Blog | BeeSensible

Featured

AI governance September 11, 2026 9 min read

What is AI governance, and what does it mean for everyday AI use?

AI governance sounds like a topic for teams that build models. For most organisations it is about something else: which AI tools staff actually use, what has been decided about them, and whether that decision holds during the working day.

AI governance is the set of decisions, agreements and evidence an organisation uses to handle AI responsibly. For most organisations that is not about building or validating models. It is about the everyday use of existing AI services by employees. The questions that come with it: which tools are actually in use, which are allowed, which have no decision yet, what sensitive information passes through, do people know the decision at the moment they open a tool, and can you show afterwards that the policy was applied. That takes figures at organisation level, not oversight of individuals.

Read the article

Browse by topic

AI data leakage Email privacy GDPR and workplace AI Safe AI adoption Compliance and AI Comparisons AI governance

When is an AI application high-risk under the AI Act?

High risk attaches to the purpose an AI system is intended for, not to the technology inside it. Annex III lists the purposes, and part of that list touches every employer: recruitment, assessment, access to services, education.

Read the article

Compliance and AI 6 min read

How do you demonstrate AI literacy?

An attendance list says something about the day of the course. An auditor asks about the Monday after. Three kinds of evidence, what each does and does not show, and what you honestly call not substantiated.

Read the article

Abstract floating tiles in teal and sand

AI governance 8 min read

What is shadow AI, and why does a ban not solve it?

Shadow AI is AI use that people started on their own, without a decision from the organisation. It appears because the work gets easier, not out of bad faith, and a ban mostly makes it invisible. What helps is a decision per tool.

Read the article

Trust and proof 8 min read

A dashboard is not evidence

Numbers show something happened. Evidence requires showing that a control was designed, that it ran, and what it says nothing about.

Read the article

Compliance and AI 6 min read

AI literacy for school staff: what does the AI Act ask of schools?

Article 4 of the AI Act applies to schools too, with no course, certificate or hour count attached. What it does ask, why the bar sits higher in education for some roles, and what sufficient means per role.

Read the article

AI governance 6 min read

Which AI tools may employees use?

The answer is not printed on the tool. It is a decision the organisation takes. How to build a list that matches what is already in use, and what to do with the tool that turns up tomorrow.

Read the article

GDPR and workplace AI 5 min read

Do you need a DPIA for AI tools at work?

The GDPR requires a DPIA when processing is likely to result in a high risk. Generative AI at work often meets several of the criteria at once. When it is required, what goes in it, and why the DPIA describes but does not demonstrate.

Read the article

Trust and proof 8 min read

What are all those AI metrics for? From dashboard to accountability

Detections, shadow AI, AI use per tool: the numbers are easy to collect. The question is what they get you with the GDPR, NIS2, and the AI Act. On seeing, helping, and substantiating, and why the order matters.

Read the article

AI governance 9 min read

An AI register: what it is and what you record in it

An AI register is the list of AI tools and applications an organisation uses: who owns each one, what it is for, which data goes in and what has been decided. The fields that belong in it, and why the list is never complete.

Read the article

AI governance 6 min read

What is an AI governance framework, and do you need one?

ISO/IEC 42001, the NIST AI RMF and the AI Act are all called frameworks, and all three are something different. For most organisations a small framework of four questions about the AI use that already exists is enough.

Read the article

AI governance 9 min read

AI governance without monitoring employees

An organisation can know which AI tools are in use, whether its policy lands and where the risk sits, without a single person appearing in the figures. That is not a compromise but a design, made of five choices you make up front.

Read the article

Abstract sphere above soft waves on the horizon

AI governance 6 min read

We have Copilot. Why do employees still use other AI tools?

The organisation bought a safe route, and yet ChatGPT, Perplexity and Gamma are open in the browser. That is not disobedience. It shows what people are trying to get done, and where the preferred route apparently falls short.

Read the article

Abstract route with nodes through soft shapes

AI governance 9 min read

Writing an AI policy: from agreements on paper to something that works at the desk

An AI policy that works does not start from a template. It starts from the questions a colleague wants answered on a Tuesday afternoon: which tools, for what, with which data, and what to do when the answer does not exist yet.

Read the article

Compliance and AI 9 min read

NEN 7510 in 2026: the new standard, the deadlines, and what healthcare arranges now

Dutch healthcare is in two transitions at once: the revised NEN 7510:2024 with a certification deadline in February 2027, and the Cyberbeveiligingswet taking effect on 15 August. What the standard asks and how to make it demonstrable.

Read the article

AI governance 6 min read

Four statuses for AI tools: allowed, limited use, not allowed and no decision yet

A list of yes and no leaves most tools unnamed, and everyone reads a tool that is not on the list differently. Four statuses, one of which is the honest starting point, keep the decision with the organisation.

Read the article

Compliance and AI 5 min read

Does every employee need AI training?

Article 4 of the AI Act asks for measures per role and context, not one course for everyone. What does apply to every employee, what differs per role, and why the explanation only works once the decision is also visible at the moment of work.

Read the article

AI governance 8 min read

Microsoft Copilot governance: what do you arrange beyond the technical setup?

Assigning licences, cleaning up permissions and turning off flex routing is the technical side. Next to it sit seven decisions no setting makes for you, from which variant is allowed to how you measure use without tracking people.

