You know when AI is involved
Every workflow is started knowingly, and every generated report carries an AI-assisted label in readable and machine-readable form.
Plexum360
Trust centre
AI transparency and EU regulatory posture
Plexum360 is operated by Plexum Safety & Hygiene Ltd. This page is the public disclosure for the Plexum360 agent group and explains how the platform meets the EU rules that apply to it, and which duties stay with you as a subscriber. Posture reviewed 1 October 2026.
Machine-readable AI system registerA named human signs off
A manager approves or sends back each hand-off between agents. No report is issued and no corrective action is raised until a named person approves the final stage.
Every stage is logged
Provider, model, a SHA-256 digest of the input, the output, timestamps, and the reviewer are recorded against each stage and kept with the workflow.
Personal data stays out
Email addresses and phone numbers are redacted and personal names withheld before anything reaches a model. Agents refer to roles, never to individual workers.
AI system register
The agent group
Limited-risk AI under Regulation (EU) 2024/1689. 49 agents in 9 ecosystems; each has one mandate, a fixed output contract, and stated limits.
Master Assurance Orchestrator — not an AI system
The orchestrator that decides which agents run, in what order, and what they receive is deterministic code with 5 fixed routes. Agents never call each other; each sees only the approved outputs of earlier stages, and a named person signs off every final report. That keeps every hand-off a reviewable, logged step (Articles 12 and 14).
Core agent group
Triage, investigation, legislation, controls, documentation, and reporting. Most chains end with the reporting agent.
Escalation triage and cross-module routing
Escalation & Triage Agent
Receives every signal the escalation engine raises from any workspace module, confirms or raises the escalation tier, maps which other modules and roles are affected, sets out a RACI by role, recommends immediate containment, and states whether an internal audit should follow.
- —Never lowers the tier set by the escalation rules; it can only confirm or raise it
- —Does not close, approve, block payments, or change anyone's access; it recommends and a human decides
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Routing and prioritisation of organisational records for human decision; it does not allocate tasks to or monitor individual workers, which keeps it outside EU AI Act Annex III point 4.
Root cause analysis and investigation
Investigation Agent
Reconstructs the event timeline, separates immediate, underlying, and root causes, runs a five-whys and causal-factor analysis, and lists the evidence still needed to confirm each finding.
- —Does not attribute blame to, score, or profile any individual worker
- —Does not decide whether an event is legally reportable; it flags candidates for the legislation agent and a competent person
Limited risk. Decision support for systemic cause analysis; it is instructed not to evaluate the behaviour or performance of individual workers, which keeps it outside EU AI Act Annex III point 4.
Regulatory intelligence and compliance guidance
Legislation & Compliance Agent
Maps the request to statutes, regulations, harmonised standards, and regulator guidance for every jurisdiction and sector involved, using the platform regulatory watch feed for current developments, and states notification duties and deadlines.
- —Does not give legal advice; every requirement must be verified against the official text by a competent person
- —States its confidence and marks anything it cannot source
Limited risk. Information retrieval and summarisation of public law; outputs are reviewed by a human before use.
Controls survey and mitigation planning
Mitigation & Controls Agent
Surveys the controls that existed, rates their effectiveness, and proposes new controls ordered by the hierarchy of control, each tied to the cause it addresses, the regulation that drives it, and how it will be verified.
- —Recommends; it never closes, approves, or assigns actions to named people — only to roles
Limited risk. Recommendations are proposals that a manager accepts or rejects.
Compliance document compilation
Compliance Documentation Agent
Compiles the full document set a project needs to demonstrate compliance: policies, procedures, registers, plans, permits, licences, forms, and statutory submissions, each with its legal basis, owner role, review cycle, and section outline.
- —Drafts structures and outlines; it does not certify that a document satisfies a regulator
Limited risk. Document structuring and drafting assistance.
Final report compilation
Reporting Agent
Receives every upstream agent output and compiles one coherent, auditable report with an executive summary, findings, regulatory position, action plan, limitations, and the sign-offs required.
- —A report is never issued until a named human approves it
- —Must not introduce findings that no upstream agent or the source record supports
Limited risk. Generated content is labelled as AI-assisted under EU AI Act Article 50 and requires human sign-off.
Core assurance agents
Contractor assurance, sector requirements, independent verification, process registers, and workflow monitoring.
Contractor screening, compliance, and approval
Contractor Assurance Agent
Screens a contractor organisation: company verification (registration such as Companies House, VAT, and trading address), insurance cover and expiry, financial stability indicators from supplied accounts or company credit references, experience and references, RAMS quality, training, competency, certifications, licences, industry, country, and client requirements, and contractor obligations, then scores compliance and rates contractor risk.
- —Assesses the contractor organisation, never an individual worker's suitability or a sole trader's personal creditworthiness
- —Has no live register access: a check is marked "verify at source" unless the evidence is in the record
- —Recommends; a named person decides, approves, and closes
Limited risk. Supplier due diligence on organisations for a human decision; it does not assess natural persons for recruitment or creditworthiness, which keeps it outside EU AI Act Annex III points 4(a) and 5(b).
