01
Your team uses ChatGPT or Copilot, without agreements.
Everyone does it their own way. Nobody knows which data has already ended up in a prompt.
for management, IT and DPO
Know which AI your organisation really uses.
In 2 to 3 weeks we map the AI tools, data flows and self-built apps in your organisation. We assess them for privacy, security, fairness and energy. You get a risk overview with priorities.
No obligation · 30 minutes · online, with someone who puts AI to work every day
At a glance
- Duration
- 2 to 3 weeks, with one fixed point of contact
- We assess
- Privacy, security, fairness and energy
- You get
- An overview, a review of your own apps and a risk overview with priorities
Sound familiar?
AI is already in your organisation. The question is where.
02
There are AI tools running that IT doesn’t know about.
A free transcription app, a browser plug-in, a new AI feature in software you already had. It’s called shadow AI, and it grows by itself.
03
A colleague built their own app with AI.
It works and the team likes using it. But where does the data go, and who maintains it when that colleague leaves?
04
You want to know what the AI Act asks of you.
If your team uses AI tools, the AI Act requires, among other things, that you work on AI literacy. Stricter rules apply to AI that helps make decisions about people, such as in recruitment or exams.
What we look at
Four tests for every tool and every app
We put every application through the same four questions. That way you can compare them fairly.
Privacy
Which data?
We check
Which kinds of data (including health or pupil data), where the vendor processes and stores it, whether it’s used to train models, and whether there’s a data processing agreement.
Security
Who has access?
We check
Accounts and access rights, personal or shared licences, keys and passwords in self-built apps, and what gets logged.
Fairness
Is the outcome fair?
We check
Whether AI helps make decisions about people, whether a colleague has the final say, and whether the outcome differs for some groups.
Energy
Less energy?
We check
Which model runs for which task, how often, and whether a smaller model or a plain search function would do.
How it works
From kick-off to risk overview in 2 to 3 weeks
The scan only starts after an introductory call and a proposal we agree on together. After that your team simply keeps working: we ask for a contact person, a short questionnaire and a few conversations.
- 1
Kick-off
Week 1. An hour with your contact people: which teams take part, who we talk to and what we may look at.
- 2
Inventory
Week 1. A short questionnaire for your teams and conversations with the people who use AI. Including what runs alongside the official tools.
- 3
Review
Week 2. We review the tools, data flows and self-built apps against the four tests.
- 4
Risk overview
Weeks 2 to 3. For each application a finding and a priority: fix now, soon or OK.
- 5
Feedback
Week 3. We walk management, IT and the DPO through the risk overview. You get the report and a first AI register.
What it asks of your team: one contact person, a 15-minute questionnaire per team and 3 to 6 conversations of 45 minutes.
After a first conversation you get a proposal with a clear scope and a fixed price.
What you get
A risk overview you can act on straight away
Not a thick report that ends up in a drawer. You get four things you can use and keep up to date yourself.
- Overview of tools and data flowsWhich AI, in which team, with which data, and where that data goes.
- Review of self-built AI appsAccess, data, keys, and who maintains the app.
- Risk overview with prioritiesWhat to fix now, what can wait, and what is OK.
- A first AI registerOne list of your AI applications, with owner and risk. A good basis for your AI policy and your agreements on AI literacy.
Example
Risk overview
5 of 14 applications
-
Free AI chat on personal accounts
Privacy
Client data in prompts, no agreements
Fix now
-
Self-built app for reports
Security
The AI service key is in a shared folder
Fix now
-
Meeting transcription
Privacy
Participants don’t know they’re being recorded
Soon
-
CV screening in the HR package
Fairness
Nobody reviews the rejections
Fix now
-
Copilot in Microsoft 365
Privacy
Works with your existing permissions, agreements are on paper
OK
Made-up example. In your real risk overview, each row gets an owner in the AI register.
After the scan
Then you decide what comes next
The risk overview is yours. You can follow it up yourself, with us or with another partner.
Roadmap
A working day with your team. You choose the applications that matter, work out the first one and make agreements for 6 to 12 months.
Pilot around one workflow
If the scan reveals an opportunity, we build it small and controllable, in your own systems.
AI literacy training
Agreements only work once your team knows and understands them.
Or nothing
If everything is in order, we’ll say so. Sometimes you won’t need us after that.
Who advises you
A new brand, built on fifteen years of craftsmanship
Ethic is Zenjoy’s AI studio, based in Leuven. The people who advise you also build. So your advice stays doable.
15 years
building and maintaining software
400+
organisations
4 years
AI in our own work every day
Frequently asked questions
What people often ask us
Question not listed? Just ask us.
Data processing agreement on request.
Do you get access to our data during the scan?
As little as possible. We work with the questionnaire, conversations and screen sharing, and look at settings and data flows, not at the content of files. For self-built apps we look at code and configuration, preferably with test data. If we do need access, we agree in advance what, for how long and read-only.
Do you sign an NDA and a data processing agreement?
If you ask for a confidentiality or data processing agreement, we arrange it before the start. If you work with your own template, we’re happy to review it.
How much time does this take from our team?
Not much. One contact person spends a few hours a week on it, mainly scheduling meetings and answering questions. The teams fill in a questionnaire of about 15 minutes, and we talk to 3 to 6 people, 45 minutes each. The feedback session takes 1.5 hours.
Is the scan a legal check?
No. The scan shows which applications may fall under which rules of the AI Act, but it isn’t legal advice. For a legal opinion, it’s best to work with your lawyer.
Will you point the finger at colleagues?
No. The scan is about tools and agreements, not people. We report per application and per team, never per employee. What’s said in a conversation stays between us. That way people dare to say honestly what they use.
Do we have to buy anything from you afterwards?
No. The risk overview and the AI register are yours. You can follow them up yourself or with another partner.
Want to know where your organisation stands today?
In a 30-minute conversation we look at whether an AI Scan makes sense, or whether a Pitstop is enough.
No obligation · 30 minutes · online, with someone who puts AI to work every day