{"operator":{"legalName":"Plexum Safety & Hygiene Ltd","product":"Plexum360","role":"Provider of the Plexum360 agent group (EU AI Act Article 3(3)); processor for subscriber workspace data (GDPR Article 28)","postureReviewedAt":"1 October 2026"},"system":{"name":"Plexum360 agent group","intendedPurpose":"Decision support for occupational health and safety, environmental, quality, and governance compliance: incident root cause analysis, regulatory requirement mapping, control planning, compliance documentation, and report drafting — always subject to human review.","riskClassification":"Limited risk (EU AI Act Article 50 transparency obligations). Not intended for any Annex III purpose.","humanOversight":"Manager approval at every hand-off or at final sign-off; reports cannot be issued without a named approver; any workflow can be stopped at any time.","logging":"Per-stage provider, model, SHA-256 input digest, output, timestamps, and reviewer, retained with the workflow.","transparency":"AI-assisted label on every generated report, machine-readable ai-generated metadata, and this register.","dataMinimisation":"Direct identifiers redacted and personal names withheld before inference.","agents":[{"key":"triage","name":"Escalation & Triage Agent","role":"Escalation triage and cross-module routing","mandate":"Receives every signal the escalation engine raises from any workspace module, confirms or raises the escalation tier, maps which other modules and roles are affected, sets out a RACI by role, recommends immediate containment, and states whether an internal audit should follow.","limits":["Never lowers the tier set by the escalation rules; it can only confirm or raise it","Does not close, approve, block payments, or change anyone's access; it recommends and a human decides","Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Routing and prioritisation of organisational records for human decision; it does not allocate tasks to or monitor individual workers, which keeps it outside EU AI Act Annex III point 4."},{"key":"investigator","name":"Investigation Agent","role":"Root cause analysis and investigation","mandate":"Reconstructs the event timeline, separates immediate, underlying, and root causes, runs a five-whys and causal-factor analysis, and lists the evidence still needed to confirm each finding.","limits":["Does not attribute blame to, score, or profile any individual worker","Does not decide whether an event is legally reportable; it flags candidates for the legislation agent and a competent person"],"riskClassification":"Limited risk. Decision support for systemic cause analysis; it is instructed not to evaluate the behaviour or performance of individual workers, which keeps it outside EU AI Act Annex III point 4."},{"key":"legislation","name":"Legislation & Compliance Agent","role":"Regulatory intelligence and compliance guidance","mandate":"Maps the request to statutes, regulations, harmonised standards, and regulator guidance for every jurisdiction and sector involved, using the platform regulatory watch feed for current developments, and states notification duties and deadlines.","limits":["Does not give legal advice; every requirement must be verified against the official text by a competent person","States its confidence and marks anything it cannot source"],"riskClassification":"Limited risk. Information retrieval and summarisation of public law; outputs are reviewed by a human before use."},{"key":"mitigation","name":"Mitigation & Controls Agent","role":"Controls survey and mitigation planning","mandate":"Surveys the controls that existed, rates their effectiveness, and proposes new controls ordered by the hierarchy of control, each tied to the cause it addresses, the regulation that drives it, and how it will be verified.","limits":["Recommends; it never closes, approves, or assigns actions to named people — only to roles"],"riskClassification":"Limited risk. Recommendations are proposals that a manager accepts or rejects."},{"key":"documentation","name":"Compliance Documentation Agent","role":"Compliance document compilation","mandate":"Compiles the full document set a project needs to demonstrate compliance: policies, procedures, registers, plans, permits, licences, forms, and statutory submissions, each with its legal basis, owner role, review cycle, and section outline.","limits":["Drafts structures and outlines; it does not certify that a document satisfies a regulator"],"riskClassification":"Limited risk. Document structuring and drafting assistance."},{"key":"reporter","name":"Reporting Agent","role":"Final report compilation","mandate":"Receives every upstream agent output and compiles one coherent, auditable report with an executive summary, findings, regulatory position, action plan, limitations, and the sign-offs required.","limits":["A report is never issued until a named human approves it","Must not introduce findings that no upstream agent or the source record supports"],"riskClassification":"Limited risk. Generated content is labelled as AI-assisted under EU AI Act Article 50 and requires human sign-off."},{"key":"legionella_risk","name":"Water Risk Assessment Agent","role":"Dynamic Legionella and water risk assessment","mandate":"Assesses every water system in scope (cooling towers, calorifiers, cold water storage tanks, hot water systems, showers, irrigation, animal water systems, ornamental features and fountains, hose reels, and misting systems) for stagnation, aerosol generation, temperature control, scale, corrosion, biofilm, and vulnerable populations, identifies people at risk, lists deadlegs and design defects against HSE ACOP L8 and BS 8580-1, and ranks the systems by priority with an improvement programme.","limits":["Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap","Assigns work to roles such as responsible person or competent person, never to named people","Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them"],"riskClassification":"Limited risk. Assessment support for building water systems; it evaluates plant and conditions, not people, and a competent person signs off the assessment."},{"key":"scheme_of_control","name":"Written Scheme of Control Agent","role":"Written scheme of control","mandate":"Turns the approved risk assessment into a written scheme of control: control strategy, task schedule with frequencies and limits, roles and responsibilities, and the action to take when a result is out of limit, following ACOP L8 and HSG274.","limits":["Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap","Assigns work to roles such as responsible person or competent person, never to named people","Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them"],"riskClassification":"Limited risk. Drafts a control document that the responsible person approves."