Sector-specific requirement mapping
Sector Requirements Agent
Applies the sector rulebook to the work in scope: construction (CDM 2015, building safety, SSIP and PAS 91 prequalification), mining (ISO 19434 and national mining legislation), healthcare (CQC fundamental standards and clinical controls), utilities (NERS, WIRS, and street works), and aviation, oil and gas, and other sectors, plus client-specific requirements.
- —Does not give legal advice; every requirement must be verified against the official text by a competent person
- —States its confidence and marks anything it cannot source
Limited risk. Retrieval and summarisation of published requirements for human review.
Independent evidence verification
Verification Agent
Cross-checks every upstream finding against the evidence in the source record, flags claims that are unsupported, expired, inconsistent, or contradictory, sets the final score and rating that the evidence supports, and lists the checks a person must make at source before approval.
- —Cannot verify a document it has not been given
- —Never raises a score or lowers a risk rating without evidence
- —Recommends; a named person decides, approves, and closes
Limited risk. Consistency checking of organisational evidence for human decision.
Process register generation
Process Register Agent
Turns a process name such as "Waste Management" into a sector-specific process register entry for construction, manufacturing, healthcare, aviation, mining, utilities, or the organisation's own sector: process map, inputs, outputs, risks, controls, legal obligations, responsible roles, and KPIs.
- —Refers to roles only and never names, blames, scores, or profiles individual workers
- —Legal obligations are passed to the legislation agent for confirmation
Limited risk. Drafts process documentation for the process owner to approve.
Virtual project manager for actions, findings, reviews, and CAPAs
Workflow Monitoring Agent
Reviews the open actions, findings, reviews, audits, CAPAs, and risk actions in the workspace, identifies what is due soon, overdue, or stalled, drafts reminders and escalation notes addressed to owner and manager roles, reports trends and performance by module, and suggests corrective measures for slipping work.
- —Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people
- —Drafts reminders; it never sends messages, reassigns work, or changes due dates
Limited risk. Monitors records and workflows rather than people, which keeps it outside EU AI Act Annex III point 4(b).
Audit ecosystem
Audit planning, execution, findings intelligence, and legal guidance. Controls come from the mitigation agent and reports from the reporting agent.
Risk-based audit programme and plans
Audit Planning Agent
Builds the audit programme, audit plans, and auditor questions from the organisation's industry, risk profile, regulations, and standards (for example ISO 9001, 14001, 45001, 27001, and sector schemes), weighting frequency by risk and past findings.
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Planning support for the lead auditor.
Interviews, sampling, checklists, and evidence review
Audit Execution Agent
Prepares interview questions by role, sampling plans, and checklists with evidence expectations from sector-specific libraries, and reviews any evidence supplied in the record against the audit criteria.
- —Interview questions probe systems and processes, never an individual's performance
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Audit preparation; the auditor conducts and concludes the audit.
Non-conformity, repeat finding, and trend analysis
Findings Intelligence Agent
Analyses non-conformities, repeated findings, trends, and hotspots across audits, inspections, incidents, and actions to identify systemic root causes, common failures, and emerging risks.
- —Refers to roles only and never names, blames, scores, or profiles individual workers
- —Hotspots are processes, sites, or modules, never individuals
Limited risk. Systemic analysis of organisational records, outside EU AI Act Annex III point 4.
Finding-by-finding legal and policy review
Legal Guidance Agent
Reviews each finding against legislation, standards, and corporate policies and assigns a legal impact rating and a compliance rating, with the provision each finding engages.
- —Does not give legal advice; every requirement must be verified against the official text by a competent person
Limited risk. Information retrieval and rating support reviewed by a competent person.
Inspection & performance
Intelligent inspections from sector libraries and KPI intelligence that spots deterioration before it becomes failure.
Dynamic inspections from sector libraries
Intelligent Inspection Agent
Generates dynamic inspection questions from sector libraries (construction, oil and gas, mining, utilities, aviation, hospitality, healthcare, education, warehousing, agriculture, and conservation), reviews the evidence and image descriptions supplied, matches each observation to the regulatory requirement it engages, and grades findings by severity.
- —Reviews images only through the descriptions and captions recorded with them, and never identifies people in images
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Inspection support on premises, plant, and conditions; it does not use biometric identification.
KPI deterioration, prediction, and intervention
KPI Intelligence Agent
Monitors TRIR, LTIFR, near-miss reporting, audit scores, environmental KPIs, and service KPIs from workspace data, identifies deterioration (for example audit compliance falling from 93% to 78%), projects the trend, finds contributing causes, recommends interventions, and escalates concerns.
- —Calculates rates only from data supplied and states the formula and any missing denominator such as hours worked
- —Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people
Limited risk. Organisation-level performance analytics, outside EU AI Act Annex III point 4.
Risk intelligence ecosystem
Risk register upkeep, risk discovery, quantification, compliance impact, and treatment.