Read the article

Compliance and AI 9 min read

The Netherlands has its NIS2 law: what applies from 15 August

Almost two years late, NIS2 is now Dutch law. From 15 August 2026, the duty of care, the reporting duty, and the registration duty apply to more than 8,000 organisations. The timeline, the duties, and what to arrange now.

Read the article

AI governance 6 min read

AI governance for mortgage and insurance organisations

At mortgage lenders and insurers, AI sits in two places: in the processes themselves, such as underwriting and pricing, and in the daily work of advisers and handlers. The first place gets the attention, the second gets the use. Governance covers both.

Read the article

AI governance 9 min read

Measuring AI adoption: which numbers mean something, and how to measure without tracking people?

A board wants to know whether AI is being used in the organisation and where it adds something. A handful of figures at organisation level answers that, with no person attached to any of them. Which figures those are, and which you can leave out.

Read the article

Compliance and AI 9 min read

AI literacy in 2026: what is actually required of organisations?

Article 4 of the AI Act has applied since February 2025, yet it prescribes no course, no certificate and no number of hours. What the article does say, what sufficient means per role, and why knowledge is half the job.

Read the article

AI governance 9 min read

How do you assess the risk of an AI tool?

There is no magic score. There are nine dimensions that matter, from what happens to your input to which personal data is likely to end up in it. And the reason the same tool can be low risk and high risk at once.

Read the article

Compliance and AI 9 min read

AI in financial services: control over client data, with evidence for your supervisor

Meeting notes full of account numbers end up in ChatGPT faster than any policy can catch. What that means for a regulated firm, and how to keep control without banning AI.

Read the article

Abstract ribbons crossing in teal and gold

AI governance 6 min read

AI governance for financial services: client data, the AFM and DORA

An adviser has an intake meeting summarised, the back office a claim. The data in those texts belongs to clients, and the firm is supervised. Which AI is in use, what the firm decides about it, and how you show that later.

Read the article

Abstract connected cards as a flow chart

AI governance 5 min read

How do you find out which AI tools employees actually use?

Network logs, surveys, invoices and SSO each see part of the AI use and each miss a different part. What they share: a snapshot ages. What you need is observation in the browser, continuous, with no user id.

Read the article

GDPR and workplace AI 8 min read

The AI Act timeline after the Digital Omnibus: what moved and what did not

Days before 2 August 2026, Brussels pushed the high-risk deadlines back to 2027 and 2028. The transparency rules and the fines carry on as planned. Here is the full timeline.

Read the article

Abstract soft rectangles in teal and gold

Compliance and AI 6 min read

Is an AI register mandatory under the EU AI Act?

No, not as one universal register for every organisation. There are registration and documentation duties that depend on your role and the systems you deploy, and the GDPR asks for its own record. What the law says, and why organisations keep a register anyway.

Read the article

Compliance and AI 8 min read

The EU AI Act for employers: what do you have to arrange in practice?

Most employers do not build AI, they use it. The AI Act calls that role deployer, and the list that comes with it is shorter than the coverage suggests. What applies today, what applies from December 2027, and where ChatGPT fits in.

Read the article

Compliance and AI 6 min read

Is AI literacy mandatory?

Yes, since 2 February 2025. Article 4 of the AI Act asks organisations to take measures towards a sufficient level of AI literacy among the people who use AI on their behalf. What it does not contain: a certificate, a course or an hour norm.

Read the article

Compliance and AI 8 min read

Anonymising, pseudonymising, masking: three words, three consequences

Only genuinely anonymised data falls outside the GDPR. The other two are useful and change none of your obligations.

Read the article

GDPR and workplace AI 6 min read

When must the works council be involved in AI?

An AI policy that only says which tools are allowed calls for consultation. An arrangement that processes employee data or can observe behaviour calls for consent. Where the line runs under Dutch law, and how to bring the works council in before it stalls.

Read the article

AI governance 6 min read

AI governance for municipalities: from council paper to chatbot

In a municipality, AI helps with the council paper, the objection letter and the neighbourhood team's notes. The data that passes through belongs to residents. Which tools are in use, what the municipality decides about them, and how that decision reaches the front desk.

Read the article

Abstract teal waves with connected data points

AI data leakage 8 min read

Where your data goes after you type it

Three vendors all say they process in Europe, and all three are telling the truth. The difference is not where the server sits, but what happens to your text after it arrives.

Read the article

AI governance 6 min read

AI register example: what a completed register looks like

Five rows from a fictional AI register, from a free ChatGPT account to an HR tool that pre-sorts applications, with the reason behind every column. Two rows sit at no decision yet, and that is exactly right.

Read the article

AI data leakage 8 min read

What is prompt injection, and why is it not a hacker story?

A model cannot separate your instruction from text it encounters along the way. Once it can also act, that stops being a curiosity and becomes a governance question.

Read the article

Compliance and AI 5 min read

ChatGPT and the AI Act: what changes for users at work?

The heavy obligations of the AI Act sit with OpenAI as the provider, not with the employee who uses ChatGPT. Three things change for you at work: your organisation has to explain, a few applications are prohibited or high-risk, and a chatbot facing the public has to make clear it is AI.