},{"key":"temperature_tmv","name":"Water Monitoring Agent","role":"Temperature, TMV, flushing, and water parameter monitoring","mandate":"Reviews monitoring data from IoT sensors, manual checks, laboratory reports, and contractor inspections: hot, cold, calorifier, and TMV mixed temperatures against HSG274 limits, chlorine, pH, turbidity, and conductivity against the treatment programme, TMV servicing and fail-safe status, and flushing coverage of little-used outlets, and raises an action for every threshold breached.","limits":["Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap","Assigns work to roles such as responsible person or competent person, never to named people","Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them"],"riskClassification":"Limited risk. Compares recorded readings with published limits for human review."},{"key":"water_sampling","name":"Legionella Sampling Agent","role":"Sampling plans, laboratory results, and trend analysis","mandate":"Manages the sampling plan and laboratory schedule, interprets Legionella, TVC, Pseudomonas aeruginosa, E. coli, and coliform results against HSG274 Part 2, BS 7592, and HTM 04-01 where healthcare applies, trends results by outlet, sets resampling and post-remedial sampling, checks UKAS accreditation, and grades each finding by severity for escalation.","limits":["Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap","Assigns work to roles such as responsible person or competent person, never to named people","Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them"],"riskClassification":"Limited risk. Interpretation of laboratory results against published action levels; a competent person confirms every conclusion."},{"key":"remedial_works","name":"Legionella Corrective Action Agent","role":"Corrective actions and remedial works","mandate":"For every failure upstream, identifies the failure, determines its risk level, and sets the corrective actions (for example flush the outlet, investigate the TMV, review circulation, re-sample, and verify closure), assigned to roles with deadlines, plus interim controls, disinfection where justified (BS 8558 and HSG274), and the checks required after the works. Approved actions become tracked WTR records that escalate if they go overdue.","limits":["Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap","Assigns work to roles such as responsible person or competent person, never to named people","Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them"],"riskClassification":"Limited risk. Recommendations that the responsible person accepts or rejects."},{"key":"water_logbook","name":"Water Hygiene Logbook Agent","role":"Logbook and water hygiene report","mandate":"Compiles the logbook entries for the period from every approved upstream output and the source record, and writes the water hygiene report for sign-off, supporting the ACOP L8 duty to keep records for at least five years.","limits":["Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap","Assigns work to roles such as responsible person or competent person, never to named people","Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them","A report is never issued until a named human approves it"],"riskClassification":"Limited risk. Generated content is labelled as AI-assisted under EU AI Act Article 50 and requires human sign-off."},{"key":"water_safety_plan","name":"Water Safety Management Agent","role":"Water safety plan and water management programme","mandate":"Supports the appointed responsible person (water): drafts the water safety plan and water management programme, maps the water systems, identifies water risks, sets the hygiene programme and contractor controls for water systems, and schedules the annual review, following ACOP L8, HSG274, BS 8680, and WHO water safety plan guidance.","limits":["Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap","Assigns work to roles such as responsible person or competent person, never to named people","Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them","Supports the appointed responsible person; it never acts as the responsible person or the duty holder"],"riskClassification":"Limited risk. Drafts management documents that the responsible person approves; it does not control any water system."},{"key":"legionella_compliance","name":"Legionella Compliance Agent","role":"Legionella regulatory compliance review","mandate":"Reviews the risk assessment, scheme of control, monitoring logs, temperature records, corrective actions, and water contractor performance against ACOP L8, HSG274, HTM 04-01 for healthcare, and local legislation, scores compliance, raises non-conformances, and drafts the management review report.","limits":["Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap","Assigns work to roles such as responsible person or competent person, never to named people","Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them"],"riskClassification":"Limited risk. Compares records with published requirements for the responsible person to review."},{"key":"water_quality","name":"Water Quality Intelligence Agent","role":"Drinking, process, and environmental water quality","mandate":"Assesses drinking water (potability, chemical and microbiological parameters), process water (cooling and industrial systems), animal habitat water, and environmental water (lakes, ponds, wetlands, and conservation areas) against the Water Supply (Water Quality) Regulations, the Drinking Water Directive (EU) 2020/2184, and environmental quality standards, produces a water quality index with predictive warnings, and supplies water consumption, losses, stress, biodiversity, and wastewater metrics to the sustainability suite.","limits":["Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap","Assigns work to roles such as responsible person or competent person, never to named people","Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them"],"riskClassification":"Limited risk. Interprets recorded results; it does not operate or control a water supply, which keeps it outside EU AI Act Annex III point 2."},{"key":"water_asset","name":"Water Asset Agent","role":"Water asset inventory and lifecycle planning","mandate":"Maintains the inventory of tanks, calorifiers, showers, TMVs, cooling towers, pumps, pipework, and water treatment equipment, scores asset criticality, schedules maintenance, forecasts end of life, and plans capital replacement.","limits":["Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap","Assigns work to roles such as responsible person or competent person, never to named people","Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them"],"riskClassification":"Limited risk. Asset planning support; it does not control plant."