AI agents your compliance team can sign off.
We design, build, test and run AI agents for regulated companies in the EU, on our own end-to-end platform hosted in Germany. Each agent is tested against a pass bar you set, records every run, leaves the decisions that matter to your people, and comes documented for the EU AI Act and GDPR.
- Platform hosted in Nuremberg, Germany
- Model route and region named in writing
- A data processing agreement before any data
Claims intake agentSample insurer · scripted · no model is called
Switch one offCustomer: “My e-bike was stolen from the cellar on 3 November. Policy HC-44-1093, IBAN DE89 3704 0044 0532 0130 00.”
ReplyYou’re writing to an AI assistant. A claims handler checks every decision.
Readsthis claim email and policy HC-44-1093, nothing else
Payout€1,240 proposed · waits for a claims handler
Recordrun 7f3a · input, sources, tools, model, approver
The platform runs on servers in Nuremberg. The model step is named per deployment, never promised in general.
AccuracyYour bar, signed firstYou approve the test cases and the score before we build. We don’t release below it.
OversightA person signsReleases, payouts, refusals: anything that matters waits for a named person.
RegulationMapped to the ActEvery control points to its article: 9, 10, 11, 12, 13, 14, 15, 26 and 50, plus GDPR.
Agents for the work that is careful, repeated and full of documents.
One process at a time, with the owner of that process. The agent prepares, checks and drafts. A person decides what leaves the building.
Intake and triage
Claims, applications, complaints, referrals. Reads what arrives, checks it against your rules, asks for what is missing, routes the rest.
A handler approves payouts and refusals.
Document review
Contracts against a playbook, KYC files against a checklist, submissions against a standard. Every finding with its source passage.
A reviewer accepts or rejects each finding.
Answers from your rules
For customers or staff, in their language, from your approved wording only. Says it is an AI, and hands over when a question needs a person.
Advice and exceptions go to your team.
Back-office checks
Reconciliation, exception lists, report preparation. The agent does the matching and explains each exception it could not clear.
An analyst signs off the result.
Examples of the kind of process we start with. We publish client work only with the client’s written consent, and have none to show yet.
Works with the systems you already run
Examples- Email and files
- Microsoft 365 (Outlook, SharePoint, OneDrive) through Microsoft Graph · Nextcloud
- Business systems
- SAP S/4HANA · Personio · Salesforce · HubSpot · your claims, policy or case system
- Databases
- PostgreSQL · MySQL, with read-only queries, each one reviewed before use
- Documents
- PDF, Word, CSV, Markdown and plain text, into the agent’s own knowledge index
- Anything else
- A REST API that takes a key, a login or OAuth 2.0 client credentials · an MCP server
Examples of what an agent can connect to, not partners: none of these vendors endorses us. Each connection is built and tested in your project, with credentials that are stored and never shown back. Reading works at once; anything that changes a record asks a person each time, unless you decide otherwise in writing.
One platform, from a brief to a monitored agent.
The agents we build live on our own platform, so the tests, approvals, records and limits are part of the product, not a spreadsheet beside it. Watch a sample agent go through it, then approve the release yourself.
Read incoming claim emails for home contents insurance. Check the policy and the cover, ask for anything missing, and draft a reply and a payout proposal. A claims handler approves every payment or refusal. German and English. No bank details in prompts.
Property claims handling is not an Annex III use case. Life and health insurance pricing would be (point 5(c)).
- Knowledge
- 3 documents · 214 passages
- Tools
- policy lookup (read) · payout proposal (asks a person)
- Guardrails
- secrets scrubbed · AI notice first
- Model route
- EU region, named in your DPA
- Cost limit
- €40 a day · €0.40 a run
- Hosting
- Nuremberg, Germany
spec signed bar 90% · safety 100%
owner claims operations (sample)
The spec is versioned. A change to it is a new version, and a new version is tested again.
Safety cases: 8 of 8 (all must pass)
Put the claims intake agent live?
Approved by you (sample). The approval is part of the release record.
Nothing goes live on a model’s word.
A named person approves each release, after seeing the score, the safety cases and the model route. The approval is kept with the release (AI Act Art. 14).
Deploy waits. Approve the release first: that is the point.
Sent back. The agent was rebuilt and tested again; it waits for you once more.
- Version
- v1.2 · claims inbox
- Runs on
- Nuremberg, Germany
- First message
- says it is an AI
- Payouts and refusals
- wait for a claims handler
- Records
- every run, kept as agreed
in claim email · 3 attachments
used policy §4.2 · policy lookup
model route per contract (sample) · €0.03
held payout €1,240 → a person
The layers around every agent, and what each one stops.