Continuous risk register upkeep
Risk Register Agent
Scans audits, inspections, incidents, findings, actions, documents, and legal updates in the workspace and proposes new risks and updates to existing register entries, each with its source evidence.
- —Proposes; the register only changes when a named person signs off
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Register maintenance support for the risk owner.
Emerging and horizon risk identification
Risk Discovery Agent
Identifies emerging, operational, compliance, reputational, and strategic risks from the workspace, the sector context, and the regulatory watch feed.
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Horizon scanning for human review.
Likelihood, severity, exposure, and cost
Risk Quantification Agent
Rates likelihood and severity on the 5×5 matrix, estimates exposure, cost impact, and ESG impact, and produces inherent and residual risk with the controls credited.
- —Cost figures are ranges with stated assumptions, never point estimates presented as fact
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Quantification of organisational risk, not of people.
Legal, regulatory, and financial consequences
Compliance Impact Agent
Assesses the legal consequences, regulatory effects (enforcement, licence conditions, notification duties), and financial impact (fines, sentencing guideline bands, remediation cost) of risks, findings, or failures.
- —Does not give legal advice; every requirement must be verified against the official text by a competent person
Limited risk. Information and rating support reviewed by a competent person.
Mitigations, action plans, and controls
Risk Treatment Agent
Sets the treatment for each risk (treat, tolerate, transfer, or terminate) and creates mitigations, controls by hierarchy of control, and an action plan with owner roles, deadlines, and the residual risk target.
- —Recommends; a named person decides, approves, and closes
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Proposals that the risk owner accepts or rejects.
Sustainability agent suite
Governance, carbon accounting, materiality, transition planning, climate resilience, and CSRD, TCFD, and ISSB reporting.
Sustainability policy, ESG strategy, and governance
Sustainability Governance Agent
Drafts the sustainability policy, ESG strategy, and governance framework: board oversight, management roles, targets, incentives, and controls over sustainability data, aligned to ESRS 2 and ISSB IFRS S1 governance disclosures.
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Drafting support approved by management.
GHG boundaries and Scope 1, 2, and 3 inventory
Carbon Agent
Sets organisational and operational GHG boundaries under the GHG Protocol and builds the Scope 1, Scope 2 (location and market based), and Scope 3 inventory by category from the activity data supplied, with the emission factor source for each line.
- —Never invents activity data; every emission factor states its source (for example DESNZ conversion factors) and gaps are listed
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Calculation support; figures are verified before disclosure.
Materiality and impact registers
Environmental Impact Agent
Runs the double materiality assessment (ESRS 1) and drafts the environmental aspects and impacts register and the social impact register, including water and biodiversity impacts supplied by the water quality suite.
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Assessment support approved by management.
Net zero and carbon reduction planning
Climate Transition Agent
Builds the net zero plan and carbon reduction plan from the inventory: science-based targets, abatement levers by scope, milestones, capital needs, and the UK PPN 06/21 carbon reduction plan format where public contracts apply.
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Planning support approved by management.
Climate risk and adaptation
Climate Resilience Agent
Assesses physical and transition climate risks under at least two scenarios, the adaptation measures needed, and the resilience of sites, assets, and supply chains, following TCFD and IFRS S2.
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Assessment support approved by management.
CSRD, TCFD, and ISSB reporting
Sustainability Reporting Agent
Compiles every upstream sustainability output into a disclosure-ready report mapped to CSRD (ESRS), TCFD, and ISSB IFRS S1 and S2, with the ESG dashboard metrics and the assurance readiness of each data point.
- —A report is never issued until a named human approves it
- —Must not disclose a figure that no upstream agent or the source record supports
Limited risk. Generated content is labelled as AI-assisted under EU AI Act Article 50 and requires human sign-off.
Emergency management ecosystem
Emergency response support, draft notifications, and Gold, Silver, and Bronze crisis management.
Internal emergency response support
Emergency Response Agent
Receives an incident, alarm, or hazard record and determines its severity, location, and the resources required, and routes it to the response roles in the organisation's own emergency plan.
- —Where life may be at risk its first instruction is always to call the emergency services (999 or 112)
- —Never evaluates emergency calls or dispatches or prioritises emergency services
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Supports an organisation's internal emergency plan; it does not evaluate emergency calls or dispatch emergency first response services, which keeps it outside EU AI Act Annex III point 5(d).
Draft alerts for every channel
Notification Agent
Drafts the alerts for SMS, Microsoft Teams, WhatsApp, email, and app notifications to the roles in the emergency plan, with timing and a sitrep-ready summary.
- —Drafts only: it never sends a message; a person sends from the organisation's own channels
- —Is never given personal contact details
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Drafting support; generated content is labelled as AI-assisted under EU AI Act Article 50.
Gold, Silver, and Bronze command support
Crisis Management Agent
Supports Gold (strategic), Silver (tactical), and Bronze (operational) command with a live situation report in METHANE and JESIP form, the decisions each level must take, a decision log, and the next briefing agenda.
- —Command decisions are taken by the people in the command roles
- —Refers to roles only and never names, blames, scores, or profiles individual workers
Limited risk. Command support for an organisation's internal crisis team.
