What we do/In depth
For compliance, legal and riskControl and law
Who answers for what an agent does, what is recorded, and which rules we map to.
G1 · Responsibility
An agent can be responsible for a task. A person stays accountable.
We use an extended RACI matrix. The agent may do the work (R). The accountability (A) always sits with a named person. The agent's limits are written down before it goes live: amounts, confidence thresholds, when it must hand over.
R does it · A answers for it · C is asked · I is told
| Task | Agent | AP lead | Controller | Supplier |
|---|---|---|---|---|
| Read and book invoices | R | A | – | – |
| Match invoice to order | R | A | C | – |
| Prepare the payment run | R | C | A | I |
| Release payments over CHF 5,000 | – | R | A | I |
made up
We work this way ourselves. Our agents write code for clients, and a named person at the client approves every change before it is merged.
G2 · Records
What you receive
Agent register
For every agent: its owner, purpose, data access and autonomy step.
Audit log
Every step an agent takes: what it read, what it did, which rule applied, who approved.
Rollback
Every agent can be stopped, and its work reversed or handed back to people.
G3 · Frameworks
What we map to
We map our controls to these frameworks. That is not the same as being certified under them.
Switzerland
The Data Protection Act (nDSG) applies to every client. In finance, FINMA Guidance 08/2024 on governance and risk management for AI.
European Union
With EU customers or operations, the EU AI Act. Its deadlines for high-risk systems are under discussion, so we check the current state for each client.
Management systems
ISO/IEC 42001 and the NIST AI Risk Management Framework give the structure: roles, risk assessment, monitoring.
G4 · Staff
Staff consultation is part of the plan
In Switzerland, larger changes can trigger information and consultation rights under the Participation Act (Mitwirkungsgesetz). In Germany, the works council has to be involved. We plan for both from the analysis on.
BackThe short version, for the manager · What we do →