AI Use Register & Readiness Agent
Finds every place you run AI, and what each one now obliges you to do
5 of 8 AI systems need attention.
8 AI systems checked. 5 flagged. The largest gap is 606 days.
Start with CV screening. Hiring has the most flagged.
The legal risk class of a system is for counsel; the list only shows what the register leaves blank or out of date.
Why rows were flagged
- No assessment, or over 12 months old43%
- High risk, no oversight owner29%
- Not classified29%
Value flagged by Use
- Hiring1
- Operations1
- Finance1
- Sales1
- IT1
Items to act on, worst first
| Item | Use | Value | Days since the assessment | Why |
|---|---|---|---|---|
| CV screening | Hiring | 1 | 477 | High risk, no oversight owner, No assessment, or over 12 months old |
| Demand forecast | Operations | 1 | 0 | Not classified, No assessment, or over 12 months old |
| Credit limit model | Finance | 1 | 0 | High risk, no oversight owner |
| Meeting notes bot | Sales | 1 | 0 | Not classified |
| Spam filter | IT | 1 | 606 | No assessment, or over 12 months old |
What to do this week
- Resolve CV screening first: it is the most urgent on the list.
- Fix the data or the status on every flagged row, then re-run.
- Re-run this check every time the list changes, before it reaches a decision.
Do
- Fix the highest-risk item first, then run the check again on fresh data.
Don't
- Don't act on one row alone: open the source record first.
How to improve
- Add more detail per row (owner, date, source) so the next report can trace each item.
- Add a second period of data so the next report can show whether things are improving.
Demo
Overview
The EU AI Act's duties fall on the companies deploying AI, not only on the labs building it, and they phase in through 2026. Most companies running AI in production cannot say where they run it, what it decides, or whether any of it falls into a prohibited category.
The usual answer is a consultancy engagement or a checklist. Neither can tell you what you actually operate. This works from your own descriptions of your own systems — what each one does, what it decides, whose data it touches, whether a person reviews the output — and produces the register that every obligation starts from.
For each system it reports what the description suggests: whether a use appears prohibited, whether it appears to touch a high-risk area such as employment, credit or essential services, what transparency the deployment would owe, and where human oversight is claimed but not evidenced. It reaches no legal conclusion. Classification is a determination a lawyer signs, and a tool that announced it would be selling you a liability.
Benefits
You find out what you actually run
Usually more systems than anyone expected.
The prohibited things surface first
Those are not deadlines. They are stop signs.
A shorter, cheaper legal conversation
Counsel reads a register rather than interviewing everyone.
What it does
Builds the register nobody has
Every obligation starts from a list of what you run. Almost no company has one.
Sorts by what a system decides
Not by which model it calls. What it decides about a person is the thing the rules turn on.
Flags apparently prohibited uses first
Some practices are not a compliance burden but a ban. Those are reported before anything else.
Finds oversight that is claimed but not evidenced
"A human reviews it" is the commonest control asserted and the least often documented — and an assertion is not a control.
Names the transparency each deployment owes
Telling people they are dealing with a system, and labelling generated content.
Concludes nothing
Risk classification is a legal determination. It gathers what a lawyer needs and refuses to pre-empt them.
What this changes
What this changes about your week
- It takes over
- Working out where the organisation runs AI and what each use now obliges it to do.
- Done today by
- Nobody, or a consultancy engagement.
- How often
- Once to build the register, then every new AI feature.
- Typical manual effort
- Interviewing every team to find what they run is weeks.
Why Compliance & Risk in particular. The duties fall on companies deploying AI, not only the labs, and they phase in through 2026. Most companies cannot say what they run — and some of what they built is not a compliance burden but a ban.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
AI Use Register & Readiness Agent has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3Toolssearch_knowledge, extract_structured_data
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Requirements
Integrations
No integrations required.
Before you start
- Descriptions of the AI systems you run — purpose, decisions, data, oversight
- A knowledge base holding the framework text or checklist you work to
- Requires the All-Access plan or higher
Use cases
Building the register
From scattered descriptions into one list.
Before shipping an AI feature
What it would oblige you to do, before it exists.
A customer or investor asks
Enterprise diligence now asks this, and blank is a bad answer.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Does it tell us if a system is high-risk?
No. That is a legal classification with substantial consequences and a lawyer signs it. It reports what your description suggests and gathers what counsel needs to decide, which is where most of the time goes anyway.
Is this legal advice?
No. It works from your descriptions and the framework text you load, and routes every judgement. Obligations differ by role, jurisdiction and date, and it does not interpret them.
We are not in the EU. Is this relevant?
If you offer a system to people in the EU, or its output is used there, it can reach you. It reports what your description suggests and flags where your market needs checking — it does not decide jurisdiction.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent