, no credit card. After two weeks you know which AI tools are in use, and which still lack a decision.
14 days free, no credit card. Rolled out across your organisation within the hour.