},{"key":"water_incident","name":"Water Incident Agent","role":"Water incident management","mandate":"Handles positive Legionella results, contamination, water outages, treatment failures, temperature excursions, and suspected disease outbreaks: sets the incident severity, immediate protective controls such as outlet restriction or point-of-use filtration, and the roles to inform (responsible person, management, compliance lead, and emergency response).","limits":["Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap","Assigns work to roles such as responsible person or competent person, never to named people","Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them","A suspected outbreak is always referred to a competent person and the public health authority; it never decides on notification"],"riskClassification":"Limited risk. Incident decision support for the responsible person; it does not operate plant or contact authorities."},{"key":"contractor_assurance","name":"Contractor Assurance Agent","role":"Contractor screening, compliance, and approval","mandate":"Screens a contractor organisation: company verification (registration such as Companies House, VAT, and trading address), insurance cover and expiry, financial stability indicators from supplied accounts or company credit references, experience and references, RAMS quality, training, competency, certifications, licences, industry, country, and client requirements, and contractor obligations, then scores compliance and rates contractor risk.","limits":["Assesses the contractor organisation, never an individual worker's suitability or a sole trader's personal creditworthiness","Has no live register access: a check is marked \"verify at source\" unless the evidence is in the record","Recommends; a named person decides, approves, and closes"],"riskClassification":"Limited risk. Supplier due diligence on organisations for a human decision; it does not assess natural persons for recruitment or creditworthiness, which keeps it outside EU AI Act Annex III points 4(a) and 5(b)."},{"key":"sector_requirements","name":"Sector Requirements Agent","role":"Sector-specific requirement mapping","mandate":"Applies the sector rulebook to the work in scope: construction (CDM 2015, building safety, SSIP and PAS 91 prequalification), mining (ISO 19434 and national mining legislation), healthcare (CQC fundamental standards and clinical controls), utilities (NERS, WIRS, and street works), and aviation, oil and gas, and other sectors, plus client-specific requirements.","limits":["Does not give legal advice; every requirement must be verified against the official text by a competent person","States its confidence and marks anything it cannot source"],"riskClassification":"Limited risk. Retrieval and summarisation of published requirements for human review."},{"key":"verification","name":"Verification Agent","role":"Independent evidence verification","mandate":"Cross-checks every upstream finding against the evidence in the source record, flags claims that are unsupported, expired, inconsistent, or contradictory, sets the final score and rating that the evidence supports, and lists the checks a person must make at source before approval.","limits":["Cannot verify a document it has not been given","Never raises a score or lowers a risk rating without evidence","Recommends; a named person decides, approves, and closes"],"riskClassification":"Limited risk. Consistency checking of organisational evidence for human decision."},{"key":"process_register","name":"Process Register Agent","role":"Process register generation","mandate":"Turns a process name such as \"Waste Management\" into a sector-specific process register entry for construction, manufacturing, healthcare, aviation, mining, utilities, or the organisation's own sector: process map, inputs, outputs, risks, controls, legal obligations, responsible roles, and KPIs.","limits":["Refers to roles only and never names, blames, scores, or profiles individual workers","Legal obligations are passed to the legislation agent for confirmation"],"riskClassification":"Limited risk. Drafts process documentation for the process owner to approve."},{"key":"workflow_monitor","name":"Workflow Monitoring Agent","role":"Virtual project manager for actions, findings, reviews, and CAPAs","mandate":"Reviews the open actions, findings, reviews, audits, CAPAs, and risk actions in the workspace, identifies what is due soon, overdue, or stalled, drafts reminders and escalation notes addressed to owner and manager roles, reports trends and performance by module, and suggests corrective measures for slipping work.","limits":["Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people","Drafts reminders; it never sends messages, reassigns work, or changes due dates"],"riskClassification":"Limited risk. Monitors records and workflows rather than people, which keeps it outside EU AI Act Annex III point 4(b)."},{"key":"audit_planning","name":"Audit Planning Agent","role":"Risk-based audit programme and plans","mandate":"Builds the audit programme, audit plans, and auditor questions from the organisation's industry, risk profile, regulations, and standards (for example ISO 9001, 14001, 45001, 27001, and sector schemes), weighting frequency by risk and past findings.","limits":["Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Planning support for the lead auditor."},{"key":"audit_execution","name":"Audit Execution Agent","role":"Interviews, sampling, checklists, and evidence review","mandate":"Prepares interview questions by role, sampling plans, and checklists with evidence expectations from sector-specific libraries, and reviews any evidence supplied in the record against the audit criteria.","limits":["Interview questions probe systems and processes, never an individual's performance","Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Audit preparation; the auditor conducts and concludes the audit."},{"key":"findings_intelligence","name":"Findings Intelligence Agent","role":"Non-conformity, repeat finding, and trend analysis","mandate":"Analyses non-conformities, repeated findings, trends, and hotspots across audits, inspections, incidents, and actions to identify systemic root causes, common failures, and emerging risks.","limits":["Refers to roles only and never names, blames, scores, or profiles individual workers","Hotspots are processes, sites, or modules, never individuals"],"riskClassification":"Limited risk. Systemic analysis of organisational records, outside EU AI Act Annex III point 4."},{"key":"legal_guidance","name":"Legal Guidance Agent","role":"Finding-by-finding legal and policy review","mandate":"Reviews each finding against legislation, standards, and corporate policies and assigns a legal impact rating and a compliance rating, with the provision each finding engages.","limits":["Does not give legal advice; every requirement must be verified against the official text by a competent person"],"riskClassification":"Limited risk. Information retrieval and rating support reviewed by a competent person."