Audit & Risk Agent
Board-ready AI-governance posture, impact assessments and audit
Compliance & Regulatory · Firm Governance
Assesses the firm's own compliance posture and produces risk registers and inspection bundles.
No credit card required
| Time | Who | Type | Entry | Matter |
|---|---|---|---|---|
| 09:36 | j.okafor | Document | Disclosure_letter_v4.docx uploaded · 18 pages | HAL-2026-0031 |
| 09:30 | e.vance | Conflict check | Conflict check on open · no matches across 38 matters | RC-2026-0009 |
| 09:12 | admin | Member | p.hartley added · role: Associate · 4 matters | Workspace |
| 08:55 | r.chen | Run | Due Diligence Agent · review grid · 12 documents | HAL-2026-0031 |
| 08:40 | r.chen | Verification | Verify all · 6 authorities · 6 verified | HAL-2026-0031 |
You hand it
- Assess the firm's compliance posture against the SRA Code
- Produce a risk register for a practice group
- Prepare a monthly COLP inspection bundle
You get back
A risk register or assessment report, plus the printable inspection bundle carrying a content digest.
- Summary
- Gap analysis
- Risk register
- Remediation roadmap
You can rely on it because
It runs inside the matter, reads only what is on the file, and records every step under How this was made.
From the task to the memo.
The Audit & Risk Agent does the internal work: compliance posture against the SRA Code and the EU AI Act, risk registers and structured assessment reports, drawing on skills covering COLP and COFA duties, SRA compliance rules, EU AI Act compliance, NIST AI RMF mapping, ISO 42001 controls and client-matter risk scoring.
- 1
Define the scope
Define the assessment scope: which frameworks (SRA, EU AI Act, NIST, ISO), which systems, and which time period.
- 2
Provide context
Provide context: existing policies, risk registers and prior audit reports.
- 3
Assess and score
The agent maps evidence against each framework's rules and articles, and scores gaps by risk.
- 4
Review the report
Review the structured report: gap analysis, risk ratings and remediation recommendations, gated by Privilege Review before circulation.
Three tasks to start with.
The prompts the agent suggests inside the workspace. Paste your own document under any of them.
Assess our SRA compliance posture
Assess our current AI governance posture against SRA Rules 2.1, 2.2, 2.5, 4.3 and Principle 7. Produce a gap analysis with risk ratings and a remediation roadmap:
Run an EU AI Act readiness check
Assess our EU AI Act readiness under Articles 6, 13, 14 and 99: high-risk classification, transparency obligations and human oversight mechanisms. Flag anything not yet in place:
Build a risk register
Build a risk register for our AI use cases, with likelihood, impact, existing controls and a risk owner for each entry:
Who it is for, and what it will not do yet.
Best for
- Compliance officers and risk managers.
- AI governance assessments and pre-audit preparation.
- Board and SRA reporting.
Not yet
- Automatic evidence-gathering across live systems is not yet supported: the assessment works from the policies, registers and prior reports you provide.
Under the hoodProtocols, gates, skills and sources, for the reader who wants them.
Protocols
- 01Planning ProtocolMaps out the plan before any work starts: which sources answer which part of the task, in what order.
- 02Privilege ReviewAssesses the output for privileged or confidential material and flags disclosure risk before it is circulated.
Skills
- SRA Compliance Rules
- EU AI Act Compliance
- NIST AI RMF Mapping
- ISO 42001 Controls
- COLP / COFA Duties
- Client Matter Risk Scoring
- AI Use-Case Registry & AIA Method
- Vendor AI Terms Review
Connectors in the catalogue
Catalogue tiles, not live integrations today. Documents are uploaded to the matter.
- Atlassian
- Microsoft 365
- OpenLaw
Sources it may cite
See it do real work.
- 01The monthly COLP printable audit bundleThe compliance officer has to be able to show what the firm did, not describe what it intends. The register records every run, verification result, share, document and conflict check as it happens, and this is the monthly routine that turns it into something the risk committee reads.
- 02Assess worker status across a contractor poolFenwick Marine engages sixty contractors on four different templates and one of them has claimed holiday pay. The grid reads every agreement against the same status questions so the pool can be sorted by risk rather than by template.
- 03Audit open source licences before a code releaseZennor Robotics is about to ship firmware to customers for the first time and nobody has looked at the open source in it. The grid reads the dependency list and the licence texts, then sorts them by what distribution actually triggers.
- 04Review a client file against the money laundering rulesA firm's MLRO has pulled a sample of thirty client files ahead of an internal review. The grid reads each file for the due diligence actually evidenced, rather than for the tick on the front sheet.
- 05Screen a counterparty ownership chain for sanctions riskA counterparty in a commodities transaction sits at the bottom of a five-layer ownership structure ending in two trusts. The run reads the corporate documents supplied and identifies where ownership and control questions arise.
- 06Audit a cookie banner against the tracking rulesA retailer's site sets forty-one trackers and its cookie policy describes eleven. The audit reads the tracker inventory against the banner behaviour and the policy, and reports where the three do not match.