Advanced

GoalCube is set up with good practice from the start. Leave the rules as they are unless you have a good reason; every change is saved with name and reason. How to

The Monday email

Recommendations (8 of 8 switched on)

  • Use of AI with minimal or limited risk is approved automatically under GoalCube's fixed rules, as long as it is not about decisions on people. The person responsible sees it on the task list.On
    Why · Turn off

    Employees can keep working without waiting; a person only confirms high-risk use and decisions about people (Art. 26 AI Act and Art. 22 GDPR).

    Then a human must confirm all use of AI, even low risk. Employees will wait more often.

  • The AI only gets data once the use has been recorded and confirmed in the AI inventory.On
    Why · Turn off

    All use of AI on the company's data is known and assessed under the AI Act and GDPR before it happens, and the user takes one step at a time. (The law does not require an inventory as such; the inventory shows which requirements apply.)

    Then the AI can get data before the use is recorded and confirmed.

  • Require a passkey (Face ID, fingerprint or security key) for decisions once users with a passkey have been created.On
    Why · Turn off

    Shows unambiguously who decided the case, and that the person had the role to do so.

    Then decisions can be saved with a written name instead of a passkey.

  • Only users with the right role may decide cases in an area (e.g. HR cases only by HR or an administrator).On
    Why · Turn off

    Art. 26(2) AI Act requires oversight by people with competence and authority.

    Then all users can decide all types of cases.

  • Flag decisions made in under 15 seconds per case as "short review time".On
    Why · Turn off

    Helps spot when the person simply follows the AI (automation bias, Art. 14(4)(b) AI Act).

    Then very fast decisions are not flagged in the audit trail.

  • Show the AI's uncertainty for each case.On
    Why · Turn off

    Makes it easier to assess the AI's recommendation critically (Art. 14(4) AI Act).

    Then the person deciding does not see what the AI is unsure about.

  • Show only the facts relevant to the decision (not email, phone and numbers).On
    Why · Turn off

    Data minimisation (Art. 5(1)(c) GDPR).

    Then email, phone and numbers are shown for decisions.

  • Timestamp the audit log with an independent timestamp service after every decision.On
    Why · Turn off

    Proves to third parties that the log existed at a specific time (in the product, a qualified service under eIDAS).

    Then the audit log has no independent timestamps.

8 legal requirements always apply (locked)
  • Decisions about people are made by a person, not by the AI. The AI may only recommend.
    Art. 22 GDPR; Art. 14 and 26(2) AI Act · locked
  • If the person makes a different decision from the AI's recommendation, it must be explained in at least one full sentence that can be shown to the person concerned.
    Art. 22(3) GDPR; Art. 86 AI Act · locked
  • A decision cannot be changed afterwards. It is logged with a checksum in a hash chain.
    Art. 12 and 26(6) AI Act · locked
  • The audit log contains only IDs and codes – no names (older entries from before 18 Oct 2026 may contain names) – and is kept for at least 6 months.
    Art. 26(6) AI Act; Art. 5(1)(c) GDPR · locked
  • The AI gets pseudonyms instead of names and numbers (see Annex C.2 of the data processing agreement). The real values are only shown at GoalCube in the EU.
    Art. 5, 25, 32 and 44 GDPR · locked
  • Prohibited use of AI is stopped: emotion recognition in the workplace or in education; social scoring of people; biometric categorisation by, for example, race, political opinion, religion or sexuality; manipulation or exploitation of vulnerabilities that can harm people.
    Art. 5 AI Act · locked
  • High-risk areas: recruitment and selection of people; decisions about employment (for example promotion, terms, dismissal, task allocation, evaluation); education (access, assessment, exam monitoring); credit scoring, or pricing of life and health insurance; access to public services; biometric identification or categorisation; safety in critical infrastructure. Exception for narrow, preparatory tasks without profiling.
    Art. 6 and Annex III AI Act · locked
  • Staff who use AI must have sufficient AI literacy.
    Art. 4 AI Act · locked

Simplified set of rules. Not legal advice.