},{"key":"inspection","name":"Intelligent Inspection Agent","role":"Dynamic inspections from sector libraries","mandate":"Generates dynamic inspection questions from sector libraries (construction, oil and gas, mining, utilities, aviation, hospitality, healthcare, education, warehousing, agriculture, and conservation), reviews the evidence and image descriptions supplied, matches each observation to the regulatory requirement it engages, and grades findings by severity.","limits":["Reviews images only through the descriptions and captions recorded with them, and never identifies people in images","Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Inspection support on premises, plant, and conditions; it does not use biometric identification."},{"key":"kpi_intelligence","name":"KPI Intelligence Agent","role":"KPI deterioration, prediction, and intervention","mandate":"Monitors TRIR, LTIFR, near-miss reporting, audit scores, environmental KPIs, and service KPIs from workspace data, identifies deterioration (for example audit compliance falling from 93% to 78%), projects the trend, finds contributing causes, recommends interventions, and escalates concerns.","limits":["Calculates rates only from data supplied and states the formula and any missing denominator such as hours worked","Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people"],"riskClassification":"Limited risk. Organisation-level performance analytics, outside EU AI Act Annex III point 4."},{"key":"risk_register","name":"Risk Register Agent","role":"Continuous risk register upkeep","mandate":"Scans audits, inspections, incidents, findings, actions, documents, and legal updates in the workspace and proposes new risks and updates to existing register entries, each with its source evidence.","limits":["Proposes; the register only changes when a named person signs off","Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Register maintenance support for the risk owner."},{"key":"risk_discovery","name":"Risk Discovery Agent","role":"Emerging and horizon risk identification","mandate":"Identifies emerging, operational, compliance, reputational, and strategic risks from the workspace, the sector context, and the regulatory watch feed.","limits":["Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Horizon scanning for human review."},{"key":"risk_quantification","name":"Risk Quantification Agent","role":"Likelihood, severity, exposure, and cost","mandate":"Rates likelihood and severity on the 5×5 matrix, estimates exposure, cost impact, and ESG impact, and produces inherent and residual risk with the controls credited.","limits":["Cost figures are ranges with stated assumptions, never point estimates presented as fact","Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Quantification of organisational risk, not of people."},{"key":"compliance_impact","name":"Compliance Impact Agent","role":"Legal, regulatory, and financial consequences","mandate":"Assesses the legal consequences, regulatory effects (enforcement, licence conditions, notification duties), and financial impact (fines, sentencing guideline bands, remediation cost) of risks, findings, or failures.","limits":["Does not give legal advice; every requirement must be verified against the official text by a competent person"],"riskClassification":"Limited risk. Information and rating support reviewed by a competent person."},{"key":"treatment","name":"Risk Treatment Agent","role":"Mitigations, action plans, and controls","mandate":"Sets the treatment for each risk (treat, tolerate, transfer, or terminate) and creates mitigations, controls by hierarchy of control, and an action plan with owner roles, deadlines, and the residual risk target.","limits":["Recommends; a named person decides, approves, and closes","Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Proposals that the risk owner accepts or rejects."},{"key":"sustainability_governance","name":"Sustainability Governance Agent","role":"Sustainability policy, ESG strategy, and governance","mandate":"Drafts the sustainability policy, ESG strategy, and governance framework: board oversight, management roles, targets, incentives, and controls over sustainability data, aligned to ESRS 2 and ISSB IFRS S1 governance disclosures.","limits":["Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Drafting support approved by management."},{"key":"carbon","name":"Carbon Agent","role":"GHG boundaries and Scope 1, 2, and 3 inventory","mandate":"Sets organisational and operational GHG boundaries under the GHG Protocol and builds the Scope 1, Scope 2 (location and market based), and Scope 3 inventory by category from the activity data supplied, with the emission factor source for each line.","limits":["Never invents activity data; every emission factor states its source (for example DESNZ conversion factors) and gaps are listed","Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Calculation support; figures are verified before disclosure."},{"key":"environmental_impact","name":"Environmental Impact Agent","role":"Materiality and impact registers","mandate":"Runs the double materiality assessment (ESRS 1) and drafts the environmental aspects and impacts register and the social impact register, including water and biodiversity impacts supplied by the water quality suite.","limits":["Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Assessment support approved by management."},{"key":"climate_transition","name":"Climate Transition Agent","role":"Net zero and carbon reduction planning","mandate":"Builds the net zero plan and carbon reduction plan from the inventory: science-based targets, abatement levers by scope, milestones, capital needs, and the UK PPN 06/21 carbon reduction plan format where public contracts apply.","limits":["Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Planning support approved by management."},{"key":"climate_resilience","name":"Climate Resilience Agent","role":"Climate risk and adaptation","mandate":"Assesses physical and transition climate risks under at least two scenarios, the adaptation measures needed, and the resilience of sites, assets, and supply chains, following TCFD and IFRS S2.","limits":["Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Assessment support approved by management."},{"key":"sustainability_reporting","name":"Sustainability Reporting Agent","role":"CSRD, TCFD, and ISSB reporting","mandate":"Compiles every upstream sustainability output into a disclosure-ready report mapped to CSRD (ESRS), TCFD, and ISSB IFRS S1 and S2, with the ESG dashboard metrics and the assurance readiness of each data point.","limits":["A report is never issued until a named human approves it","Must not disclose a figure that no upstream agent or the source record supports"],"riskClassification":"Limited risk. Generated content is labelled as AI-assisted under EU AI Act Article 50 and requires human sign-off."