Read the article

Compliance and AI 8 min read

Approving an AI tool: what to ask the vendor

Six questions, with what a usable answer looks like and what an evasive one looks like. Built to be used in a call, not filed in a folder.

Read the article

AI governance 5 min read

How often should you review your AI policy?

There is no fixed rhythm. You review an AI policy when something prompts it, and at least once a year when nothing does. Three numbers tell you whether it is time, and what needs to change.

Read the article

AI data leakage 8 min read

What is an MCP server, and what are you connecting to it?

Integrations between AI tools and your own systems now take a few clicks, often from the employee's own laptop. Here is what actually happens.

Read the article

AI governance 6 min read

Which KPIs do you use for AI adoption?

A board wants to know whether AI is used, whether it runs through the agreed route, and whether the agreements work. Eight KPIs that answer that, with for each one what it says, what it does not say, and whether it can be measured without a user id.

Read the article

AI DLP 6 min read

"Save as PDF" does not remove what you think

Comments, tracked changes, hidden columns, speaker notes. What travels out of Word, Excel and PowerPoint when you export.

Read the article

Abstract spiral with data points in teal

AI governance 6 min read

AI adoption versus AI governance: why each needs the other

IT wants more people using the AI tool the organisation paid for. The privacy officer wants fewer tools without a decision. They look like two agendas, but they are the same figures seen from two sides, and they get better together.

Read the article

AI data leakage 8 min read

Why an AI agent needs permissions

An agent acts on your behalf, so it acts with your permissions. Why least privilege is harder for agents than for people, and what holds up instead.

Read the article

AI DLP 7 min read

Why removing names is not enough

Postcode, date of birth and gender together identify most people. On quasi-identifiers, and why anonymising is arithmetic rather than deletion.

Read the article

Safe AI adoption 5 min read

What is safe AI adoption in an organisation?

Safe AI adoption is not as little AI as possible. It is use the organisation knows about, through a fitting account, with sensitive data kept out of the prompt, with a decision that is known when someone opens the tool, and with figures that show it.

Read the article

AI data leakage 6 min read

ChatGPT and client files: a client's annual accounts in a chatbot

Explaining a ledger, rewriting the notes, tidying a client email: the task is fine, the client is not. What you strip from the file before you paste, what a business account changes and what it does not, and what the firm arranges.

Read the article

AI governance 6 min read

AI register in Excel or in software?

A spreadsheet is enough while the list is short, changes little and one person keeps it. It breaks in four places: discovering new tools, reviews, getting the decision to the person at work, and versions. Software only fixes that if the rows come from somewhere else.

Read the article

AI DLP 7 min read

What stays in a PDF after you remove the text

Author name, file path, revision history, colleagues' comments. Data that is not on the page and is very much in the file.

Read the article

Compliance and AI 5 min read

The AI register and the third-party register: two lists, one reality

Under DORA a financial entity keeps a register of its ICT third parties. The DPO keeps an AI register. The same vendors appear in both, with different fields and a different owner. How to avoid duplicate work and feed both with what is actually used.

Read the article

AI data leakage 8 min read

What is an AI agent, and what can it do in your organisation?

The difference between a chatbot that answers and an agent that acts. Once a model can do something rather than say something, the question changes.

Read the article

Trust and proof 8 min read

AI monitoring versus employee monitoring

You can know a tool is being used without knowing who used it. That sounds like wordplay and it is a design decision with technical consequences.

Read the article

Comparisons 6 min read

ChatGPT versus Microsoft Copilot for business use

Which of the two is safer has a short answer: it depends on the account, not the tool. What remains after that is a real difference in what each assistant can see and who manages it.

Read the article

Abstract network of connected tiles in teal and sand

AI data leakage 7 min read

Browser extensions are AI tools too

An extension with read access to every site sees more than most AI services do. We are one ourselves, so this article is about us as well.

Read the article

Safe AI adoption 5 min read

Allow or ban ChatGPT at work?

Allow or ban are two of four options, and the two that work least well. Limited use with a condition, and a business account named as the preferred route, keep the use visible and give it a decision.

Read the article

AI governance 6 min read

Shadow AI in education: the tools the school does not know about

Free tools on personal accounts, AI features in learning tools that were already there, and extensions someone installed during a break. Where shadow AI comes from in schools, why a quarterly survey falls behind, and how to keep track without tracking teachers.

Read the article

AI data leakage 7 min read

Who decides what an AI assistant remembers?

Memory became a setting, and settings have owners. Sometimes you, sometimes your administrator, sometimes the vendor deciding for both of you.

Read the article

GDPR and workplace AI 6 min read

Your AI policy covers what people type. What about the file they attach?

Most AI policies are written for the prompt: don't type client names, don't paste account numbers. Almost none of them say anything about the report, case file, or spreadsheet someone uploads whole. That gap is not small.

Read the article

Safe AI adoption 9 min read

The hidden risks of AI chat logs

You delete a ChatGPT conversation and assume it is gone. But the chat log outlives the chat. A deleted conversation is not instantly nowhere, AI memory carries context forward, and on business plans an admin can read along. The one place you actually control this is the moment of pasting, not the settings afterwards.