Your DPO and your security team ask the same things: who gets in, what the agent can reach, what reaches the model, who decides, what is kept. These are the strongest answers that are true today. The trust page has all nine layers, each with what is still partial.
Nothing changes outside the agent without a person
AI Act Art. 14GDPR Art. 22A write waits for a named person. The approval covers exactly that action, once, and expires. A person approves every release.
Documents are data, never orders
AI Act Art. 15Pages, files and tool results are labelled untrusted. Code an agent writes runs locked, with no network. Every injection case in the safety pack must pass before release.
Your records answer only to you
GDPR Art. 32Every record, file and search index is tied to its client and filtered by who is signed in. A live agent runs in its own containers, with its own database.
Credentials sealed, never shown back
GDPR Art. 32Keys you give us are sealed to their owner and can’t be read back. Secrets are scrubbed from anything the model or the records see. All traffic is HTTPS.
One request, from sign-in to the record: six of the nine layers it passes. The platform is hosted in Nuremberg, Germany; the model step is named per deployment in your contract.
What we don’t claim: we hold no ISO/IEC 27001 or SOC 2 certificate and show no badges. Personal data is not masked before the model today, stored data other than credentials is not encrypted at rest yet, and the model step is not promised to stay in the EU. The trust page says what is partial and what comes next.
Built for the EU AI Act and GDPR, not patched for them.
Nobody can sell you an “AI Act certified” badge; no such certificate exists. What a regulator, an auditor or your DPO will ask for is evidence. We build agents that produce it as they work.
Risk classification first
AI Act Art. 6Annex IIIBefore anything is built, the use case is classified and the reasoning written down: credit scoring and life and health insurance pricing are high-risk; claims intake usually is not.
Tested against a signed bar
Art. 15Art. 10Your cases plus safety cases. Every safety case must pass, and we don’t release below your bar. Re-run before any change.
A person in the loop
Art. 14GDPR Art. 22Decisions with a legal or similar effect wait for a named person. Anyone with access can stop the agent at once.
Every run on record
Art. 12Art. 26(6)Input, sources, tools, model, cost and approver, for each run, kept for the period you agree: at least six months where the Act requires it.
Documented for your auditors
Art. 11Art. 13What the agent does, its limits, its accuracy on your cases, its oversight design and its model route, in one documentation pack.
Private by design
GDPR Art. 28Art. 5(1)(c)Art. 17A DPA and a dated sub-processor list before any data. Only the systems the task needs. Erasure with a receipt for each step.
Where the AI Act stands, today
- Prohibited practices apply
- Rules for general-purpose AI models
- The Act applies; people must be told they talk to an AI (Art. 50)
- Build to the high-risk standard while there is time
- High-risk rules for Annex III systems
- High-risk rules for AI in regulated products
Dates as amended by the Digital Omnibus on AI, which the European Parliament approved on 16 June 2026. Read on 9 November 2026. Sources and the article-by-article map.
Already live: saying it is an AI
AI Act Art. 50Since 2 August 2026, people must be told when they are dealing with an AI, at the latest at their first interaction. Every customer-facing agent we build opens by saying so, and the safety pack tests that it does.
See one agent’s data path, drawnSix steps, each with something you sign or keep.
Scope and classify
One process, its owner, its data, its risk class under the AI Act, and whether an agent is the right tool.
You keep: the brief and the classification.
Sign the bar
Together we write the test cases and the safety cases, and you set the score the agent must reach.
You sign: the pass bar.
Build on the platform
Knowledge from your documents, the tools it may use, the actions that wait for a person, the cost limits.
You see: the agent working, every week.
Test and document
Test rounds until it clears the bar, then the documentation pack and the DPIA inputs.
You keep: the test report and the pack.
Approve and deploy
A named person approves the release. Then a supervised pilot with your team before it runs on its own.
You sign: the release.
Run and improve
Monitoring, cost limits, re-tests before every change, and a monthly report in plain words.
You get: the record, every month.
For sectors where a wrong answer has a cost.
Each sector meets the AI Act at a different place. We know where the line is in yours.
Banks and financial services
KYC files, AML alert preparation and customer questions, kept clear of credit scoring and contracted on DORA’s terms.
AI Act Annex III 5(b)AI Act Art. 6(3), 6(4)Insurance
Claims intake, policy answers and complaint files, with a handler deciding every payout. Life and health pricing stays off-limits.