},{"key":"emergency_response","name":"Emergency Response Agent","role":"Internal emergency response support","mandate":"Receives an incident, alarm, or hazard record and determines its severity, location, and the resources required, and routes it to the response roles in the organisation's own emergency plan.","limits":["Where life may be at risk its first instruction is always to call the emergency services (999 or 112)","Never evaluates emergency calls or dispatches or prioritises emergency services","Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Supports an organisation's internal emergency plan; it does not evaluate emergency calls or dispatch emergency first response services, which keeps it outside EU AI Act Annex III point 5(d)."},{"key":"notification","name":"Notification Agent","role":"Draft alerts for every channel","mandate":"Drafts the alerts for SMS, Microsoft Teams, WhatsApp, email, and app notifications to the roles in the emergency plan, with timing and a sitrep-ready summary.","limits":["Drafts only: it never sends a message; a person sends from the organisation's own channels","Is never given personal contact details","Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Drafting support; generated content is labelled as AI-assisted under EU AI Act Article 50."},{"key":"crisis_management","name":"Crisis Management Agent","role":"Gold, Silver, and Bronze command support","mandate":"Supports Gold (strategic), Silver (tactical), and Bronze (operational) command with a live situation report in METHANE and JESIP form, the decisions each level must take, a decision log, and the next briefing agenda.","limits":["Command decisions are taken by the people in the command roles","Refers to roles only and never names, blames, scores, or profiles individual workers"],"riskClassification":"Limited risk. Command support for an organisation's internal crisis team."},{"key":"people_command","name":"People Command Agent","role":"Competence, health, training, wellbeing, and culture","mandate":"Reads the People domain (training and competency, contractor assurance, occupational health, and people records) and reports the assurance position for competence, health, training, wellbeing, occupational health, and safety culture.","limits":["Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people","Refers to roles only and never names, blames, scores, or profiles individual workers","Reports only what the workspace data supports and states data gaps rather than filling them","Health information is reported only in aggregate (UK GDPR and GDPR Article 9)"],"riskClassification":"Limited risk. Aggregated assurance reporting for management review; it does not monitor or evaluate workers, which keeps it outside EU AI Act Annex III point 4."},{"key":"operations_command","name":"Operations Command Agent","role":"Process assurance, service delivery, and quality","mandate":"Reads the Operations domain (process register, tasks, audits, inspections, and objectives) and reports process assurance, service delivery, operational performance, and quality assurance.","limits":["Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people","Refers to roles only and never names, blames, scores, or profiles individual workers","Reports only what the workspace data supports and states data gaps rather than filling them"],"riskClassification":"Limited risk. Aggregated assurance reporting for management review; it does not monitor or evaluate workers, which keeps it outside EU AI Act Annex III point 4."},{"key":"risk_compliance_command","name":"Risk & Compliance Command Agent","role":"Legislation, standards, compliance, and governance","mandate":"Reads the Risk & Compliance domain (risk register, cyber, compliance obligations, and fire risk) together with the regulatory watch feed, and reports the organisation's legal, standards, compliance, and risk governance position. It is the principal assurance view the board relies on.","limits":["Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people","Refers to roles only and never names, blames, scores, or profiles individual workers","Reports only what the workspace data supports and states data gaps rather than filling them","Does not give legal advice; every requirement must be verified against the official text by a competent person"],"riskClassification":"Limited risk. Aggregated assurance reporting for management review; it does not monitor or evaluate workers, which keeps it outside EU AI Act Annex III point 4."},{"key":"events_command","name":"Events & Improvement Command Agent","role":"Incidents, near misses, CAPA, and lessons learned","mandate":"Reads the Events & Improvement domain (incidents, corrective actions, and events safety) and reports incident and near-miss trends, CAPA effectiveness, lessons learned, and continuous improvement.","limits":["Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people","Refers to roles only and never names, blames, scores, or profiles individual workers","Reports only what the workspace data supports and states data gaps rather than filling them"],"riskClassification":"Limited risk. Aggregated assurance reporting for management review; it does not monitor or evaluate workers, which keeps it outside EU AI Act Annex III point 4."},{"key":"assets_command","name":"Assets & Controls Command Agent","role":"Asset management, maintenance, integrity, and control effectiveness","mandate":"Reads the Assets & Controls domain and reports asset management, maintenance, integrity, and the effectiveness of critical controls.","limits":["Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people","Refers to roles only and never names, blames, scores, or profiles individual workers","Reports only what the workspace data supports and states data gaps rather than filling them"],"riskClassification":"Limited risk. Aggregated assurance reporting for management review; it does not monitor or evaluate workers, which keeps it outside EU AI Act Annex III point 4."},{"key":"resilience_command","name":"Resilience Command Agent","role":"Chief resilience officer support","mandate":"Receives the People, Operations, Risk & Compliance, Assets, Sustainability, Emergency, and Water domain positions and produces the business continuity position (ISO 22301), an organisational resilience score with its method (ISO 22316), and a recovery capability assessment.","limits":["Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people","Refers to roles only and never names, blames, scores, or profiles individual workers","Reports only what the workspace data supports and states data gaps rather than filling them"],"riskClassification":"Limited risk. Aggregated assurance reporting for management review; it does not monitor or evaluate workers, which keeps it outside EU AI Act Annex III point 4."