Read the article

GDPR and workplace AI 6 min read

ChatGPT and legal professional privilege

Pasting the other side's writ into a free ChatGPT account takes ten seconds. What happens to that text, what a business account changes and what it does not, and what you take out before you paste.

Read the article

Abstract sphere between translucent panels

GDPR and workplace AI 6 min read

AI governance, the GDPR and legitimate interest

Measuring AI use and showing notices may involve processing employee data. Which lawful basis fits, why consent usually does not, and how the three-step balancing test works when the data carry no user id.

Read the article

AI DLP 7 min read

Why a black box over text is not redaction

A PDF is made of layers. A black rectangle goes on the drawing layer; the text stays in the text layer. Select, copy, paste, and it is back.

Read the article

AI governance 6 min read

Shadow AI in municipalities: what runs next to Copilot

A municipality that has rolled out Copilot has not thereby settled its AI use. Next to Copilot run Perplexity, ChatGPT, transcription and translation tools, mostly without a decision. How to keep track without following employees.

Read the article

AI data leakage 7 min read

Before you paste a PDF into ChatGPT, redact it

Advice on safe AI use is almost always about what you type. But a full case file, contract, or report uploaded wholesale skips that advice entirely. Here is what to do about the document, not just the prompt.

Read the article

AI governance 6 min read

An AI policy for accounting firms

A firm's AI policy can be short, but it must answer the question that lands on the floor: is this tool allowed, with this file, on this account. Which questions it answers, what the compliance officer does, and how it reaches the floor.

Read the article

AI data leakage 8 min read

Free vs business AI accounts: the privacy difference

The biggest privacy variable in AI tools is not which tool your team picks. It is which account tier sits underneath it. A free login and an enterprise licence process the same prompt under very different terms.

Read the article

Comparisons 6 min read

CASB versus AI governance

A CASB sees traffic to cloud services and can step in. Governance of AI use sees which AI tools are opened, records a decision per tool and shows it where the work happens. What each misses, and when a CASB is the better choice.

Read the article

AI data leakage 10 min read

Perplexity feels like search, so people paste like it's private

Perplexity looks and behaves like a smarter Google, so employees treat it like one: typing in client names, internal context, and confidential questions as if it were a private search box. It isn't. It's an AI service that retains data by default, and its crawlers have been caught ignoring the rules.

Read the article

AI governance 8 min read

Which data do you really need to measure AI use?

A proxy log holds every URL, every user and every timestamp. To answer which AI tools are in use, you need four fields from it, and the user is not one of them. Data minimisation applied to measurement.

Read the article

AI data leakage 10 min read

Le Chat is the European option. It still cannot fix the paste.

Mistral's Le Chat is the GDPR-friendly choice: a French company, EU data residency, no US CLOUD Act exposure by structure. All of that is real and genuinely valuable. None of it changes what an employee chooses to type into the box.

Read the article

AI governance 7 min read

AI governance in education: agreements that move with the classroom

Teachers use AI for lesson material, feedback and letters to parents, and pupil data often goes in with it. What a board with several schools arranges: sight of the tools, a decision per tool, that decision at the moment of typing, and figures without names.

Read the article

AI data leakage 10 min read

Meta AI is the assistant inside your social apps, and that is the risk

Meta AI is not a separate tool you choose to open. It is built into WhatsApp, Instagram, Messenger and Facebook, the apps people use personally and, in many small businesses, for work too. It appears where the line between private and professional is already blurry, and it is a consumer product with no business protections.

Read the article

AI governance 6 min read

An AI register for education organisations

An AI register at a school has the same fields as any register, plus three that weigh more: the processing agreement, the pupil data and the school where the tool runs. It also covers the AI features inside learning tools the school already had.

Read the article

AI data leakage 10 min read

Grok at work: the chatbot that publishes

Grok lives inside X, a network built for publishing, and in 2025 its share button quietly turned hundreds of thousands of private conversations into Google-indexed web pages. When the AI sits inside a social network, 'share' and 'publish' blur, and so does the line between a work tool and a personal account.

Read the article

Email privacy 10 min read

Gmail at work: you can contract away Google, not the recipient

It is easy to worry about what Google does with your Gmail. But the risk on Google's side is largely a contract problem, and contracts exist. The risk no agreement covers is the one that does the real damage: the data you hand to another person.

Read the article

AI governance 5 min read

How do you keep an AI register up to date?

An AI register does not go stale on the day you write it. It goes stale on the day a vendor adds a feature or a colleague opens a new tool. Staying current takes triggers, a rhythm, and a second source.

Read the article

Comparisons 6 min read

Browser extension or network proxy for AI governance?

A proxy sees every connection that passes through it and can stop one. A browser extension sees only the browser, but it travels with the laptop and sits in the text box. Which one answers the question of which AI tools your organisation uses?

Read the article

AI data leakage 11 min read

The two Geminis: which one your team uses decides your privacy risk

Gemini is not a website you visit. It is woven into Gmail, Docs, Drive, and your Android phone. The privacy question isn't only what an employee pastes into a prompt. It's which Gemini they are using, what it can already see, and what it's allowed to act on.

Read the article

GDPR and workplace AI 6 min read

AI policy example: a one-page policy people actually read

An AI policy that gets read fits on one page: eight agreements someone can follow without asking a second question. This is that page, with one sentence per agreement on why it is there.

