Every agent · Office copilots and assistants · OpenAI

ChatGPT Enterprise, Team or Edu

Q: What can ChatGPT Enterprise, Team or Edu act on?

Drafts for a human. A workspace plan: prompts are not used for training, SSO and admin controls exist, and connectors can read company systems with the user permissions. Data still leaves the tenant to the vendor, under contract.

Q: Is a human in the loop with ChatGPT Enterprise, Team or Edu, and does data leave the tenant?

Human in the loop by default: yes. Data leaves the tenant by default: yes. It drafts and a person decides, so the loop is real; what it can read is the question. Data leaves your tenant to the vendor by default.

A workspace plan: prompts are not used for training, SSO and admin controls exist, and connectors can read company systems with the user permissions. Data still leaves the tenant to the vendor, under contract.

drafts for a human

acts on

yes

human in the loop by default

yes

data leaves the tenant by default

The prompt, uploads, and any connector the workspace admin enabled (Drive, SharePoint, GitHub, Slack)

reaches by default

What that means for the register

It drafts and a person decides, so the loop is real; what it can read is the question. Data leaves your tenant to the vendor by default. Pasted with only its name it lands as control until an owner is named.

This week

List the connectors the workspace has enabled and who approved each.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Agent Register.

Data leaving the tenant to a model vendor ISO 42001 A.10.3 · ISO 42001 A.4.3 · ISO 42001 A.7.3 · ISO 42001 A.10.2 · EU AI Act Art.10 · EU AI Act Art.25

ISO 42001 A.10.3 Suppliers

Establish a process ensuring that the organization's use of services, products or materials provided by suppliers aligns with its approach to the responsible development and use of AI systems.

Evidence an auditor accepts: supplier assessment criteria covering responsible AI; completed assessments for AI suppliers including model, dataset and component providers; contract terms binding suppliers to the organization's AI requirements

ISO 42001 A.4.3 Data resources

As part of identifying resources, the organization shall document information about the data resources utilized for the AI system.

Evidence an auditor accepts: Data inventory; Data lineage records; Datasheets

ISO 42001 A.7.3 Acquisition of data

The organization shall determine and document details about the acquisition and selection of data used in AI systems, including provenance and consent where applicable.

Evidence an auditor accepts: Data acquisition records; Provenance documentation; Consent records

ISO 42001 A.10.2 Allocating responsibilities

Ensure responsibilities across the AI system life cycle are allocated between the organization, its partners, suppliers, customers and third parties.

Evidence an auditor accepts: RACI or equivalent covering each life cycle stage and each external party; contract clauses that state who is accountable for what; evidence the allocation is reviewed when the arrangement changes

EU AI Act Art.10 Data and data governance

High-risk AI systems that make use of techniques involving the training of AI models shall use training, validation and testing data that meet the quality criteria in Art.10(2)-(5): appropriate data governance, examination for possible biases, identification of data gaps/shortcomings, statistically ...

Evidence an auditor accepts: Data governance procedures; Bias examination records and remediation; Data-quality assessment per dataset

EU AI Act Art.25 Responsibilities along the AI value chain

Distributors/importers/deployers/other third parties become providers when they place on the market or put into service under their own name or trademark, substantially modify the system, or modify the intended purpose making it high-risk. The original provider shall cooperate with the new provider,...

Evidence an auditor accepts: Documented allocation of provider status across the value chain; Cooperation agreements between original and new providers

Do this for every tool your teams use

Paste the list and get this classification for every entry at once, with the owner column, the findings per department, and the controls the register is evidence for. Ten entries free, no account.

Build my agent register

Gemini app (consumer) · ChatGPT (personal account)