},{"key":"governance_command","name":"Governance & Board Intelligence Agent","role":"Board papers, assurance statements, and maturity","mandate":"Receives every domain position and compiles the governance report, the assurance statement, board papers with the decisions the board must take, an improvement roadmap, and an organisational maturity assessment.","limits":["Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people","Refers to roles only and never names, blames, scores, or profiles individual workers","Reports only what the workspace data supports and states data gaps rather than filling them","A board paper is never issued until a named human approves it"],"riskClassification":"Limited risk. Generated content is labelled as AI-assisted under EU AI Act Article 50 and requires human sign-off."}],"workflows":[{"type":"incident_investigation","label":"Incident investigation","description":"From incident report to signed-off investigation report: root cause, legal duties, controls, and corrective actions.","stages":[{"stage":"investigation","agent":"investigator","label":"Root cause analysis & investigation"},{"stage":"regulatory","agent":"legislation","label":"Legal duties & notification check"},{"stage":"mitigation","agent":"mitigation","label":"Mitigation survey & controls"},{"stage":"report","agent":"reporter","label":"Investigation report"}]},{"type":"module_escalation","label":"Module escalation","description":"Any record or signal from any module: triage and routing, legal duties, controls, and a signed-off escalation report with corrective actions and follow-up audits.","stages":[{"stage":"escalation","agent":"triage","label":"Escalation triage & routing"},{"stage":"regulatory","agent":"legislation","label":"Legal duties & notification check"},{"stage":"mitigation","agent":"mitigation","label":"Controls & corrective actions"},{"stage":"report","agent":"reporter","label":"Escalation report for sign-off"}]},{"type":"compliance_project","label":"Compliance project","description":"Scope a project or operation and receive its legal register, risk controls, and the complete compliance document set.","stages":[{"stage":"regulatory","agent":"legislation","label":"Applicable legal register"},{"stage":"mitigation","agent":"mitigation","label":"Risk & control requirements"},{"stage":"documentation","agent":"documentation","label":"Compliance documentation set"},{"stage":"report","agent":"reporter","label":"Compliance pack report"}]},{"type":"legislation_brief","label":"Legislation brief","description":"Ask the legislation agent for current requirements, updates, and guidance on any topic, sector, and jurisdiction.","stages":[{"stage":"regulatory","agent":"legislation","label":"Regulatory research"},{"stage":"report","agent":"reporter","label":"Compliance guidance brief"}]},{"type":"water_hygiene","label":"Water hygiene","description":"One agent per stage of Legionella control: risk assessment, written scheme, monitoring, sampling, corrective action, and the logbook and report for sign-off.","stages":[{"stage":"risk_assessment","agent":"legionella_risk","label":"Legionella risk assessment"},{"stage":"scheme_of_control","agent":"scheme_of_control","label":"Written scheme of control"},{"stage":"monitoring","agent":"temperature_tmv","label":"Temperature, TMV, flushing & parameter monitoring"},{"stage":"sampling","agent":"water_sampling","label":"Sampling & water quality"},{"stage":"remedial_works","agent":"remedial_works","label":"Corrective actions & remedial works"},{"stage":"report","agent":"water_logbook","label":"Logbook & water hygiene report"}]},{"type":"water_safety_plan","label":"Water safety plan","description":"Build or review the water safety plan: system map and asset register, dynamic water risk assessment, Legionella compliance, and water quality, compiled for the responsible person to approve.","stages":[{"stage":"water_safety_plan","agent":"water_safety_plan","label":"Water safety plan & system map"},{"stage":"water_assets","agent":"water_asset","label":"Water asset register & criticality"},{"stage":"risk_assessment","agent":"legionella_risk","label":"Dynamic water risk assessment"},{"stage":"compliance","agent":"legionella_compliance","label":"Legionella compliance review"},{"stage":"water_quality","agent":"water_quality","label":"Water quality intelligence"},{"stage":"report","agent":"reporter","label":"Water safety plan for sign-off"}]},{"type":"water_incident","label":"Water incident","description":"Positive Legionella, contamination, outages, treatment failures, and temperature excursions: protective controls, sampling, corrective actions, and a compliance check, with the actions tracked as WTR records.","stages":[{"stage":"incident","agent":"water_incident","label":"Water incident assessment"},{"stage":"sampling","agent":"water_sampling","label":"Sampling & result interpretation"},{"stage":"remedial_works","agent":"remedial_works","label":"Corrective actions & remedial works"},{"stage":"compliance","agent":"legionella_compliance","label":"Legionella compliance check"},{"stage":"report","agent":"water_logbook","label":"Logbook & incident report"}]},{"type":"contractor_onboarding","label":"Contractor onboarding","description":"A contractor is onboarded and the Master Assurance Orchestrator runs screening, legal compliance, sector requirements, risk assessment, and verification, ending in a contractor approval report with a compliance score and risk rating.","stages":[{"stage":"screening","agent":"contractor_assurance","label":"Screening, verification & compliance"},{"stage":"regulatory","agent":"legislation","label":"Legal compliance"},{"stage":"sector","agent":"sector_requirements","label":"Sector requirements"},{"stage":"risk","agent":"risk_quantification","label":"Contractor risk assessment"},{"stage":"verification","agent":"verification","label":"Evidence verification"},{"stage":"report","agent":"reporter","label":"Contractor approval report"}]},{"type":"process_register","label":"Process register","description":"Name a process, for example \"Waste Management\", and receive its process map, inputs, outputs, risks, controls, legal obligations, responsible roles, and KPIs, checked by the legal and compliance agents.","stages":[{"stage":"process","agent":"process_register","label":"Process register entry"},{"stage":"regulatory","agent":"legislation","label":"Legal obligations"},{"stage":"compliance","agent":"compliance_impact","label":"Compliance impact"},{"stage":"report","agent":"reporter","label":"Process register for approval"}]},{"type":"workflow_monitoring","label":"Workflow monitoring","description":"A virtual project manager across actions, findings, reviews, audits, CAPAs, and risk actions: what is due, overdue, or stalled, reminder drafts by role, trends, and corrective measures.","stages":[{"stage":"monitoring","agent":"workflow_monitor","label":"Action & CAPA monitoring"},{"stage":"mitigation","agent":"mitigation","label":"Corrective measures"},{"stage":"report","agent":"reporter","label":"Workflow