Read the article

AI data leakage 10 min read

DeepSeek at work: the question isn't the model, it's where your data lands

DeepSeek's model is impressive and openly licensed. But the app most people use sends every prompt to servers in China, under a legal regime with no EU adequacy. The privacy question is not how good the AI is. It is where your data sleeps, and who can ask for it.

Read the article

AI data leakage 11 min read

Microsoft Copilot inherits your access, including the files you forgot you could open

Copilot does not break permissions; it respects them perfectly. That is the problem. It makes every overshared folder, every stale 'anyone with the link', and every forgotten access right instantly findable by asking a question in plain English.

Read the article

AI data leakage 6 min read

Generative AI and confidentiality: where the line sits for lawyers

For a lawyer, confidentiality is a professional duty and a contract at the same time. Generative AI touches it in four places: at input, in memory, through connections and when sharing. Where the line sits, and what a firm arranges.

Read the article

AI governance 6 min read

Which AI tools may lawyers use?

The professional rules name no tools, they name core values. Which AI tools a lawyer may use is therefore a firm decision: a list with statuses, conditions and alternatives, and a route for the tool that is not on it yet.

Read the article

Email privacy 11 min read

WhatsApp at work: why end-to-end encrypted doesn't mean safe

WhatsApp messages are end-to-end encrypted, which makes the app feel private. But encryption protects the message in transit, not who you send it to, which personal phone it lands on, or whether work data should be in a consumer channel at all. The biggest risks sit in the chat box, not the cryptography.

Read the article

AI governance 5 min read

ChatGPT and personal data in municipalities: what may and may not go in the prompt?

Rewriting a letter, summarising an objection, answering a council question: the task is usually fine, the personal data is not. Per task, what comes out before you paste, and why the account type weighs heavily in a municipality.

Read the article

Abstract crossing waves in teal and sand

GDPR and workplace AI 11 min read

Using AI Safely in HR: 7 Privacy Rules for Recruitment and People Operations

AI saves HR teams real time, but HR handles the most sensitive data an organisation holds. The biggest risk is rarely the AI itself. It is the moment a CV, a sickness record, or a review note is pasted into an open AI tool, and the moment an AI output is trusted without checking. Seven rules, and what settings do not solve.

Read the article

Comparisons 6 min read

AI governance software versus classic GRC software

GRC software manages policies, risks and controls, and for many organisations it is where an auditor finds the evidence. Governance of AI use supplies what a GRC suite cannot produce itself: the observation of what is used, and the moment staff see the decision.

Read the article

Abstract translucent panels forming a skyline

Compliance and AI 8 min read

Do you need a data processing agreement for an AI tool?

If an AI vendor processes personal data on your behalf, it is a processor and a data processing agreement (Article 28 GDPR) is usually mandatory. Free accounts do not have one. Here is when you need a DPA and what has to be in it.

Read the article

AI governance 6 min read

Copilot in education: what do you arrange beyond the licence?

A Copilot licence for staff is assigned in an afternoon. What remains to be decided: which variant, who can reach which pupil files, which data and connections, and what you do about the AI tools teachers use next to it.

Read the article

Safe AI adoption 7 min read

Why an AI tool catalog ages the moment you print it

Dozens of new AI tools arrive every day. An annual inventory describes last year, and inventorying more often does not fix it.

Read the article

AI governance 6 min read

How do you build a list of approved AI tools?

Start from what is already in use, not from a blank document. Record the account and the data per tool, give every tool a status and an owner, and publish the list where people work. Why a list without "no decision yet" is not finished.

Read the article

AI data leakage 8 min read

How AI memory works (and how to manage it)

AI tools now remember things between conversations. Useful for preferences, risky for work: a client name or case detail you typed once can resurface in an unrelated chat weeks later. Here is how to view, manage, and delete memory in each tool.

Read the article

AI governance 6 min read

An AI register for municipalities: what goes in it beyond the algorithm register?

The Dutch Algorithm Register publicly describes the algorithms that affect decisions about residents. The chatbot, the transcription tool and Copilot are not in it; that is what a second, internal register is for. What belongs where, and how observed use fills the internal one.

Read the article

AI data leakage 10 min read

What happens to your data in Claude? The privacy risks, explained

Claude can be a useful work tool, but account type determines whether Anthropic trains on your conversations. The gap that settings cannot close is the sensitive context employees paste before pressing Enter.

Read the article

AI data leakage 6 min read

Why an AI tool's safety depends on how you use it

Three colleagues open the same chatbot and run three different risks. Not because the tool changes, but because what goes in, which account sits underneath and what happens to the answer differ per person. And most of that is in your own hands.

Read the article

Email privacy 10 min read

The privacy risks of email at work, and what Outlook settings don't solve

Outlook can be configured securely, but the biggest privacy risks don't come from Microsoft. They come from the email moment itself: the wrong recipient, a sensitive attachment, a forwarded thread. Settings help, but they don't protect against the most common failure: sending too quickly.

Read the article

AI data leakage 8 min read

What happens when Copilot can reach SharePoint?

Over-broad permissions were harmless for years because nobody could find anything. An assistant that searches well changes that in a single query.