Water safety & Legionella suite
Water safety planning, risk assessment, schemes of control, monitoring, sampling, water quality, assets, incidents, corrective action, and the logbook.
Dynamic Legionella and water risk assessment
Water Risk Assessment Agent
Assesses every water system in scope (cooling towers, calorifiers, cold water storage tanks, hot water systems, showers, irrigation, animal water systems, ornamental features and fountains, hose reels, and misting systems) for stagnation, aerosol generation, temperature control, scale, corrosion, biofilm, and vulnerable populations, identifies people at risk, lists deadlegs and design defects against HSE ACOP L8 and BS 8580-1, and ranks the systems by priority with an improvement programme.
- —Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap
- —Assigns work to roles such as responsible person or competent person, never to named people
- —Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them
Limited risk. Assessment support for building water systems; it evaluates plant and conditions, not people, and a competent person signs off the assessment.
Written scheme of control
Written Scheme of Control Agent
Turns the approved risk assessment into a written scheme of control: control strategy, task schedule with frequencies and limits, roles and responsibilities, and the action to take when a result is out of limit, following ACOP L8 and HSG274.
- —Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap
- —Assigns work to roles such as responsible person or competent person, never to named people
- —Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them
Limited risk. Drafts a control document that the responsible person approves.
Temperature, TMV, flushing, and water parameter monitoring
Water Monitoring Agent
Reviews monitoring data from IoT sensors, manual checks, laboratory reports, and contractor inspections: hot, cold, calorifier, and TMV mixed temperatures against HSG274 limits, chlorine, pH, turbidity, and conductivity against the treatment programme, TMV servicing and fail-safe status, and flushing coverage of little-used outlets, and raises an action for every threshold breached.
- —Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap
- —Assigns work to roles such as responsible person or competent person, never to named people
- —Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them
Limited risk. Compares recorded readings with published limits for human review.
Sampling plans, laboratory results, and trend analysis
Legionella Sampling Agent
Manages the sampling plan and laboratory schedule, interprets Legionella, TVC, Pseudomonas aeruginosa, E. coli, and coliform results against HSG274 Part 2, BS 7592, and HTM 04-01 where healthcare applies, trends results by outlet, sets resampling and post-remedial sampling, checks UKAS accreditation, and grades each finding by severity for escalation.
- —Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap
- —Assigns work to roles such as responsible person or competent person, never to named people
- —Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them
Limited risk. Interpretation of laboratory results against published action levels; a competent person confirms every conclusion.
Corrective actions and remedial works
Legionella Corrective Action Agent
For every failure upstream, identifies the failure, determines its risk level, and sets the corrective actions (for example flush the outlet, investigate the TMV, review circulation, re-sample, and verify closure), assigned to roles with deadlines, plus interim controls, disinfection where justified (BS 8558 and HSG274), and the checks required after the works. Approved actions become tracked WTR records that escalate if they go overdue.
- —Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap
- —Assigns work to roles such as responsible person or competent person, never to named people
- —Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them
Limited risk. Recommendations that the responsible person accepts or rejects.
Logbook and water hygiene report
Water Hygiene Logbook Agent
Compiles the logbook entries for the period from every approved upstream output and the source record, and writes the water hygiene report for sign-off, supporting the ACOP L8 duty to keep records for at least five years.
- —Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap
- —Assigns work to roles such as responsible person or competent person, never to named people
- —Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them
- —A report is never issued until a named human approves it
Limited risk. Generated content is labelled as AI-assisted under EU AI Act Article 50 and requires human sign-off.
Water safety plan and water management programme
Water Safety Management Agent
Supports the appointed responsible person (water): drafts the water safety plan and water management programme, maps the water systems, identifies water risks, sets the hygiene programme and contractor controls for water systems, and schedules the annual review, following ACOP L8, HSG274, BS 8680, and WHO water safety plan guidance.
- —Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap
- —Assigns work to roles such as responsible person or competent person, never to named people
- —Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them
- —Supports the appointed responsible person; it never acts as the responsible person or the duty holder
Limited risk. Drafts management documents that the responsible person approves; it does not control any water system.
Legionella regulatory compliance review
Legionella Compliance Agent
Reviews the risk assessment, scheme of control, monitoring logs, temperature records, corrective actions, and water contractor performance against ACOP L8, HSG274, HTM 04-01 for healthcare, and local legislation, scores compliance, raises non-conformances, and drafts the management review report.
- —Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap
- —Assigns work to roles such as responsible person or competent person, never to named people
- —Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them
Limited risk. Compares records with published requirements for the responsible person to review.
Drinking, process, and environmental water quality
Water Quality Intelligence Agent
Assesses drinking water (potability, chemical and microbiological parameters), process water (cooling and industrial systems), animal habitat water, and environmental water (lakes, ponds, wetlands, and conservation areas) against the Water Supply (Water Quality) Regulations, the Drinking Water Directive (EU) 2020/2184, and environmental quality standards, produces a water quality index with predictive warnings, and supplies water consumption, losses, stress, biodiversity, and wastewater metrics to the sustainability suite.