performance report"}]},{"type":"audit_programme","label":"Audit programme","description":"A risk-based audit programme, audit plans, auditor and interview questions, sampling plans, and checklists from the industry, risk profile, regulations, and standards.","stages":[{"stage":"planning","agent":"audit_planning","label":"Audit programme & plans"},{"stage":"execution","agent":"audit_execution","label":"Questions, sampling & checklists"},{"stage":"regulatory","agent":"legislation","label":"Audit criteria & legal register"},{"stage":"report","agent":"reporter","label":"Audit programme for approval"}]},{"type":"audit_findings","label":"Audit findings","description":"Non-conformities and repeat findings analysed for root causes and hotspots, rated for legal impact and compliance, given controls by hierarchy of control, and compiled into the audit report with tracked corrective actions.","stages":[{"stage":"findings","agent":"findings_intelligence","label":"Findings intelligence"},{"stage":"legal","agent":"legal_guidance","label":"Legal impact & compliance rating"},{"stage":"mitigation","agent":"mitigation","label":"Controls & mitigation"},{"stage":"report","agent":"reporter","label":"Audit, executive & board report"}]},{"type":"inspection","label":"Intelligent inspection","description":"Dynamic questions from sector libraries, evidence and image review, and regulatory matching, then risk quantification, compliance rating, and mitigation, ending in an inspection report and action plan.","stages":[{"stage":"inspection","agent":"inspection","label":"Intelligent inspection"},{"stage":"risk","agent":"risk_quantification","label":"Risk quantification"},{"stage":"legal","agent":"legal_guidance","label":"Compliance rating"},{"stage":"mitigation","agent":"mitigation","label":"Mitigation"},{"stage":"report","agent":"reporter","label":"Inspection report & action plan"}]},{"type":"kpi_intelligence","label":"KPI intelligence","description":"TRIR, LTIFR, near misses, audit scores, and environmental and service KPIs: deterioration detected, trends projected, contributing causes found, and interventions recommended.","stages":[{"stage":"kpi","agent":"kpi_intelligence","label":"KPI intelligence"},{"stage":"findings","agent":"findings_intelligence","label":"Contributing causes"},{"stage":"mitigation","agent":"mitigation","label":"Interventions"},{"stage":"report","agent":"reporter","label":"Performance intelligence report"}]},{"type":"risk_intelligence","label":"Risk intelligence","description":"Scans audits, inspections, incidents, findings, actions, documents, and legal updates; discovers and quantifies risks, assesses compliance impact, and plans treatment. Signed-off new risks are added to the risk register.","stages":[{"stage":"register","agent":"risk_register","label":"Risk register scan"},{"stage":"discovery","agent":"risk_discovery","label":"Risk discovery"},{"stage":"quantification","agent":"risk_quantification","label":"Risk quantification"},{"stage":"compliance","agent":"compliance_impact","label":"Compliance impact"},{"stage":"treatment","agent":"treatment","label":"Treatment plan"},{"stage":"report","agent":"reporter","label":"Risk intelligence report"}]},{"type":"sustainability","label":"Sustainability suite","description":"Governance, GHG inventory, materiality, net zero transition, climate resilience, and a CSRD, TCFD, and ISSB-mapped sustainability report.","stages":[{"stage":"governance","agent":"sustainability_governance","label":"Sustainability governance"},{"stage":"carbon","agent":"carbon","label":"GHG inventory"},{"stage":"materiality","agent":"environmental_impact","label":"Materiality & impact registers"},{"stage":"transition","agent":"climate_transition","label":"Net zero & carbon reduction"},{"stage":"resilience","agent":"climate_resilience","label":"Climate resilience"},{"stage":"report","agent":"sustainability_reporting","label":"Sustainability report"}]},{"type":"emergency_response","label":"Emergency response","description":"An incident, alarm, or hazard: severity, location, resources, and routing; a Gold, Silver, and Bronze situation report; and draft alerts for every channel. People send the alerts.","stages":[{"stage":"response","agent":"emergency_response","label":"Severity, resources & routing"},{"stage":"crisis","agent":"crisis_management","label":"Gold, Silver & Bronze situation report"},{"stage":"report","agent":"notification","label":"Draft notifications & sitrep"}]},{"type":"resilience_assessment","label":"Resilience assessment","description":"The People, Operations, Assets, and Risk & Compliance command agents report their domains to the Resilience Command Agent for business continuity, a resilience score, and recovery capability.","stages":[{"stage":"people","agent":"people_command","label":"People domain"},{"stage":"operations","agent":"operations_command","label":"Operations domain"},{"stage":"assets","agent":"assets_command","label":"Assets & Controls domain"},{"stage":"risk_compliance","agent":"risk_compliance_command","label":"Risk & Compliance domain"},{"stage":"resilience","agent":"resilience_command","label":"Resilience position"},{"stage":"report","agent":"reporter","label":"Business continuity & resilience report"}]},{"type":"board_report","label":"Board report","description":"Every domain command agent reports its position; the resilience agent consolidates it and the Board Intelligence Agent compiles the board paper, assurance statement, improvement roadmap, and maturity assessment.","stages":[{"stage":"people","agent":"people_command","label":"People domain"},{"stage":"operations","agent":"operations_command","label":"Operations domain"},{"stage":"risk_compliance","agent":"risk_compliance_command","label":"Risk & Compliance domain"},{"stage":"events","agent":"events_command","label":"Events & Improvement domain"},{"stage":"assets","agent":"assets_command","label":"Assets & Controls domain"},{"stage":"resilience","agent":"resilience_command","label":"Resilience position"},{"stage":"report","agent":"governance_command","label":"Board paper & assurance statement"}]}],"inferenceSubprocessors":[{"provider":"Anthropic","purpose":"Large language model inference","transferSafeguard":"Standard contractual clauses / EU–US Data Privacy Framework"},{"provider":"OpenAI","purpose":"Large language model inference (failover)","transferSafeguard":"Standard contractual clauses / EU–US Data Privacy Framework"},{"provider":"Google (Gemini)","purpose":"Large language model inference (failover)","transferSafeguard":"Standard contractual clauses / EU–US Data Privacy Framework"},{"provider":"Self-hosted model endpoint","purpose":"Optional in-tenancy or EU-sovereign inference","transferSafeguard":"No third-country transfer when hosted in the EU"},{"provider":"Netlify AI Gateway","purpose":"Inference routing and credential management","transferSafeguard":"Standard contractual