Read the article

AI governance 6 min read

An AI policy for schools: what do you agree with teachers and pupils?

An AI policy for a school answers two kinds of questions: which tools and which data for staff, and what use on which assignment for pupils. Two policy lines, and one teacher who explains both.

Read the article

AI governance 6 min read

An AI policy for lawyers: agreements that fit the professional rules

An AI protocol that says "carefully" and "no confidential information" does not answer the trainee's question on a Wednesday afternoon. Which questions an AI policy for a law firm does answer, why the account type is the first agreement, and how the policy reaches the lawyer at the moment of typing.

Read the article

AI data leakage 10 min read

ChatGPT and work data: the privacy risk is the paste

ChatGPT can be used safely at work, but the dangerous moment is often the first paste: customer records, HR notes, contracts, screenshots, and files copied into the wrong workspace.

Read the article

AI governance 6 min read

Shadow AI in accounting firms

A survey in April turns up eleven AI tools. By June the list is wrong: a new transcription tool, an AI note in the compilation software, a contract analysis tool a colleague recommended. How a firm keeps track without following its staff.

Read the article

Safe AI adoption 8 min read

Blocking AI doesn't make you safer. It makes the risk invisible.

A hard block sounds like the safe choice. In practice it moves AI use to personal accounts and personal phones, beyond any visibility. That is shadow AI, and it is harder to govern than the behaviour you were trying to stop.

Read the article

AI governance 6 min read

Who is responsible for the AI register?

The board carries the final responsibility, but a register that sits with one person is out of date within a quarter. The roles of the DPO, CISO, IT, procurement and the business, and why "the DPO will handle it" fails.

Read the article

GDPR and workplace AI 8 min read

Can an admin read your AI chats?

It depends on your account. On a free or personal account there is no employer admin above you, only the vendor. On a business or enterprise account, an admin can often reach your conversations through compliance and eDiscovery tooling.

Read the article

AI data leakage 7 min read

How AI tools reach files you never uploaded

You do not have to share anything to share something. Once an assistant is connected to your account it works with your permissions, and those reach further than you remember.

Read the article

GDPR and workplace AI 8 min read

Shadow AI and employee privacy: two interests that do not collide

The organisation wants to know which AI tools are in use. The employee does not want to be tracked. That looks like a choice between two interests, and it is not one: the question of which tools needs no person.

Read the article

AI governance 6 min read

Microsoft Copilot in municipalities: what do you arrange beyond the licence?

A Copilot licence covers one service. In a municipality, four things sit beyond it: the permissions in SharePoint and Teams, the DPIA, the data Copilot may reach, and the AI tools in use alongside it.

Read the article

Safe AI adoption 8 min read

The browser became your biggest security blind spot

Almost all work now happens in the browser: AI tools, email, SaaS. That is where sensitive data leaves the organisation, not through your network or your files. But most security still watches logs, and by then the data is already gone.

Read the article

AI governance 6 min read

AI governance roles: who does what?

Nobody owns AI in the organisation, and that is fine as long as every decision has one owner. What the board, DPO, CISO, IT, procurement, HR, team leads, works council and employees each decide, deliver and see.

Read the article

AI data leakage 8 min read

What is RAG, and how does it change your data risk?

Once an AI tool can search your own documents, the question moves from "what am I pasting in" to "what can it reach". That is a different kind of risk, owned by different people.

Read the article

AI governance 6 min read

An AI register for law firms

A law firm uses more AI than the research database it licenses: chatbots, dictation software, contract analysis, the AI features inside the legal database. Which tools belong in the register, and which fields carry more weight for a firm than elsewhere.

Read the article

Safe AI adoption 9 min read

Data sovereignty starts in the prompt field

Your data sits in a European data centre, so you're sovereign? Not necessarily. As long as the provider is American, the US government can reach it, wherever the servers are. And that choice isn't made by procurement, it's made by the employee who pastes something into a prompt.

Read the article

AI governance 6 min read

An AI register for accounting firms

In an accounting firm, AI runs in the chatbot, the bookkeeping package and the audit software. Which register fields a firm needs on top of the usual ones, and why the register is only right once you also look at what is actually opened.

Read the article

Safe AI adoption 7 min read

Using AI safely in your SMB, without a big project

You don't need a security team or a large AI programme to use AI safely. Your people already use AI, and the risk lives in everyday haste. A practical layer handles it in the tools you already use, with no months-long project.

Read the article

AI governance 5 min read

ChatGPT and pupil data: what a teacher may and may not paste

Feedback on an essay, a grade list, a care note: the task is fine, the pupil is not. What you take out before you paste, why removing the name is not enough, and how you still get the task done.

Read the article

Safe AI adoption 9 min read

You have an AI policy. Can you prove it's being followed?

Almost every organisation now has an AI policy. Very few can show what employees actually paste into ChatGPT, Copilot or Gemini. That gap between the document and the desk is the real risk, and it is wider than most leaders assume.

Read the article

Comparisons 6 min read

ChatGPT, Claude or Copilot: which fits which work?

There is no winner. The account decides the data protection for all three; after that the real difference is what each assistant can see and who manages that. There is a direction per situation, and the consumer versions fit no work involving personal data.

Read the article

Safe AI adoption 9 min read

Awareness training makes people aware. It doesn't change their behaviour.

