Use cases, also under the EU AI Act
What you use a tool for: measured use cases, regulated use cases with an indication under the EU AI Act, and your own use cases.
A use case is what you use a tool for. It lives on the Use cases tab of the tool page in the AI register, with departments per use case and the question whether personal data is processed. A registration without at least one use case shows under To complete.
Use cases are recorded per tool for a reason: under the EU AI Act, the obligations also depend on what you use a tool for, and not just on the tool itself.
Three kinds
Measured by BeeSensible. The seven kinds of use BeeSensible recognises in prompts. The first prompt of a conversation is classified and discarded at once; only the label is counted. Record one of these and the Measured column shows how many prompts belong to it.
| Use case | What it covers |
|---|---|
| Writing communication | Writing a new message or document: an email, letter, report or proposal. |
| Marketing & content | Social media posts, ads, blogs, newsletters and other promotional copy. |
| Summarizing | Condensing an existing text, meeting or document to the key points. |
| Rewriting & editing | Rephrasing an existing text, changing its tone, shortening or correcting it. |
| Translating | Translating text from one language into another. |
| Coding & technical | Writing, fixing or explaining code, queries, scripts or spreadsheet formulas. |
| Analysis & knowledge | Interpreting data, comparing options, researching a topic or having something explained. |
Regulated use cases. Use cases where AI plays a part in a decision about people and that can fall under the EU AI Act. BeeSensible does not measure them; you record them because they need an assessment of your own. They are listed per domain, with the badge EU AI Act.
| Domain | Examples | What BeeSensible says about it |
|---|---|---|
| HR and work | Screening CVs, Comparing candidates, Evaluating employees, Monitoring employees | May fall under Annex III, point 4 of the AI Act (employment and workforce management): high risk. Needs your own assessment. |
| Education | Admission or selection, Assessing level or performance, Exam proctoring and fraud | May fall under Annex III, point 3 (education and training): high risk. Needs your own assessment. |
| Financial services | Assessing creditworthiness, Loans or financing, Insurance risk or pricing | May fall under Annex III, point 5 (access to essential services, including credit and insurance): high risk. Needs your own assessment. |
| Public sector | Eligibility for a benefit or service, Prioritising requests, Risk profiles | May fall under Annex III, point 5 (access to public benefits and services): high risk. Needs your own assessment. |
| Law, enforcement and migration | Legal decision support, Risk of crime or reoffending, Assessing migration, asylum or visa | May fall under Annex III, points 6 to 8 (law enforcement, migration and justice): high risk. Needs your own assessment. |
| Biometrics, emotion and profiling | Biometric identification or categorisation, Emotion recognition, Inferring sensitive characteristics, Social scoring | May fall under the prohibited practices (Article 5) or Annex III, point 1 (biometrics and emotion recognition). Have this assessed first. |
Your own use cases. If your use is not in the list, Add your own use case lets you record it in your own words, for example "First selection of applicants", with a short note on who uses it and how. An own use case is not measured; the register says so next to it.
Recording use cases
Choose from the list
Choose use cases opens the list with the measured and the regulated use cases. Tick what you do with the tool; anything already recorded is marked "already recorded". Choose at least one.
Or adopt what BeeSensible already saw
When BeeSensible measures use that is not recorded as a use case yet, the tab says so: "Regular use that looks like Summarizing (42 prompts). Add it as a use case?" Add as use case records it. The same signal appears on the Measured tab.
Add the departments
Per use case you pick the departments, or Whole organisation. If no departments are set up yet, you do that first under Organisation.
Answer the question about personal data
"Is personal data processed in this use case?" Do employees enter data about identifiable people here, such as names, email addresses or CVs? Choose Not known yet, Yes, personal data is processed or No, no personal data is processed. With Yes, the field Which personal data takes a short note, for example "CVs, customer contact details".
What the personal-data answer does
Answer Yes and a DPIA may be needed. The register then asks you to record where that stands, in the Documents card: one DPIA for the tool, covering all use cases. As long as it is not arranged, the tool shows "Personal data is processed and the DPIA is not arranged yet" under Still open, and counts in the Documents open filter.
To ground your answer, the question shows what BeeSensible found in the tool, for example "Sensitive data found 17 times in ChatGPT in the last 30 days, mostly name and email address. This applies to the whole tool." Detections belong to the tool, not to a use case, and never contain the content. The answer stays yours.
The tool's overview sums it up: "Personal data in 2 of 3 use cases" and, where it applies, "1 use case can fall under the EU AI Act".
A measured use case is recorded, but the Measured tab says it does not occur
That signal only means BeeSensible did not see the use case in prompts during the last period. It can be right, for example for rare use or for a tool BeeSensible does not measure in. Keep the use case if you still use it; the review walks you through the list again.
Every change to a use case, including the personal-data answer, goes into the tool's history. In the CSV export each use case is a row of its own, with its kind: measured, regulated or own.
