AI Sentinel
Every AI use case classified, justified and signed off — with a record that holds up.
AI Sentinel assesses AI use cases — and the AI agents behind them — against the EU AI Act, DORA and GDPR. It asks the questions that matter, applies approved rules, derives the obligations that follow, maps them to the controls you already have and keeps a complete audit trail. Your experts keep the decision.
Where AI governance decisions break down
When an AI use case is introduced or materially changed, an institution has to know quickly which rules apply, on which facts and who approved it. Each row below is a point where that stops working.
What the decision requires
Use case, system, role, purpose and deployment context captured in one consistent structure.
What happens today
Described differently by each business unit, in manual documents with implicit assumptions.
What the decision requires
The same facts and the same rules lead to the same classification.
What happens today
The result depends on who assesses. Comparable cases are not necessarily decided comparably.
What the decision requires
Each AI use case linked to the controls you already run, with genuine gaps made visible.
What happens today
Mapped manually, case by case, or handled in a separate AI process next to your framework.
What the decision requires
Sources, assumptions, rule versions and approvals recorded as part of the process.
What happens today
Reconstructed later with additional effort, ahead of an audit or exam.
What the decision requires
Regulatory changes flow into the cases already assessed.
What happens today
Every change has to be reapplied to existing cases, one by one.
What the decision requires
A clear review status and named approvers across stakeholders, such as business units, Compliance, Risk, Legal and Information Security.
What happens today
The assessment is spread across functions. Sign-off stalls because no one is confident enough to close it alone.
One decision workflow, from intake to sign-off
AI Sentinel guides your teams through the questions that matter, applies approved regulatory logic to the confirmed answers and documents every step. Where the logic does not reach, it says so and escalates.
Capture
Structured questions describe the use case, system, role, purpose, affected parties and deployment context — including any AI agents involved. Completeness is checked; extracted facts are confirmed by a person.
Assess
The inference engine applies the confirmed facts to approved rules for the EU AI Act, DORA and GDPR. Same inputs and same rule version always produce the same result.
Interim Review
Cases that are uncovered, contradictory or depend on interpretation are flagged with a traceable reason — never waved through.
Obligations & controls
Applicable obligations follow from the assessment, each linked to its legal source and rule — and mapped to the controls you already have.
Sign off & record
Reviewers approve in the workflow. Facts, rule trail, assumptions, version and approval are stored in an exportable decision record — ready for audit to come.
The decision record is what turns an assessment into something Compliance can defend, Internal Audit can reproduce and a supervisor can read.
- ＋Replaces manual AI inventory collection with structured intake
- ＋Gives comparable cases a consistent, rule-based assessment
- ＋Documents source, rule, version and decision path for every finding
- ＋Shows a clear review status across business owner, Compliance, Risk and Legal
- ＋Reuses your existing controls and flags only genuine gaps
Tool your teams work in every day
AI Sentinel is a human-supervised, rule-based expert system delivered as a subscription. It is built so that every result can be explained to an auditor.
Mapping to your existing controls
Obligations are mapped to the control framework you already run. Where a control covers a requirement, it is reused — no re-mapping. Where nothing covers it, the gap is flagged with a rationale.
Deterministic engine
Rules are applied by a deterministic inference engine. A language model supports intake and explanation; it never alters the engine's output and gives no free-form legal interpretation.
Escalate, don't guess
"Complete" applies only within an explicitly approved coverage segment. Outside it, AI Sentinel escalates with a stated reason. There is no probabilistic confidence score.
Rule packs that stay current
Legal sources, conditions, exceptions and obligations are versioned, effective-dated and approved under the four-eyes principle, and updated as regulation changes. Past decisions remain reconstructable.
AI agents in scope
Where agents are used within a use case, they are captured and assessed together with it, in the context in which they are deployed.
One workflow covers every role
Business owners, Compliance, Risk, Legal, Information Security and Audit work on the same case with a shared review status.
Audit-ready by default
Inputs, sources, rule trail, versions, reviews and approvals are logged automatically and exportable as a decision record.
One AI agent use case, assessed step by step
A software developer agent running on a local language model. The sample follows the workflow from section 02: the risk assessment path of the EU AI Act (step 02), then the resulting requirements and their mapping to your controls (step 04).
Key takeaways
Risk class follows the use case
The same agent can fall into a different risk class, from minimal to high risk, depending on the process it is used in.
Implementation matters
Whether the model comes from a vendor, is open-weight or is trained in-house affects whether the institution acts as deployer or as provider, and with it which obligations apply.
A local model is not a lower risk
Building and operating your own agent setup may make the institution the provider of that AI system, not only a deployer.
The use case
Your software development department employs a set of open-source agents to write and review code. The code is used in an application rating your customers' credit risk for single-family home loans.
The IT department employs an open-source agent framework and runs open-weight models that it downloaded from a public model hub.
Analysts specify code changes via tickets. These are assigned to a coding agent. Its code is reviewed by another agent. The agents iterate. A user does the final review and deployment.
Where this sample sits in the workflow
part of the platform workflow, not shown in this sample selected sub-step
Is it an AI system?
A machine-based system designed to operate with varying levels of autonomy that infers, from the input it receives, how to generate outputs. Systems based solely on rules defined by natural persons are not covered (recital 12).
