A legal advisory engagement
Assesses your role, your systems and your obligations.
Indispensable for the assessment. It needs an inventory of which AI is in use, and that inventory ages the moment it is delivered.
EU AI Act compliance software
EU AI Act compliance software: what employers need to do, and where software helps.
The AI Act places the heaviest obligations on whoever develops AI systems. Most employers develop nothing; they use AI made by others, which makes them a deployer. For that role, the part software can handle is manageable: knowing which AI services are in use, recording a decision for each tool, showing that decision when someone opens the tool, and using figures to show what AI literacy looks like in practice. BeeSensible helps with that part. It does not judge whether you comply and certifies nothing; that is for the organisation and its legal adviser to decide.
Prefer to try it yourself? 14 days free, no credit card.
app.beesensible.eu/insights/compliance
AI tools in use
7
Newly discovered
2
The problem
The law is here. What do we need to do?
Most coverage of the AI Act is about providers, conformity assessments and CE marking. For an employer using ChatGPT, Copilot and a recruitment tool, the law is about something smaller and more concrete. That smaller part is where software can help.
The role is unclear
If you use AI from a vendor, you are a deployer, not a provider. The vendor handles the system's documentation. What the organisation does with it, and who is responsible for that, is still its own job.
Two obligations already apply
AI literacy (Article 4) and the prohibited practices (Article 5) have applied since 2 February 2025. No certificate is prescribed. But you must be able to explain how you know it works.
High-risk AI is often in a tool you already use
AI for recruitment, assessment, promotion or dismissal is listed in Annex III. That function is sometimes built into an HR system nobody recognised as AI. The Article 26 duties apply to it from 2 December 2027.
Features
Which tasks the AI Act gives you, and which part BeeSensible handles.
The category runs from GRC suites for providers to a register in a spreadsheet. These are the tasks that come with the AI Act, and for each one, which part BeeSensible handles.
| Task | What it involves | BeeSensible |
|---|---|---|
| Inventory of AI services in use | Know which AI tools are opened in the organisation, including the ones nobody requested. | Yes Through the browser extension, domain only, no user ID. Every tool in the catalogue of over 1,000 has an indicative EU AI Act classification and a risk score. |
| Classification of your own high-risk systems | Determine whether a system you develop or substantially modify falls under Annex III. | No That is legal work based on the intended purpose. The indicative classification in the catalogue says something about the tool, nothing about your use of it. |
| Conformity assessment and technical documentation | The provider's obligations: risk management, documentation, CE marking. | No For organisations that develop AI systems or place them on the market. A deployer does not need this, and BeeSensible does not do it. |
| Fundamental rights impact assessment (FRIA) | The assessment that public bodies and a limited group of private organisations carry out for a high-risk system. | No Not in the product. Usable as input: which tools are in use and what has been decided about them. |
| Demonstrate AI literacy | Show that employees know what they may do with AI and which data does not belong in a prompt. | Partly Aggregated figures on what people do while they work: how often a notice was shown and followed, how often sensitive data was highlighted. No training records, no attendance lists. |
| Decision and condition per tool | Record for each AI tool what the organisation has decided, with a condition of its own where relevant. | Yes Allowed, limited use, no decision yet, not allowed. Everything starts at "no decision yet"; BeeSensible never chooses for you. |
| Accountability per provision | Figures mapped to provisions of the GDPR, NIS2 and the AI Act. For each provision, it shows what the law says, what BeeSensible contributes and what it does not cover. | Yes From the AI Act, Article 4(1) (AI literacy) is included, with what the figures do not show: whether employees are sufficiently trained. |
| Inform employees | Let employees know what has been decided about an AI tool. | Yes When someone opens a tool the organisation has decided on, they see that decision in the browser, with the alternative first. People can still continue, unless the organisation has chosen otherwise. The Article 26 duty to inform workers before deploying a high-risk system is a conversation with staff and the works council, not a notice. |
What it does not do
What BeeSensible does not assess for you.
The assessment stays with your organisation. BeeSensible supplies the inventory and the figures. It does not do the following.
- No final legal assessment and no certification. Whether you comply with the AI Act is for the organisation and its adviser to determine.
- No conformity assessment, technical documentation or CE marking. That is work for providers.
- No classification of your own systems and no status per article. The indicative classification in the catalogue describes the tool, not how you deploy it.
The approach
First know which AI is in use, then decide, explain and back it up.
A deployer's obligations start with the same question: which AI is in use. Then come the decision, the explanation and the evidence. After that, the inventory starts again.
1 See
Which AI is in use
Every AI tool people open comes into view, counted anonymously, with the indicative EU AI Act classification and the risk score from the catalogue attached.
2 Decide
A decision per tool
High risk, prohibited function or ordinary use: that classification is yours to make. In BeeSensible you record for each tool what was decided, with a condition where relevant.
3 Help
The decision reaches the employee
Anyone who opens a tool the organisation has decided on sees that decision. Sensitive data is highlighted as someone types. That turns AI literacy into action at the moment it counts.
4 Substantiate
What you can show, and what you can't
How often a notice was followed, how often a highlight changed something, how much use runs through allowed tools. For each provision, it shows what the figures do not cover, and a missing figure is never shown as a zero.
and again How the cycle works
Why this approach
How this fits with your legal adviser, GRC suite or register.
A legal engagement, a GRC suite and a spreadsheet each answer a different part of the question. None of them sees which AI tools are opened today.
A GRC suite
Manages policies, risks and controls for the whole organisation.
Built for providers and large programmes. It records what someone enters, but does not see what people open.
An AI register in Excel
A list of tools, owners and decisions.
Describes the day it was made. A tool nobody reported is not in it.
Frequently asked questions
What people ask before they choose.
What is EU AI Act compliance software?
Software that helps with the obligations under the AI Act. For providers that means risk management, documentation and conformity assessment. For employers that use AI made by others it is a smaller part: knowing which AI is in use, deciding on each tool, informing employees and backing up AI literacy. BeeSensible focuses on that second part.
Are we a provider or a deployer?
If you use an AI system developed by someone else, under your own authority and for your own work, you are a deployer. You become a provider if you develop a system yourself, release one under your own name, or give an existing system a different purpose or a higher risk. For most employers the first role is the only one.
Which obligations already apply?
Since 2 February 2025: measures for AI literacy (Article 4) and the prohibited practices (Article 5), including emotion recognition in the workplace. Since 2 August 2026, the Article 50 transparency rules for anyone deploying a customer-facing chatbot. The obligations for high-risk systems under Annex III, such as AI for recruitment and assessment, apply from 2 December 2027 after the Digital Omnibus.
Does BeeSensible make us AI Act compliant?
No. BeeSensible supports your measures: it shows which AI is in use, records decisions, shows them when someone opens a tool and delivers figures without a user ID. Whether that adds up to compliance is for the organisation and its legal adviser to judge. Accountability maps the figures to provisions of the GDPR, NIS2 and the AI Act, and shows, for each provision, what the figures do not cover.
Does it help with high-risk systems in HR?
Partly. BeeSensible shows that a tool is in use and what has been decided about it. Whether that tool is a high-risk system, how human oversight is arranged and what goes into the FRIA is still up to the organisation. The inventory is useful input for that.
Further reading
The AI Act, one question at a time.
Start with the inventory that every obligation builds on.
Every module is included. After two weeks you know which AI tools are in use, and which still lack a decision.
14 days free, no credit card. Rolled out across your organisation within an hour.
