- Home
- How we work
AI agent implementation: a method a compliance team can follow, step by step.
Six steps. Each ends with something you sign or keep, so at any point you can see where the agent stands, why, and on whose approval.
The six steps
One process, its owner and its risk class
We sit with the person who owns the process and, early, with your DPO or counsel. We map the steps, the data, the systems and the decisions. We classify the use case under the AI Act with the reasoning written down, and say plainly if an agent is the wrong tool.
AI Act Art. 6Annex IIIGDPR Art. 35You keep: the brief, the data path draft, the classification.
The test set and the score, agreed before the build
From your real cases (anonymised where needed) we build the test set, then add safety cases: the wrong customer, a missing document, an attempt to make the agent ignore its rules, a request for data it should not give. You set the score it must reach.
Art. 10Art. 15You sign: the pass bar.
On the platform, in weekly rounds
We connect the knowledge sources and tools, set which actions need a person, connect only what the task needs, add the AI notice, and set cost limits. Every week you see the agent working on your cases.
Art. 14Art. 50GDPR Art. 25You see: the agent, weekly, and its test score.
Until it clears the bar, then on paper
Test rounds until the agent reaches your bar with every safety case passing. Then the documentation pack: purpose, limits, accuracy on your cases, oversight design, model route and region, data path, retention. And the inputs your DPO needs for the DPIA.
Art. 11Art. 13You keep: the test report and the documentation pack.
A person approves; a pilot proves it
A named person approves the release on its review card. Then a supervised pilot: the agent works on live cases while your team checks its output, until you are satisfied it does what the test said.
Art. 14Art. 26You sign: the release and the end of the pilot.
Watched, re-tested, reported
We monitor every run and the cost against your limits, re-run the tests before any change to the agent, its prompts or its model, handle incidents, and send a monthly report in plain words.
Art. 12Art. 26(5)Art. 72You get: the record, every month.
Three people on your side.
- The process ownerKnows the work and the exceptions. A few hours a week during the build.
- Your DPO or counselAt classification, at the documentation pack, and at release.
- The reviewersThe people who will approve the agent’s work. We brief them on what it does well, where it fails and how to spot automation bias (Art. 14(4)(b)).
Some things we won’t build.
- Anything on the AI Act’s prohibited list (Art. 5).
- Agents that take decisions with legal or similar effects about people with no person deciding.
- Agents that diagnose or recommend treatment, decide credit, or set life and health insurance prices, outside a full high-risk programme with your risk and compliance teams.
- Agents whose data path we can’t draw.
Bring one process. Leave with a risk class, a pass bar and a plan.
A 45-minute scoping call with the people who would build it. You get a first view of the AI Act risk class, the controls it needs, and whether an agent is the right tool at all.