Both agent types employed are machines that infer outputs and have considerable autonomy to derive their output.
Is it prohibited?
Cross-check that none of the practices prohibited under Art. 5(1) is performed. The agents are checked against each of them:
- Manipulative, subliminal or deceptive techniques causing significant harmNo
- Exploiting vulnerabilities (age, disability, social or economic situation)No
- Social scoringNo
- Assessing the risk of criminal offences based solely on profilingNo
- Untargeted scraping of facial imagesNo
- Emotion recognition in the workplace and in educationNo
- Biometric categorisation inferring sensitive characteristicsNo
- Real-time remote biometric identification for law enforcement in public spacesNo
- Non-consensual intimate imagery (applies from 2 December 2026)No
- Child sexual abuse material (applies from 2 December 2026)No
Is it high-risk?
We walk through this step with you for your own AI use cases.
Request a demoDo I need to label AI usage?
Art. 50 sets transparency duties that apply independently of the risk class. They apply from 2 August 2026; for Art. 50(2), systems placed on the market earlier have until 2 December 2026.
Providers must design systems that interact directly with people so that these are informed that they deal with an AI system, unless this is obvious to a reasonably well-informed person. The developers who assign tickets to the agents know that they work with AI.
Providers of AI systems that generate synthetic text must mark the outputs in a machine-readable format, so that they are detectable as AI-generated. Exceptions apply, for example for assistive functions for standard editing. This analysis treats source code as text. If the institution is the provider of its agent setup, this duty may fall on it.
Source code should carry headers showing AI use.
These do not apply here. They concern emotion recognition, biometric categorisation, deepfakes and text published to inform the public on matters of public interest.
Informing the reviewing developers that code was written by AI supports due diligence, for example on hallucinations or altered requirements such as creditworthiness calculations. This is not an Art. 50 duty for internal code.
Mark output as produced by AI, e.g. through user naming.
If the local model is used for other purposes, check against the rules for general-purpose AI models.
Requirements
We walk through this step with you for your own AI use cases.
Request a demoWould apply if a system in this use case is classified as high-risk (see step 2.3)
The requirements for high-risk systems listed in Annex III apply from 2 December 2027.
- Use as per the provider's instructions for use (Art. 26)
- Assign human oversight to competent, trained people (Art. 26)
- Where you control the input data, ensure it is relevant and sufficiently representative (Art. 26)
- Monitor operation, and suspend use and inform where a risk arises (Art. 26, with Art. 73 for serious incidents)
- Keep the logs under your control for at least six months (Art. 26)
- Inform workers' representatives, affected workers and persons subject to decisions (Art. 26)
- Fundamental rights impact assessment before first use, for credit scoring and for life and health insurance risk assessment and pricing (Art. 27)
- Use the provider's transparency information for the GDPR data protection impact assessment (Art. 26)
- Right of affected persons to an explanation of decisions taken on the basis of the system's output (Art. 86)
- Risk management system across the lifecycle (Art. 9)
- Data governance, including bias examination (Art. 10)
- Technical documentation per Annex IV (Art. 11)
- Automatic event logging (Art. 12)
- Transparency and instructions for use (Art. 13)
- Human oversight by design (Art. 14)
- Accuracy, robustness and cybersecurity (Art. 15)
- Quality management system (Art. 17)
- Keep documentation for 10 years and logs for at least six months (Art. 18, 19)
- Conformity assessment, declaration of conformity and CE marking (Art. 43, 47, 48)
- Registration in the EU database (Art. 49)
- Contact details on the system or its documentation (Art. 16)
- Corrective actions (Art. 20), serious incident reporting (Art. 73), cooperation with authorities (Art. 21)
- Post-market monitoring plan (Art. 72)
Control Analysis
The requirements from step 4.1 are mapped to the controls you already run.
- Art. 4 AI literacy: specific training that makes software developers aware of the technical and legal risks→ Your control for tracking mandatory training participation needs to be updatedUpdate required
We walk through this step with you for your own AI use cases.
Request a demoSample analysis based on Regulation (EU) 2024/1689 (EU AI Act) [6], as amended by the AI Omnibus [7]; article references as in the analysis. Application dates: Art. 50 from 2 August 2026, the prohibitions on non-consensual intimate imagery and child sexual abuse material from 2 December 2026, requirements for Annex III high-risk systems from 2 December 2027 [4][5]. The classification in step 2.3 is to be confirmed by the institution's legal department.
Built for the teams that carry AI governance
AI Sentinel is built for fintechs and financial institutions in the DACH region that already run AI. We are opening it to a first group of design partners.
Executive management
A controllable governance process, reduced specialist effort and resilient reporting.
AI governance leads
A consistent decision process across departments and cases.
Business, Compliance, Risk, Legal, InfoSec
Guided data capture, clear follow-up questions and traceable results.
Internal and external audit
A reproducible rule trail with inputs, sources, versions and approvals.
Two backgrounds, one shared view from inside the industry
Both co-founders have seen first-hand how financial institutions would benefit from governing AI within the control framework they already run. AI Sentinel combines their experience.
See AI Sentinel on your own AI use cases
Tell us which AI use cases and agents you need to assess. We will show you how the platform handles them.
Making AI Compliance work for you. Agents & beyond.