Review campaigns
In a campaign, owners confirm that AI systems, RoPA, DPIAs, TOMs, vendors and TIAs are still up to date.
A register is only as good as its last check against reality. With review campaigns, an administrator asks all owners to check and confirm their records by a deadline. The result is dated evidence that the documentation is reviewed regularly: exactly what accountability and review intervals require.
At a glance
- Included from
- Available in all plans as soon as the module concerned is booked (beta)
- Where in the app
- Prove compliance → Review campaigns (AI Act and GDPR)
- Output
- Progress per person, confirmation per record in the audit log, CSV export
- Legal basis
- Art. 5(2), Art. 24(1) sentence 2 GDPR (review and update)
What can be reviewed
| Object type | Note |
|---|---|
| AI system | Including its documentation. |
| Records of processing | GDPR module only. |
| DPIA | GDPR module only. |
| TOMs | GDPR module only. |
| Vendors / DPAs | Vendor register only. |
| TIA | Transfer tracker only. |
How a campaign runs
- 1An administrator starts the campaign with a title, object types, a deadline (today at the earliest, at most one year ahead) and optionally a department filter.
- 2Each record in scope is assigned to the person it names as responsible, if they have an active user account. Records without an assignable person go to the administrators.
- 3Everyone involved receives an e-mail invitation and sees their open records in the review campaign view.
- 4For each record, the person confirms "reviewed: current" or "reviewed: updated". The confirmation appears in the record’s audit log, next to its edits.
- 5Reminders go out 7 days and 1 day before the deadline and once after it has passed; then the administrators receive an escalation listing all open records.
Manage and evaluate
- Progress per person, manual reminder, reassign records, cancel the campaign.
- CSV export of the status (prepared for Excel).
- Recurring campaign: at most one schedule per organisation, every 6, 12 or 24 months. The campaign starts automatically and carries month and year in its title.
- If a record is deleted during the campaign, it no longer counts.
Signed-in only
A confirmation is one person’s statement: "I have reviewed this record." That is why review campaigns are not available through the API; an API key would confirm in the name of the person who created it. Only administrators manage campaigns.