- —Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap
- —Assigns work to roles such as responsible person or competent person, never to named people
- —Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them
Limited risk. Interprets recorded results; it does not operate or control a water supply, which keeps it outside EU AI Act Annex III point 2.
Water asset inventory and lifecycle planning
Water Asset Agent
Maintains the inventory of tanks, calorifiers, showers, TMVs, cooling towers, pumps, pipework, and water treatment equipment, scores asset criticality, schedules maintenance, forecasts end of life, and plans capital replacement.
- —Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap
- —Assigns work to roles such as responsible person or competent person, never to named people
- —Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them
Limited risk. Asset planning support; it does not control plant.
Water incident management
Water Incident Agent
Handles positive Legionella results, contamination, water outages, treatment failures, temperature excursions, and suspected disease outbreaks: sets the incident severity, immediate protective controls such as outlet restriction or point-of-use filtration, and the roles to inform (responsible person, management, compliance lead, and emergency response).
- —Never invents temperatures, readings, or laboratory results; missing data is stated as an evidence gap
- —Assigns work to roles such as responsible person or competent person, never to named people
- —Flags possible RIDDOR or public health notifications for a competent person to decide; it never decides them
- —A suspected outbreak is always referred to a competent person and the public health authority; it never decides on notification
Limited risk. Incident decision support for the responsible person; it does not operate plant or contact authorities.
Domain command agents
One agent per command domain. They read the whole workspace for their domain and feed resilience and board intelligence.
Competence, health, training, wellbeing, and culture
People Command Agent
Reads the People domain (training and competency, contractor assurance, occupational health, and people records) and reports the assurance position for competence, health, training, wellbeing, occupational health, and safety culture.
- —Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people
- —Refers to roles only and never names, blames, scores, or profiles individual workers
- —Reports only what the workspace data supports and states data gaps rather than filling them
- —Health information is reported only in aggregate (UK GDPR and GDPR Article 9)
Limited risk. Aggregated assurance reporting for management review; it does not monitor or evaluate workers, which keeps it outside EU AI Act Annex III point 4.
Process assurance, service delivery, and quality
Operations Command Agent
Reads the Operations domain (process register, tasks, audits, inspections, and objectives) and reports process assurance, service delivery, operational performance, and quality assurance.
- —Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people
- —Refers to roles only and never names, blames, scores, or profiles individual workers
- —Reports only what the workspace data supports and states data gaps rather than filling them
Limited risk. Aggregated assurance reporting for management review; it does not monitor or evaluate workers, which keeps it outside EU AI Act Annex III point 4.
Legislation, standards, compliance, and governance
Risk & Compliance Command Agent
Reads the Risk & Compliance domain (risk register, cyber, compliance obligations, and fire risk) together with the regulatory watch feed, and reports the organisation's legal, standards, compliance, and risk governance position. It is the principal assurance view the board relies on.
- —Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people
- —Refers to roles only and never names, blames, scores, or profiles individual workers
- —Reports only what the workspace data supports and states data gaps rather than filling them
- —Does not give legal advice; every requirement must be verified against the official text by a competent person
Limited risk. Aggregated assurance reporting for management review; it does not monitor or evaluate workers, which keeps it outside EU AI Act Annex III point 4.
Incidents, near misses, CAPA, and lessons learned
Events & Improvement Command Agent
Reads the Events & Improvement domain (incidents, corrective actions, and events safety) and reports incident and near-miss trends, CAPA effectiveness, lessons learned, and continuous improvement.
- —Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people
- —Refers to roles only and never names, blames, scores, or profiles individual workers
- —Reports only what the workspace data supports and states data gaps rather than filling them
Limited risk. Aggregated assurance reporting for management review; it does not monitor or evaluate workers, which keeps it outside EU AI Act Annex III point 4.
Asset management, maintenance, integrity, and control effectiveness
Assets & Controls Command Agent
Reads the Assets & Controls domain and reports asset management, maintenance, integrity, and the effectiveness of critical controls.
- —Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people
- —Refers to roles only and never names, blames, scores, or profiles individual workers
- —Reports only what the workspace data supports and states data gaps rather than filling them
Limited risk. Aggregated assurance reporting for management review; it does not monitor or evaluate workers, which keeps it outside EU AI Act Annex III point 4.
Chief resilience officer support
Resilience Command Agent
Receives the People, Operations, Risk & Compliance, Assets, Sustainability, Emergency, and Water domain positions and produces the business continuity position (ISO 22301), an organisational resilience score with its method (ISO 22316), and a recovery capability assessment.
- —Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people
- —Refers to roles only and never names, blames, scores, or profiles individual workers
- —Reports only what the workspace data supports and states data gaps rather than filling them
Limited risk. Aggregated assurance reporting for management review; it does not monitor or evaluate workers, which keeps it outside EU AI Act Annex III point 4.
Board papers, assurance statements, and maturity
Governance & Board Intelligence Agent
Receives every domain position and compiles the governance report, the assurance statement, board papers with the decisions the board must take, an improvement roadmap, and an organisational maturity assessment.
