Paste the AI tools your teams use. Get back what each one can act on, and who owns it.
Every agent, copilot and integration classified: what it can do on its own, what it reaches, whether a human is in the loop, whether your data leaves the tenant, and the controls ISO/IEC 42001 and the EU AI Act expect. Ten entries free, no account.
| Tool | Acts on | Human in loop | Standing |
|---|---|---|---|
| Zapier | executes autonomously | no | control |
| Otter.ai | executes autonomously | no | control |
| Microsoft 365 Copilot | drafts for a human | yes | clear |
| OpenAI API | executes autonomously | no | control |
| Gong | read only | yes | clear |
| Acme Insight Assistant | unknown | unknown | unregistered |
Paste the list you already have
The names are enough. A department and whatever the person who compiled the list knew ("connected to Salesforce", "personal account", "owner: Dana") sharpen the answer. Every name is matched against a published dictionary of agents, copilots, connectors and model APIs. A name that matches nothing is marked unregistered with the four questions to answer, never guessed.
Read the four answers per tool
What it can act on: read only, drafts for a human, executes with approval, or executes autonomously. What it reaches by default. Whether a human is in the loop. Whether your data leaves the tenant. Then the owner, and one standing per row: clear, control, or unregistered.
Take the controls to the review
Every finding maps to the controls ISO/IEC 42001 and the EU AI Act expect, with the requirement text, the artefacts an auditor accepts and the gap seen most often. The register is the inventory; the findings are the work list; the controls are what you show the assessor.
Why a register and not an AI security platform
The funded tools want to sit in your network and discover AI traffic before they tell you anything. Your teams can already name what they use, and an admin export of OAuth grants lists the rest. What that list lacks is the column that says what each tool can do on its own and who answers for it. That is the column this builds, in your browser, from the names you already have, with no agent, no proxy and no account.
Agent Register: the questions buyers ask
What is Agent Register?
Agent Register is a register for the AI agents, copilots and integrations your teams already use. You paste the list and it classifies each tool for what it can do on its own, what it reaches, whether a human is in the loop and whether your data leaves the tenant. It is built for the security manager, SOC lead or IT risk lead who is about to be asked for that inventory.
What do I need to paste into Agent Register?
One line per tool. The name alone is enough, and a department or what the tool is connected to sharpens the answer, as in `Name, Department, connected to Salesforce`. A CSV or TSV export with a header row works, and so does the app list from a Google Workspace or Microsoft 365 admin export.
What does it tell me about each AI tool?
For every tool it returns four answers: what it can act on (read only, drafts for a human, executes with approval, or executes autonomously), what it reaches by default, whether a human is in the loop, and whether your data leaves the tenant. It then adds the owner and one standing per row.
How many entries can I run for free?
Ten entries are free and no account is needed. Classification runs in your browser against a published dictionary.
Does anything I paste leave my browser?
Nothing you paste leaves the browser until you choose to save. Classification runs in the browser against a published dictionary, and there is no agent, no proxy and no account to install.
What happens if one of my tools is not recognised?
A name that matches nothing is marked unregistered, with the four questions to answer, and it is never guessed. The dictionary of agents, copilots and integrations it recognises is published in full at /agents/, with what each one can act on and reach.
What do the standings clear, control and unregistered mean?
Every row carries one standing: clear, control or unregistered. In the specimen register, tools that act on their own with no human in the loop sit under control, while tools that only draft for a human or read are shown as clear.
Is Agent Register an AI security platform?
No. The funded tools want to sit in your network and discover AI traffic before they tell you anything, while Agent Register works from the list your teams can already name. An admin export of OAuth grants lists the rest, and the column added here is what each tool can do on its own and who answers for it.
Which standards does it read against?
It attaches the controls ISO/IEC 42001 and the EU AI Act expect. We read the published text of ISO/IEC 42001:2023 and the EU AI Act clause by clause, and every obligation is stated in our words and cited to its clause.
Does it tell me whether I am compliant?
No. Agent Register does arithmetic on your own rows and states each obligation in our words, citing its clause; it never rules on you. The register is the inventory, the findings are the work list and the controls are what you show the assessor.
Can I hand the output to an auditor?
Every finding maps to the controls ISO/IEC 42001 and the EU AI Act expect, with the requirement text, the artefacts an auditor accepts and the gap seen most often. That is what you hand the auditor before they ask for the AI inventory.
Where do the findings come from if nothing is written while I wait?
Nothing is written while you wait and nothing is generated on the fly. Every obligation is stated in our words from the published text of ISO/IEC 42001:2023 and the EU AI Act and cited to its clause, and where the page names an obligation without stating its requirements, it says so and does not state them.
What this does, and what a spreadsheet, a consultant or an AI assistant does better
A spreadsheet is better for keeping the register as your own working document, with fields, filters and history this tool does not hold, and it never depends on a dictionary matching your tool names. A consultant or lawyer is better on your organisation's context and on what ISO/IEC 42001 or the EU AI Act require of it, and can advise rather than ask. A general AI assistant is better for drafting the policy text or the audit narrative around a tool. What this does that they do not is classify each pasted tool against a published dictionary for what it can act on, what it reaches, whether a human is in the loop and whether data leaves the tenant, add an owner and a standing, and map the row to the ISO/IEC 42001 and EU AI Act clauses it cites; it does not rule on you, and a tool it does not recognise is marked unregistered rather than guessed.
Primary source: ISO/IEC 42001