EU AI Act
AI governance, inventory, transparency and evidence are managed as a dossier. Full compliance is not automatically claimed.
You need to be able to demonstrate trust.
Here you'll find what Bedrijfsgeheugen has demonstrably put in place around AI, data, security, and relevant regulations, what's still in progress, and where evidence is still missing.
Trust center · Bedrijfsgeheugen itself
Readiness is not an external certification or an automatic legal judgment. Only concrete evidence may be presented as demonstrable. Uncertainty and open items remain visible.
As of: September 9, 2026.
Current status
NIS2
Security controls are operational, but formal applicability remains a separate decision that must be substantiated.
NIS-legacy
The old NIS Directive is not used as a current compliance basis.
Release integrity
Protected main, mandatory test status, exact-SHA deployment and production readback together form the release pipeline.
Deploy & secretscan
Production deployments are linked to a commit ref and checked for secrets before release evidence can pass.
Independent assurance
No external certification or audit claim will be made unless it can be substantiated with a scope and date.
Data & AI
| Component | Status | Next evidence point |
|---|---|---|
| Website hosting & serverless runtime | Demonstrable | Keep documenting data residency for each datastore and connector. |
| Portal data | In progress | Link the data processor and data residency register to technical evidence. |
| AI processing | In progress | Register the provider, role, data category, human oversight, and evidence for each application. |
| Human review | In progress | Document the reviewer, decision rationale, and periodic review date for each critical control. |
More about data silos: Excel as a CRM.
Outstanding improvements
Data processor and data residency register
Document the supplier, datastore, region, retention period, and subprocessors for each capability, with verifiable evidence.
AI system register
For each AI feature, document its purpose, provider, role, risk class, data category, and human oversight.
NIS2 applicability
Record the formal scope decision, including the decision-maker and review date.
The way it works now
- The appointment is in one colleague's mailbox
- Data is manually retyped from one system to another
- The person who knows is on vacation
- No one can see afterwards why this decision was made
As it is
- The agreement is stored with the client, findable for everyone
- Once entered, information flows through to the rest
- Work continues, even if someone is absent
- Every decision has a source, an owner, and a date
drag with your finger
What if Peter leaves?
Two out of five rules on this page disappear. That's how it feels when knowledge isn't part of the company.
What is your next step?
Free self-assessmentTwelve click questions, three minutes, immediate score and your biggest risk.
Fresh LookBusiness case, benchmark and priority. Settled once we build after this.
What it costsFixed price per package, no price per user, no hourly billing.
From the fieldWhat changed at companies that started with this.
Also good to know: frequently asked questions · security and data · terms and conditions · partners · research and figures · templates · what's changing · where you start