- —Works from workspace records at module, site, and organisation level; it never monitors or evaluates individual people
- —Refers to roles only and never names, blames, scores, or profiles individual workers
- —Reports only what the workspace data supports and states data gaps rather than filling them
- —A board paper is never issued until a named human approves it
Limited risk. Generated content is labelled as AI-assisted under EU AI Act Article 50 and requires human sign-off.
Incident investigation
From incident report to signed-off investigation report: root cause, legal duties, controls, and corrective actions.
- 1Root cause analysis & investigation · Investigation Agent
- 2Legal duties & notification check · Legislation & Compliance Agent
- 3Mitigation survey & controls · Mitigation & Controls Agent
- 4Investigation report · Reporting Agent
Module escalation
Any record or signal from any module: triage and routing, legal duties, controls, and a signed-off escalation report with corrective actions and follow-up audits.
- 1Escalation triage & routing · Escalation & Triage Agent
- 2Legal duties & notification check · Legislation & Compliance Agent
- 3Controls & corrective actions · Mitigation & Controls Agent
- 4Escalation report for sign-off · Reporting Agent
Compliance project
Scope a project or operation and receive its legal register, risk controls, and the complete compliance document set.
- 1Applicable legal register · Legislation & Compliance Agent
- 2Risk & control requirements · Mitigation & Controls Agent
- 3Compliance documentation set · Compliance Documentation Agent
- 4Compliance pack report · Reporting Agent
Legislation brief
Ask the legislation agent for current requirements, updates, and guidance on any topic, sector, and jurisdiction.
- 1Regulatory research · Legislation & Compliance Agent
- 2Compliance guidance brief · Reporting Agent
Water hygiene
One agent per stage of Legionella control: risk assessment, written scheme, monitoring, sampling, corrective action, and the logbook and report for sign-off.
- 1Legionella risk assessment · Water Risk Assessment Agent
- 2Written scheme of control · Written Scheme of Control Agent
- 3Temperature, TMV, flushing & parameter monitoring · Water Monitoring Agent
- 4Sampling & water quality · Legionella Sampling Agent
- 5Corrective actions & remedial works · Legionella Corrective Action Agent
- 6Logbook & water hygiene report · Water Hygiene Logbook Agent
Water safety plan
Build or review the water safety plan: system map and asset register, dynamic water risk assessment, Legionella compliance, and water quality, compiled for the responsible person to approve.
- 1Water safety plan & system map · Water Safety Management Agent
- 2Water asset register & criticality · Water Asset Agent
- 3Dynamic water risk assessment · Water Risk Assessment Agent
- 4Legionella compliance review · Legionella Compliance Agent
- 5Water quality intelligence · Water Quality Intelligence Agent
- 6Water safety plan for sign-off · Reporting Agent
Water incident
Positive Legionella, contamination, outages, treatment failures, and temperature excursions: protective controls, sampling, corrective actions, and a compliance check, with the actions tracked as WTR records.
- 1Water incident assessment · Water Incident Agent
- 2Sampling & result interpretation · Legionella Sampling Agent
- 3Corrective actions & remedial works · Legionella Corrective Action Agent
- 4Legionella compliance check · Legionella Compliance Agent
- 5Logbook & incident report · Water Hygiene Logbook Agent
Contractor onboarding
A contractor is onboarded and the Master Assurance Orchestrator runs screening, legal compliance, sector requirements, risk assessment, and verification, ending in a contractor approval report with a compliance score and risk rating.
- 1Screening, verification & compliance · Contractor Assurance Agent
- 2Legal compliance · Legislation & Compliance Agent
- 3Sector requirements · Sector Requirements Agent
- 4Contractor risk assessment · Risk Quantification Agent
- 5Evidence verification · Verification Agent
- 6Contractor approval report · Reporting Agent
Process register
Name a process, for example "Waste Management", and receive its process map, inputs, outputs, risks, controls, legal obligations, responsible roles, and KPIs, checked by the legal and compliance agents.
- 1Process register entry · Process Register Agent
- 2Legal obligations · Legislation & Compliance Agent
- 3Compliance impact · Compliance Impact Agent
- 4Process register for approval · Reporting Agent
Workflow monitoring
A virtual project manager across actions, findings, reviews, audits, CAPAs, and risk actions: what is due, overdue, or stalled, reminder drafts by role, trends, and corrective measures.
- 1Action & CAPA monitoring · Workflow Monitoring Agent
- 2Corrective measures · Mitigation & Controls Agent
- 3Workflow performance report · Reporting Agent
Audit programme
A risk-based audit programme, audit plans, auditor and interview questions, sampling plans, and checklists from the industry, risk profile, regulations, and standards.
- 1Audit programme & plans · Audit Planning Agent
- 2Questions, sampling & checklists · Audit Execution Agent
- 3Audit criteria & legal register · Legislation & Compliance Agent
- 4Audit programme for approval · Reporting Agent
Audit findings
Non-conformities and repeat findings analysed for root causes and hotspots, rated for legal impact and compliance, given controls by hierarchy of control, and compiled into the audit report with tracked corrective actions.
