Responsible people and documents
Who is responsible for a tool and in which role, and which documents belong to it, such as the processing agreement and DPIA, with status, date and link.
A registration in the AI register has at least one responsible person and can carry a list of documents. Each is a card on the Overview tab of the tool page: Responsible and Documents. BeeSensible stores no document; the register keeps track of what exists, in what state, from when and where it lives.
Responsible people
Whoever allows a tool is added automatically as a responsible person with the role Owner, and as the reassessment owner. After that you add whoever else belongs on the list.
Pick a person
Add person lets you pick a member of your organisation from the list, or choose Someone else (not a member) and type a name. A member gets an email when the reassessment is coming up, and so do the admins; a plain name cannot be emailed.
Give a role
Every person gets a role: Owner, IT, Privacy or Security. If none of the four fits, choose Other role and type the role name.
Save
Give every person a name and a role; without at least one responsible person you cannot save. The change goes into the tool's history.
Remove the last responsible person and the tool shows under To complete with the reason "Owner missing". The reassessment owner is chosen separately, under Review.
Documents
Per tool you record which documents belong to it. Add document asks for the kind, a title and the status; date and link are optional. A link starts with https://. Open takes you to the document later, Change updates the status, date or link.
| Kind of document | Statuses |
|---|---|
| Processing agreement | Not known yet, In place, Missing, Not needed |
| DPIA | Not known yet, Carried out, Needed, not done yet, Not needed |
| Internal assessment | Not known yet, Carried out, Still to do, Not needed |
| Usage rules or AI policy | Not known yet, In place, Missing, Not needed |
| Contract with the vendor | Not known yet, In place, Missing, Not needed |
| Other document | Not known yet, In place, Missing, Not needed |
There is one processing agreement and one DPIA per tool; the DPIA covers all use cases. Until they are recorded, the tab lists them as "Not recorded yet" with a Record button.
The vendor's processing agreement
Next to your own record, the tab shows what BeeSensible knows from the catalog: "Processing agreement from the vendor: Available" or "Not available". That says whether the vendor offers one, not whether you signed it. The latter is what you record under the kind Processing agreement.
Still open
The register actively watches two documents:
- While the processing agreement is not arranged, the tool shows under Still open: "The processing agreement is not arranged yet."
- When a use case says personal data is processed and the DPIA is not arranged, it shows: "Personal data is processed and the DPIA is not arranged yet." The same signal appears on the Measured tab when BeeSensible finds personal data in the tool.
Such tools fall under the Documents open filter and count on Home as "with a document open". Set the status to In place, Carried out or Not needed and the note disappears.
The vendor offers a processing agreement, but the register says it is still open
Both are right. "Available" comes from the catalog and describes what the vendor offers. Still open describes your record: under the kind Processing agreement, record that it is In place, with the date and a link.
Every change to a document goes into the tool's history, and the review walks through the documents as one of its steps.
