AMBIENT AGENT
Self-AssessmentBook an introductionIntroduction

Home / Who it is for / Risk and compliance

You carry the obligations already. AI now has to fit inside them.

You work in risk, compliance or data protection. You need AI use brought within the rules you already answer to, with evidence you can produce on request.

Book an introductionTake the Self-Assessment
Control gate: approval recordSample data
Use of AI
Claims letter drafting
Business Owner
Head of Claims
Risk rating
High
Decision
Cleared to roll out
Is this person passported?The builder holds Level 3. The users hold Level 1 or above.
Is there evidence?Use, data and risk are on record, with trial results.
Has someone accountable approved it?Signed off by the Governance Approver, with the date recorded.
Illustrative view with sample data. Built in the tools you already run.

What you are likely being asked.

Each answer is covered in full, with sources and dates, on the Questions page.

Is a policy enough?

A policy states what people should do. Governance decides what they are permitted to do, and produces the evidence.

Does the EU AI Act reach us?

It can. Scope follows the activity, not the address. The AI literacy obligation has applied since 2 February 2025.

We are working towards ISO 42001. Is that the same thing?

The two work together. The standard defines the management system. A control system makes it hold where people use AI.

Five things you should be able to show today.

In our experience, most organisations can produce two of them. If a regulator asked this afternoon, the distance between what you could produce and what should exist is the measure of where you stand.

  • A current count of AI agents and assistants in use.
  • A named owner for each one that is live.
  • A record of who approved each use, and on what basis.
  • What each agent can reach, and who it shares with.
  • What was required of the person who built it, before they were permitted to build.

What you hold when the work is done.

Evidence you can produce when someone asks.

An approval record for every use

Who approved it, when, and on what evidence.

Risk ratings before rollout

Every use of AI is risk-rated before it is deployed.

A sector overlay

Your regulator’s expectations mapped to the part of the system that shows each one.

The dates that matter.

Parts of the EU AI Act already apply. UK regulators are applying the frameworks they already have. The Regulatory Clock is reviewed monthly.

  1. AI literacy obligationIn force
  2. Transparency obligationsIn force
  3. Stand-alone high-risk obligationsTo come
  4. AI embedded in regulated productsTo come
See the Regulatory ClockQuestions, with sources

Where to start.

Two steps cost nothing. Every paid step has a published price.

  1. Self-Assessment

    Ten questions on this site. About five minutes.

    No charge

  2. Introduction

    30 minutes. A conversation about where you are, then a look at a sample of the work.

    No charge

  3. Your team runs it

    You own the system. A Governance Retainer is there if you want it.

    Optional: from £10,000per month, plus VAT

See a sample before you decide anything.

An introduction takes 30 minutes and there is no charge. We talk about where you are, then show you a sample of the work.

Book an introductionTake the Self-Assessment