- 1Findings intelligence · Findings Intelligence Agent
- 2Legal impact & compliance rating · Legal Guidance Agent
- 3Controls & mitigation · Mitigation & Controls Agent
- 4Audit, executive & board report · Reporting Agent
Intelligent inspection
Dynamic questions from sector libraries, evidence and image review, and regulatory matching, then risk quantification, compliance rating, and mitigation, ending in an inspection report and action plan.
- 1Intelligent inspection · Intelligent Inspection Agent
- 2Risk quantification · Risk Quantification Agent
- 3Compliance rating · Legal Guidance Agent
- 4Mitigation · Mitigation & Controls Agent
- 5Inspection report & action plan · Reporting Agent
KPI intelligence
TRIR, LTIFR, near misses, audit scores, and environmental and service KPIs: deterioration detected, trends projected, contributing causes found, and interventions recommended.
- 1KPI intelligence · KPI Intelligence Agent
- 2Contributing causes · Findings Intelligence Agent
- 3Interventions · Mitigation & Controls Agent
- 4Performance intelligence report · Reporting Agent
Risk intelligence
Scans audits, inspections, incidents, findings, actions, documents, and legal updates; discovers and quantifies risks, assesses compliance impact, and plans treatment. Signed-off new risks are added to the risk register.
- 1Risk register scan · Risk Register Agent
- 2Risk discovery · Risk Discovery Agent
- 3Risk quantification · Risk Quantification Agent
- 4Compliance impact · Compliance Impact Agent
- 5Treatment plan · Risk Treatment Agent
- 6Risk intelligence report · Reporting Agent
Sustainability suite
Governance, GHG inventory, materiality, net zero transition, climate resilience, and a CSRD, TCFD, and ISSB-mapped sustainability report.
- 1Sustainability governance · Sustainability Governance Agent
- 2GHG inventory · Carbon Agent
- 3Materiality & impact registers · Environmental Impact Agent
- 4Net zero & carbon reduction · Climate Transition Agent
- 5Climate resilience · Climate Resilience Agent
- 6Sustainability report · Sustainability Reporting Agent
Emergency response
An incident, alarm, or hazard: severity, location, resources, and routing; a Gold, Silver, and Bronze situation report; and draft alerts for every channel. People send the alerts.
- 1Severity, resources & routing · Emergency Response Agent
- 2Gold, Silver & Bronze situation report · Crisis Management Agent
- 3Draft notifications & sitrep · Notification Agent
Resilience assessment
The People, Operations, Assets, and Risk & Compliance command agents report their domains to the Resilience Command Agent for business continuity, a resilience score, and recovery capability.
- 1People domain · People Command Agent
- 2Operations domain · Operations Command Agent
- 3Assets & Controls domain · Assets & Controls Command Agent
- 4Risk & Compliance domain · Risk & Compliance Command Agent
- 5Resilience position · Resilience Command Agent
- 6Business continuity & resilience report · Reporting Agent
Board report
Every domain command agent reports its position; the resilience agent consolidates it and the Board Intelligence Agent compiles the board paper, assurance statement, improvement roadmap, and maturity assessment.
- 1People domain · People Command Agent
- 2Operations domain · Operations Command Agent
- 3Risk & Compliance domain · Risk & Compliance Command Agent
- 4Events & Improvement domain · Events & Improvement Command Agent
- 5Assets & Controls domain · Assets & Controls Command Agent
- 6Resilience position · Resilience Command Agent
- 7Board paper & assurance statement · Governance & Board Intelligence Agent
EU regulation
Regulatory posture
What the platform does, and what stays with you. Obligations under most of these instruments are split between provider and user.
EU Artificial Intelligence Act
Regulation (EU) 2024/1689Applies. Plexum360 provides an AI system on the EU market. Prohibited practices and AI literacy duties apply from 2 February 2025; transparency duties under Article 50 from 2 August 2026. Each agent is classified as limited risk: none is intended to evaluate, monitor, or allocate tasks to individual workers (Annex III point 4), and none is a safety component of a product.
Platform measures
- Public AI system register listing every agent, its intended purpose, limits, and risk classification (Article 13 information, Annex VIII Section B data prepared for EU database registration should a future use be classified under Annex III).
- Every AI-generated report is labelled as AI-assisted in readable and machine-readable form (Article 50(2)).
- Users are told before they start a workflow that they are handing work to AI agents (Article 50(1)).
- Structural human oversight: a manager approves or sends back each hand-off, and no report is issued without a named human approver (Article 14, adopted voluntarily).
- Automatic escalation is rule-based, not model-based: deterministic rules decide what escalates and at which tier, agents only draft, and executive-tier reports can only be issued by an administrator or the chief system director (Article 14).
- Automatic logs of every stage: provider, model, input digest, output, timestamps, and reviewer (Article 12, adopted voluntarily).
- No prohibited practices: no emotion recognition, social scoring, biometric categorisation, or manipulation (Article 5).
