Know which AI you use
Give anyone who wants to use an AI tool a place to ask for it, instead of using it without anyone knowing.
An employee asks to use an AI tool; it is reviewed, a decision is recorded, and once the approval is recorded it enters the inventory on its own.
Members of your organisation ask from the platform; the rest of your staff, from a link with work-email verification, without needing an account. Alethexis does not detect tools on its own: it organises the ones your team declares.
AI use requests are included in the M2 and M3 plans.
The person asking states the tool, the provider, what it will be used for (the specific task), who will use it, whether it will process personal data and which, and the urgency. They can start from a template of the tools common in your sector or type it in with “Another tool (I will type it in)”. If the tool usually requires a high-risk assessment, the template says so. The request is saved as a draft and submitted for review when it is ready.
The Owner or the AI Officer create the link in Settings → Access → Request link, with the allowed work-email domains; personal email domains are not accepted. The person opening the link enters their email, receives a 6-digit code that expires in 15 minutes and fills in the request. Each email confirmation is valid for one request only. People who request through the link are not added to your team; they receive an acknowledgement by email and, once the decision is recorded, another email with the status. Internal comments are not sent to them.
The AI Officer reviews it —and the DPO too if it will process personal data—: under “Your review” they note what they checked and what they recommend. The Owner or the AI Officer record the decision with “Record approval” or “Record rejection”, with an optional comment. Each request has a conversation for comments. Submission, review and decision are kept in the approvals register with their date and the hash of the content.
When the approval is recorded, the tool is added to the inventory with what was declared in the request: name, provider, purpose and whether it processes personal data. It must then be classified in risk classification. What the request does not ask —for instance, whether the system makes decisions about working conditions— enters unanswered, so that whoever reviews the record can answer it.
Each request is in one of six statuses: Draft, Submitted, Under review, Approval recorded, Rejected or Withdrawn, and the list can be filtered by them. While something is waiting for someone's action, that person receives at most one email a day, with everything pending; each item is reminded once a week while it remains pending.
The controls in the Alethexis catalogue that this feature helps to document, with their legal basis where they have one, and their nature.
Provide an internal channel where employees can declare, without penalty, which AI tools they use in their work, personal accounts included. Voluntary declaration is the most effective route to discovery; without a credible amnesty, shadow AI stays hidden.
Legal basis
No direct basis in law.
Data from the controls catalogue. The labels show the regulatory nature of each control; they are not a statement of compliance.