clauses"}]},"regulatoryPosture":[{"key":"ai-act","instrument":"EU Artificial Intelligence Act","citation":"Regulation (EU) 2024/1689","applicability":"Applies. Plexum360 provides an AI system on the EU market. Prohibited practices and AI literacy duties apply from 2 February 2025; transparency duties under Article 50 from 2 August 2026. Each agent is classified as limited risk: none is intended to evaluate, monitor, or allocate tasks to individual workers (Annex III point 4), and none is a safety component of a product.","platformMeasures":["Public AI system register listing every agent, its intended purpose, limits, and risk classification (Article 13 information, Annex VIII Section B data prepared for EU database registration should a future use be classified under Annex III).","Every AI-generated report is labelled as AI-assisted in readable and machine-readable form (Article 50(2)).","Users are told before they start a workflow that they are handing work to AI agents (Article 50(1)).","Structural human oversight: a manager approves or sends back each hand-off, and no report is issued without a named human approver (Article 14, adopted voluntarily).","Automatic escalation is rule-based, not model-based: deterministic rules decide what escalates and at which tier, agents only draft, and executive-tier reports can only be issued by an administrator or the chief system director (Article 14).","Automatic logs of every stage: provider, model, input digest, output, timestamps, and reviewer (Article 12, adopted voluntarily).","No prohibited practices: no emotion recognition, social scoring, biometric categorisation, or manipulation (Article 5).","Agents are instructed not to name, blame, score, or profile individual workers, which keeps them outside the employment high-risk category.","The Master Assurance Orchestrator, which decides which specialist agents run and in what order, is deterministic code rather than a model; agents never call each other (Articles 12 and 14).","Workflow monitoring, KPI intelligence, and the domain command agents work at record, module, site, and organisation level only, never on individual performance (Annex III point 4(b)).","The contractor assurance agents assess contractor organisations, not natural persons, and never assess a sole trader's personal creditworthiness (Annex III points 4(a) and 5(b)).","The emergency agents support an organisation's internal emergency plan only: they do not evaluate emergency calls or dispatch emergency services, and the notification agent drafts alerts that a person sends (Annex III point 5(d)).","Multi-provider inference with documented failover, so no single model vendor is a point of failure."],"subscriberDuties":["Ensure staff who use the agent group have sufficient AI literacy (Article 4).","Use the agents only for their stated purpose; using outputs to evaluate or discipline individual workers would change the risk classification and must not be done without a fresh assessment.","Keep a competent person in the review role and verify legal requirements against official texts."]},{"key":"gdpr","instrument":"General Data Protection Regulation","citation":"Regulation (EU) 2016/679","applicability":"Applies. The subscriber is controller for workspace data; Plexum Safety & Hygiene Ltd is processor. Incident records can contain health data (Article 9), so special-category safeguards apply.","platformMeasures":["Data minimisation before inference: email addresses and phone numbers are redacted, and record owner and author names are withheld from agents (Articles 5(1)(c) and 25).","No solely automated decisions with legal or similarly significant effects: every agent output is reviewed by a human before it becomes record (Article 22).","Tenant isolation on every query, encrypted object storage, and full activity audit trail (Article 32).","Portable exports in JSON and CSV support access and portability requests (Articles 15 and 20).","Inference sub-processors are listed in the AI system register (Article 28(2))."],"subscriberDuties":["Identify a lawful basis for processing incident and health data, and an Article 9(2) condition for health data.","Run a DPIA where investigations involve health data at scale (Article 35).","Inform workers that incident data may be processed with AI assistance."]},{"key":"nis2","instrument":"NIS2 Directive","citation":"Directive (EU) 2022/2555","applicability":"Applies to subscribers that are essential or important entities. Plexum360 is part of their supply chain (Article 21(2)(d)).","platformMeasures":["Continuous health probes, an incident register, and payment-security event review support supplier assurance.","The legislation agent flags the 24-hour early warning, 72-hour notification, and one-month final report duties when an incident may be significant (Article 23)."],"subscriberDuties":["Assess Plexum360 as an ICT supplier in your NIS2 risk-management measures.","Make the national CSIRT or competent-authority notifications yourself."]},{"key":"data-act","instrument":"EU Data Act","citation":"Regulation (EU) 2023/2854","applicability":"Applies from 12 September 2025. Plexum360 is a data processing service, so the cloud-switching chapter applies.","platformMeasures":["Exports in open formats (JSON, CSV, original document bytes) and a portable PostgreSQL schema with SQL migrations (Articles 23 to 31).","Every capability can be moved to another provider by configuration; exit paths are published by the architecture endpoint."],"subscriberDuties":["Give notice of switching under your subscription terms."]},{"key":"accessibility","instrument":"European Accessibility Act","citation":"Directive (EU) 2019/882","applicability":"Applies from 28 June 2025 to the consumer e-commerce parts of the platform, such as individual academy course purchases.","platformMeasures":["Semantic HTML forms, keyboard-reachable controls, and labelled inputs, targeting WCAG 2.1 AA (EN 301 549)."],"subscriberDuties":[]},{"key":"dsa","instrument":"Digital Services Act","citation":"Regulation (EU) 2022/2065","applicability":"Limited. Plexum360 stores content for business subscribers but does not disseminate it to the public, so it is a hosting service rather than an online platform. Points of contact and notice-and-action duties apply (Articles 11, 12, and 16).","platformMeasures":["A single point of contact for authorities and users through the workspace \"Contact the Founder\" channel and the discovery request form."],"subscriberDuties":[]},{"key":"cra","instrument":"Cyber Resilience Act","citation":"Regulation (EU) 2024/2847","applicability":"Not directly applicable. Plexum360 is delivered as a hosted service rather than as a product with digital elements; remote processing is covered by NIS2 instead. Reviewed annually.","platformMeasures":["Coordinated vulnerability intake through the founder contact channel."],"subscriberDuties":[]}]}