What the GDPR, the AI Act, NIS2, ISO 27001, and sector rules mean once your team uses AI.
Compliance frameworks rarely mention AI by name, but they all apply the moment staff paste personal or confidential data into an AI tool. The GDPR governs personal data, the AI Act governs the system, NIS2 raises governance and incident duties, and ISO 27001, the BIO, and NEN 7510 ask for organisational measures and awareness. The shared practical answer is data minimisation at the point of typing.
Most rules that organisations live by were written before everyday generative AI. They still apply. A national ID in a prompt is personal data under the GDPR. A care file in a chatbot is special-category data under NEN 7510. An incident with a public AI tool can become a reporting duty under NIS2.
These guides translate each framework into the same practical question: which data may leave your organisation, and how do you keep the rest out of an AI tool. They cover the GDPR, the EU AI Act, NIS2, ISO 27001, and the BIO and NEN 7510 for government and healthcare.
The common thread across all of them is data minimisation and awareness at the moment data is shared. A signal in the text field, so the person typing can mask or remove sensitive data before they send, supports the organisational measures these frameworks ask for, without reading the content of private chats.
Articles in this topic
High risk attaches to the purpose an AI system is intended for, not to the technology inside it. Annex III lists the purposes, and part of that list touches every employer: recruitment, assessment, access to services, education.
Read the article
An attendance list says something about the day of the course. An auditor asks about the Monday after. Three kinds of evidence, what each does and does not show, and what you honestly call not substantiated.
Read the article
Article 4 of the AI Act applies to schools too, with no course, certificate or hour count attached. What it does ask, why the bar sits higher in education for some roles, and what sufficient means per role.
Read the article Dutch healthcare is in two transitions at once: the revised NEN 7510:2024 with a certification deadline in February 2027, and the Cyberbeveiligingswet taking effect on 15 August. What the standard asks and how to make it demonstrable.
Read the article Article 4 of the AI Act asks for measures per role and context, not one course for everyone. What does apply to every employee, what differs per role, and why the explanation only works once the decision is also visible at the moment of work.
Read the article Almost two years late, NIS2 is now Dutch law. From 15 August 2026, the duty of care, the reporting duty, and the registration duty apply to more than 8,000 organisations. The timeline, the duties, and what to arrange now.
Read the article Article 4 of the AI Act has applied since February 2025, yet it prescribes no course, no certificate and no number of hours. What the article does say, what sufficient means per role, and why knowledge is half the job.
Read the article
Meeting notes full of account numbers end up in ChatGPT faster than any policy can catch. What that means for a regulated firm, and how to keep control without banning AI.
Read the article
No, not as one universal register for every organisation. There are registration and documentation duties that depend on your role and the systems you deploy, and the GDPR asks for its own record. What the law says, and why organisations keep a register anyway.
Read the article Most employers do not build AI, they use it. The AI Act calls that role deployer, and the list that comes with it is shorter than the coverage suggests. What applies today, what applies from December 2027, and where ChatGPT fits in.
Read the article Yes, since 2 February 2025. Article 4 of the AI Act asks organisations to take measures towards a sufficient level of AI literacy among the people who use AI on their behalf. What it does not contain: a certificate, a course or an hour norm.
Read the article Only genuinely anonymised data falls outside the GDPR. The other two are useful and change none of your obligations.
Read the article The heavy obligations of the AI Act sit with OpenAI as the provider, not with the employee who uses ChatGPT. Three things change for you at work: your organisation has to explain, a few applications are prohibited or high-risk, and a chatbot facing the public has to make clear it is AI.
Read the article
Six questions, with what a usable answer looks like and what an evasive one looks like. Built to be used in a call, not filed in a folder.
Read the article Under DORA a financial entity keeps a register of its ICT third parties. The DPO keeps an AI register. The same vendors appear in both, with different fields and a different owner. How to avoid duplicate work and feed both with what is actually used.
Read the article
If an AI vendor processes personal data on your behalf, it is a processor and a data processing agreement (Article 28 GDPR) is usually mandatory. Free accounts do not have one. Here is when you need a DPA and what has to be in it.
Read the article Article 4 of the AI Act places the duty on the organisation, not on a department. In practice HR carries the explanation, IT the register and the moment of work, and the DPO the advice. Who does what, who keeps the evidence, and why "the DPO will handle it" does not work.
Read the article
DORA asks financial entities to manage their ICT risk and their ICT providers. The chatbot an adviser found on her own is also an ICT service from a third party. Where it lands in risk management, and what you record about it.
Read the article Yes, and there is nothing contradictory about it. An AI tool's risk depends on what you use it for, which data goes in and which account it runs under. The AI Act looks at the purpose of an application, not the name of the tool.
Read the article
Article 4 of the AI Act asks a municipality for measures towards a sufficient level of AI literacy. What sufficient means for the front desk, the policy adviser, the youth care consultant, IT and the board, and how you demonstrate it.
Read the article
The GDPR does not mention AI, but it applies the moment you put personal data into an AI tool. Here are the concrete measures: lawful basis, data minimisation, processor role, transfers, and security.
Read the article The BIO, the information security baseline for Dutch government, never mentions AI. It does not need to: everyday use of chatbots and summarising tools in a municipality lands in four themes it already has, classification, supplier management, awareness and logging.
Read the article NIS2 raises the bar on cybersecurity, governance, and incident reporting. AI tools are part of your attack surface and your supply chain. Here is how NIS2 and AI privacy meet.
Read the article ISO 27001 does not mention AI, but it requires policy, classification, supplier management, awareness, and data leakage prevention. Here is how to bring AI use under those controls.
Read the article Government works with the BIO, healthcare with NEN 7510. Both demand strict handling of sensitive data. Here is what that means once staff start using AI tools.
Read the articleMostly not. The GDPR, NIS2, ISO 27001, the BIO, and NEN 7510 predate everyday generative AI, but they apply as soon as personal or confidential data enters an AI tool. The EU AI Act is the one framework written specifically for AI systems.
Data minimisation and awareness at the point of use. Keep personal and confidential data out of prompts, document what you do, and make the safe path the easy path so people follow it under time pressure.
The infrastructure BeeSensible runs on is ISO 27001 certified. BeeSensible itself is not certified. BeeSensible supports your measures by making sensitive data visible before it is sent, but it does not replace your own compliance work.
Detect sensitive data before it leaves your team, in any app, in real time.
Rens, BeeSensible
I am happy to give you a twenty-minute tour. Leave your details and I will find a moment that suits you. Calling or emailing works just as well.