A training on Monday does little when someone pastes a client file into ChatGPT under pressure on Thursday. Not from ignorance, but because the habit is stronger than the knowledge. Awareness only works in the moment, and everywhere: in AI tools, email, and social media.

Read the article

AI data leakage 7 min read

Where is your prompt while you type it?

Between the first keystroke and the send button, your text exists in more places than the interface suggests. Drafts, sync, extensions, keyboards.

Read the article

Abstract winding path through soft hills

Safe AI adoption 5 min read

How do you communicate AI policy without drowning people in rules?

A six-page policy in an email is read once and then forgotten. What sticks: one rule per situation, at the moment someone opens the tool, with the alternative named before the ban.

Read the article

Safe AI adoption 8 min read

Copilot is allowed. Should ChatGPT be banned?

Copilot has been bought and allowed, and ChatGPT is still open on dozens of desks. A ban looks like the obvious next step. Three other outcomes keep the visibility you need, and the ban is the only one that takes it away.

Read the article

AI data leakage 8 min read

Why AI makes things up

Hallucination is not a fault in the system, it is a property of how the system works. And once the invention concerns a real person, it becomes a GDPR question.

Read the article

AI governance 6 min read

An AI policy for municipalities: agreements that survive a working day

An AI policy adopted by the board only helps a neighbourhood team worker if it answers her Friday-afternoon question: may I use this tool, with this note? Which questions the policy must answer, who reviews, and how the decision reaches the front desk.

Read the article

AI data leakage 8 min read

What happens when you upload a PDF to a chatbot?

Step by step, from the moment you drop the file to the moment a summary appears. And why "I only asked it to summarise" describes your request, not your transmission.

Read the article

AI governance 8 min read

How do you measure Microsoft Copilot adoption?

The Microsoft 365 admin center shows how many licensed users have used Copilot, and in which app. It does not show what is in use next to Copilot. How you put the two side by side without tracking people.

Read the article

Comparisons 12 min read

Zivver or BeeSensible? Two approaches to secure email compared

Zivver encrypts what you send. BeeSensible shows what you are about to send. Both are useful, but they work at different moments: Zivver protects the email after you send it, BeeSensible helps before you send it. Which approach fits which problem?

Read the article

AI governance 5 min read

An AI policy around Microsoft Copilot: the agreements you make beyond the licence

A Copilot licence covers the service: a data processing agreement, no training on your data, processing inside Microsoft 365. It does not cover the use. Six agreements a board makes itself, on one page, with a table to walk through them.

Read the article

Comparisons 17 min read

Microsoft Purview and BeeSensible: two layers, not a choice

Purview governs data after the fact across your Microsoft estate. BeeSensible marks sensitive data while you type, in the browser. Two moments, and together they cover more.

Read the article

AI governance 6 min read

Should ChatGPT or Copilot be in your AI register?

Yes, as soon as they are used, even if nobody bought them. And not as one row: the free and the business version differ on exactly the fields a register exists for.

Read the article

AI data leakage 7 min read

Why encryption does not protect your prompt

Encryption protects text from being read in transit. The recipient has to read it, or it cannot answer. That is not a gap in the design, it is the design.

Read the article

Comparisons 7 min read

DLP versus AI governance: which layer covers what?

DLP recognises sensitive data in files, mail and network traffic and acts on the content. Governance of AI use is about the tool, the decision and the moment of typing. Two layers with a different starting point, and usually you need both.

Read the article

AI data leakage 7 min read

Prompt redaction guide: remove, replace, or mask sensitive data before using AI

Concrete examples of risky prompts and safer alternatives for support, finance, legal, HR, healthcare, and product teams.

Read the article

Trust and proof 7 min read

How do you know your AI policy is actually followed?

A signed policy and a training log tell you what people have read. Whether the policy is followed you read from three numbers about everyday practice, and from what you do when those numbers disappoint.

Read the article

AI data leakage 8 min read

What a chat history actually is

Where your conversations live, who can reach them, what deletion does in the database, and what sits in the backup. Four layers, each with its own clock.

Read the article

AI data leakage 6 min read

Generative AI and confidential financial information

Quarterly figures that go public in twelve days, an acquisition file, a draft opinion. Where generative AI touches that information, why a business account is not the whole answer, and what a firm puts in place.

Read the article

GDPR and workplace AI 7 min read

GDPR and employee use of AI tools: a practical rollout guide

How to frame controller responsibility, DPIA work, employee guidance, data minimisation, and technical controls for workplace AI.

Read the article

Compliance and AI 5 min read

Who is responsible for AI literacy: HR, IT or the DPO?

Article 4 of the AI Act places the duty on the organisation, not on a department. In practice HR carries the explanation, IT the register and the moment of work, and the DPO the advice. Who does what, who keeps the evidence, and why "the DPO will handle it" does not work.

Read the article

AI data leakage 7 min read

AI data leakage prevention: how to stop sensitive data entering AI tools

A practical guide to reducing AI data leakage with policy, prompt hygiene, browser warnings, and a deliberate rollout.

Read the article

AI data leakage 6 min read

ChatGPT and client data: a meeting note full of IBANs

An adviser who has ChatGPT write up her notes from an intake meeting pastes the client's IBANs, income and family situation along with them. The task is fine; the data does not need to go in. What to take out, per task.