AI Act Annex III 5(c)AI Act Art. 27Consumer lending
Loan support, complaints, documents and payment plans for lenders and lending platforms. No agent approves, prices or scores a loan.
CCD2 Art. 18(3)CCD2 Art. 18(9)Health and life sciences
Referral intake, letters for sign-off and regulatory drafting, on the administrative side of the line. No diagnosis, no triage.
GDPR Art. 9GDPR Art. 35Legal and professional services
Contract review against your playbook, due diligence and intake, from your documents. Lawyers stay the ones who advise.
AI Act Annex III 8GDPR Art. 28Public sector
Citizen questions, casework preparation and tender checks, with the AI Act’s public-body duties built in. No benefit decisions.
AI Act Annex III 5(a)AI Act Art. 27Industry and manufacturing
Quality records, supplier documents and technical files, drafted for an engineer to sign. Never a safety function.
NIS2 Annex IIGDPR Art. 5(1)(c)Clear scopes, a fixed price for yours.
Start with a review or a pilot. Book a call for the price; nothing commits you to the next step.
AI Act and GDPR readiness
Book a callPrice on request
One use case: risk class with reasons, obligations and dates, the data path, DPIA inputs and a gap list for your counsel.
What’s in itOne agent, one process
Book a callPrice on request
Brief, signed pass bar, build on the platform, test report, approval, and a supervised pilot with your team.
How a pilot runsProduction, documented
Book a callPrice on request
Integrations, the full test set, the documentation pack, oversight training for your reviewers, and go-live.
From pilot to productionRun on the platform
Book a callPrice on request
Hosting, monitoring, cost limits, re-tests before every change, incident handling and a monthly report. Model usage at cost.
What we runWe don’t publish prices, because the scope sets them. After a short scoping call you get a written proposal with a fixed price for your scope, in EUR, excluding VAT. Model usage is billed at the provider’s price, without mark-up, and capped by the limits you set.
Regulated AI, in plain words.
Human oversight in practice: designing the approval step an auditor will accept
Article 14 asks for oversight that works: people who understand, can override and can stop. Six design rules for the approval step in an AI agent.
ReadGDPR and AI agents: the seven questions your DPO will ask
Controller or processor, the DPA, minimisation, retention, erasure, sub-processors and transfers: what GDPR asks of an AI agent, article by article.
ReadThe EU AI Act for companies deploying AI agents: what applies, and when
Risk classes, provider or deployer, the dates after the 2026 Digital Omnibus, and five things to do now. Every article cited, read 9 November 2026.
ReadWhat compliance and IT ask first.
Does all our data stay in the EU?
The platform runs on servers in Nuremberg, Germany, and your documents, knowledge index, run records and test cases are kept there. The model step is different: its route and region are not settled yet, so each deployment names its model provider, route and region in your contract. Some sub-processors may process data outside the EU. We will not promise that every byte stays in the EU unless the route in your contract guarantees it.
Are you “AI Act compliant” or “GDPR certified”?
Nobody is, as a label: no certificate exists for either. Compliance belongs to a system used in a context, by you and your vendors together. We give you the evidence the AI Act and GDPR ask for (classification, tests, records, oversight design, documentation, a DPA) and your counsel and DPO decide. We hold no ISO 27001 or SOC 2 certificate today, and we don’t display badges we don’t hold.
Is an agent that drafts claims decisions high-risk?
Usually not for property or motor claims: Annex III lists credit scoring of people and risk assessment and pricing in life and health insurance, not claims handling in general. But GDPR Art. 22 still protects people from purely automated decisions with significant effects, which is why our agents prepare and a person decides. We write the classification and its reasons down for each use case.
Which AI models do you use?
We choose per agent, by testing candidate models on your cases against your bar. The provider, route and region go into the contract. We never change the model of a live agent without re-running your tests and asking for your approval.
What do we need to provide?
An owner for the process, a few hours a week of their time during the build, examples of real cases (anonymised where needed) and access to the documents the agent should use. Your DPO or counsel joins at classification and at release.
Can we try the platform ourselves?
The demo on this page is scripted on sample data. In a scoping call we show the platform itself, and for a pilot we set up a workspace for your team.
Where is the company based?
We serve companies in the EU; the platform is hosted in Germany. The company behind Wise Agents is Advanced AI Solutions Inc..
Bring one process. Leave with a risk class, a pass bar and a plan.
A 45-minute scoping call with the people who would build it. You get a first view of the AI Act risk class, the controls it needs, and whether an agent is the right tool at all.