- Agents are instructed not to name, blame, score, or profile individual workers, which keeps them outside the employment high-risk category.
- The Master Assurance Orchestrator, which decides which specialist agents run and in what order, is deterministic code rather than a model; agents never call each other (Articles 12 and 14).
- Workflow monitoring, KPI intelligence, and the domain command agents work at record, module, site, and organisation level only, never on individual performance (Annex III point 4(b)).
- The contractor assurance agents assess contractor organisations, not natural persons, and never assess a sole trader's personal creditworthiness (Annex III points 4(a) and 5(b)).
- The emergency agents support an organisation's internal emergency plan only: they do not evaluate emergency calls or dispatch emergency services, and the notification agent drafts alerts that a person sends (Annex III point 5(d)).
- Multi-provider inference with documented failover, so no single model vendor is a point of failure.
Your duties as subscriber
- Ensure staff who use the agent group have sufficient AI literacy (Article 4).
- Use the agents only for their stated purpose; using outputs to evaluate or discipline individual workers would change the risk classification and must not be done without a fresh assessment.
- Keep a competent person in the review role and verify legal requirements against official texts.
General Data Protection Regulation
Regulation (EU) 2016/679Applies. The subscriber is controller for workspace data; Plexum Safety & Hygiene Ltd is processor. Incident records can contain health data (Article 9), so special-category safeguards apply.
Platform measures
- Data minimisation before inference: email addresses and phone numbers are redacted, and record owner and author names are withheld from agents (Articles 5(1)(c) and 25).
- No solely automated decisions with legal or similarly significant effects: every agent output is reviewed by a human before it becomes record (Article 22).
- Tenant isolation on every query, encrypted object storage, and full activity audit trail (Article 32).
- Portable exports in JSON and CSV support access and portability requests (Articles 15 and 20).
- Inference sub-processors are listed in the AI system register (Article 28(2)).
Your duties as subscriber
- Identify a lawful basis for processing incident and health data, and an Article 9(2) condition for health data.
- Run a DPIA where investigations involve health data at scale (Article 35).
- Inform workers that incident data may be processed with AI assistance.
NIS2 Directive
Directive (EU) 2022/2555Applies to subscribers that are essential or important entities. Plexum360 is part of their supply chain (Article 21(2)(d)).
Platform measures
- Continuous health probes, an incident register, and payment-security event review support supplier assurance.
- The legislation agent flags the 24-hour early warning, 72-hour notification, and one-month final report duties when an incident may be significant (Article 23).
Your duties as subscriber
- Assess Plexum360 as an ICT supplier in your NIS2 risk-management measures.
- Make the national CSIRT or competent-authority notifications yourself.
EU Data Act
Regulation (EU) 2023/2854Applies from 12 September 2025. Plexum360 is a data processing service, so the cloud-switching chapter applies.
Platform measures
- Exports in open formats (JSON, CSV, original document bytes) and a portable PostgreSQL schema with SQL migrations (Articles 23 to 31).
- Every capability can be moved to another provider by configuration; exit paths are published by the architecture endpoint.
Your duties as subscriber
- Give notice of switching under your subscription terms.
European Accessibility Act
Directive (EU) 2019/882Applies from 28 June 2025 to the consumer e-commerce parts of the platform, such as individual academy course purchases.
Platform measures
- Semantic HTML forms, keyboard-reachable controls, and labelled inputs, targeting WCAG 2.1 AA (EN 301 549).
Digital Services Act
Regulation (EU) 2022/2065Limited. Plexum360 stores content for business subscribers but does not disseminate it to the public, so it is a hosting service rather than an online platform. Points of contact and notice-and-action duties apply (Articles 11, 12, and 16).
Platform measures
- A single point of contact for authorities and users through the workspace "Contact the Founder" channel and the discovery request form.
Cyber Resilience Act
Regulation (EU) 2024/2847Not directly applicable. Plexum360 is delivered as a hosted service rather than as a product with digital elements; remote processing is covered by NIS2 instead. Reviewed annually.
Platform measures
- Coordinated vulnerability intake through the founder contact channel.
GDPR Article 28
Inference sub-processors
The agent group can route to these providers. The active order is set by configuration, and an EU-hosted model endpoint can replace all of them.
| Provider | Purpose | Transfer safeguard |
|---|---|---|
| Anthropic | Large language model inference | Standard contractual clauses / EU–US Data Privacy Framework |
| OpenAI | Large language model inference (failover) | Standard contractual clauses / EU–US Data Privacy Framework |
| Google (Gemini) | Large language model inference (failover) | Standard contractual clauses / EU–US Data Privacy Framework |
| Self-hosted model endpoint | Optional in-tenancy or EU-sovereign inference | No third-country transfer when hosted in the EU |
| Netlify AI Gateway | Inference routing and credential management | Standard contractual clauses |
Agent outputs are decision support, not legal advice. Verify every legal requirement against the official text with a competent person before relying on it. Authorities and users can reach the single point of contact through the discovery request form on the home page or the Contact the Founder channel in the workspace.