Read the article

AI data leakage 7 min read

What is a context window, and why does AI forget things?

A long conversation loses its beginning. That does not mean the data is gone. The difference between what the model forgets and what the service retains.

Read the article

GDPR and workplace AI 8 min read

A DPIA for Microsoft Copilot: what do you include?

A sector DPIA on Microsoft 365 Copilot exists, and it describes the service. Your DPIA describes your use of it: the permissions, the data, the connections, the measures, and how you later show that those measures are running.

Read the article

AI data leakage 8 min read

What "we don't train on your data" actually means

The promise covers training. It does not cover storage, human review, logging, or retention. What happens to text that is not used for training.

Read the article

GDPR and workplace AI 9 min read

What does the AI Act mean for my business, alongside the GDPR?

The AI Act and the GDPR apply side by side. The GDPR covers personal data, the AI Act covers the AI system itself. Here are the facts that count and what most organisations must arrange now.

Read the article

Compliance and AI 6 min read

AI and DORA: where AI tools fit in your ICT risk management

DORA asks financial entities to manage their ICT risk and their ICT providers. The chatbot an adviser found on her own is also an ICT service from a third party. Where it lands in risk management, and what you record about it.

Read the article

AI governance 6 min read

Shadow AI in financial services

A firm that has rolled out Copilot has not settled its AI use. Next to it run ChatGPT, Perplexity, transcription and tools that read files, mostly without a decision. Why that weighs more under supervision and DORA, and how to keep track without following employees.

Read the article

GDPR and workplace AI 8 min read

Can my employer monitor whether I use AI?

An employer can check whether staff use AI tools, but not freely. The GDPR sets conditions on purpose, proportionality, and transparency, and works councils often have a say.

Read the article

Compliance and AI 6 min read

Can one AI tool be both low and high risk?

Yes, and there is nothing contradictory about it. An AI tool's risk depends on what you use it for, which data goes in and which account it runs under. The AI Act looks at the purpose of an application, not the name of the tool.

Read the article

AI data leakage 8 min read

What you can and cannot share with AI

A practical checklist of data you should never put in an AI tool, what is usually fine, and the rule of thumb that helps you decide in borderline cases. It applies beyond chatbots, to meeting AI, email assistants, and transcription too.

Read the article

AI governance 6 min read

AI governance for law firms: confidentiality in the age of the chatbot

Lawyers use AI to summarise, draft and research. The information that passes through those tools was entrusted to the firm under a duty of confidentiality. Which tools are in use, what the firm decides about each, and how that decision reaches the lawyer at the keyboard.

Read the article

AI data leakage 8 min read

Does AI train on my data, and how do I turn that off?

Whether an AI tool uses your conversations for training depends on the account and the settings. How to turn off training, how to request deletion, and why that does not fix everything.

Read the article

AI governance 6 min read

From shadow AI to a current AI register

A manually kept register shows what the organisation knows. Actual use shows what falls outside it. The gap between those two lists is the work, and in four steps it becomes a register that keeps itself current.

Read the article

AI data leakage 8 min read

Is AI safe for company data?

Your board wants a yes or a no. The honest answer is that this is four questions wearing one coat, and three of them were settled before anyone started typing.

Read the article

Compliance and AI 6 min read

AI literacy in municipalities: who needs to know what?

Article 4 of the AI Act asks a municipality for measures towards a sufficient level of AI literacy. What sufficient means for the front desk, the policy adviser, the youth care consultant, IT and the board, and how you demonstrate it.

Read the article

Compliance and AI 8 min read

GDPR and AI: which measures does the law require for AI use?

The GDPR does not mention AI, but it applies the moment you put personal data into an AI tool. Here are the concrete measures: lawful basis, data minimisation, processor role, transfers, and security.

Read the article

Compliance and AI 7 min read

AI governance and the BIO baseline: where AI use fits

The BIO, the information security baseline for Dutch government, never mentions AI. It does not need to: everyday use of chatbots and summarising tools in a municipality lands in four themes it already has, classification, supplier management, awareness and logging.

Read the article

Compliance and AI 8 min read

NIS2 and AI: what does the directive mean for your AI use?

NIS2 raises the bar on cybersecurity, governance, and incident reporting. AI tools are part of your attack surface and your supply chain. Here is how NIS2 and AI privacy meet.

Read the article

AI governance 6 min read

AI governance for accountants: client files, confidentiality and demonstrability

In an accounting firm, AI helps with the general ledger, the financial statements and the advisory memo. What goes in belongs to the client. Which tools are in use, what the firm decides about them, and how you show that later.

Read the article

Compliance and AI 8 min read

ISO 27001 and AI: how does AI use fit into your ISMS?

ISO 27001 does not mention AI, but it requires policy, classification, supplier management, awareness, and data leakage prevention. Here is how to bring AI use under those controls.

Read the article

Compliance and AI 8 min read

BIO and NEN 7510: AI and privacy in government and healthcare

Government works with the BIO, healthcare with NEN 7510. Both demand strict handling of sensitive data. Here is what that means once staff start using AI tools.

Read the article

Using AI at work, without the data leaks.