Agent Register
Every agent · Customer-facing bots · ServiceNow

ServiceNow Now Assist and AI Agents

Assist drafts for agents; AI Agents execute workflows across the platform under configured roles. Runs inside the platform trust boundary.

executes with approval
acts on
configurable
human in the loop by default
no
data leaves the tenant by default
Tickets, knowledge, the CMDB and any workflow an agent is allowed to run
reaches by default

What that means for the register

It acts, but a person approves each action by default; the risk moves to whoever relaxes that setting. Data stays inside your tenant by default. Pasted with only its name it lands as control until an owner is named.

This week

List the AI Agents that can execute workflows and the roles they run as.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Agent Register.

Broad system reach or write access to a system of record ISO 42001 A.4.4 · ISO 42001 A.4.5 · ISO 42001 A.6.2.5 · ISO 42001 A.5.2 · EU AI Act Art.15 · EU AI Act Art.9
ISO 42001 A.4.4 Tooling resources

The organization shall document information about the tooling resources utilized for the AI system.

Evidence an auditor accepts: Tooling inventory; Tool risk assessments; Development frameworks, libraries, MLOps platforms
ISO 42001 A.4.5 System and computing resources

The organization shall document information about the system and computing resources utilized.

Evidence an auditor accepts: Infrastructure inventory; Capacity plans; Compute (CPU/GPU), storage, network resources
ISO 42001 A.6.2.5 AI system deployment

The organization shall document a deployment plan and ensure requirements are met before deployment.

Evidence an auditor accepts: Deployment plans; Go-live checklists; Approval records
ISO 42001 A.5.2 AI system impact assessment process

The organization shall establish a process to assess the potential consequences of the AI system for individuals or groups and societies.

Evidence an auditor accepts: AI impact assessment procedure; Assessment template; Methodology covering individuals, groups, societies
EU AI Act Art.15 Accuracy, robustness and cybersecurity

High-risk AI systems shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness, and cybersecurity, and shall perform consistently in those respects throughout their lifecycle. Resilience to errors, faults and inconsistencies; protection against atte...

Evidence an auditor accepts: Accuracy/robustness measurements relevant to the intended purpose; Adversarial/data-poisoning threat modelling and mitigation; Cybersecurity controls aligned with state-of-the-art
EU AI Act Art.9 Risk management system

Providers shall establish, implement, document and maintain a risk management system as a continuous iterative process planned and run throughout the entire lifecycle of a high-risk AI system, including identification and analysis of known and reasonably foreseeable risks, estimation/evaluation of r...

Evidence an auditor accepts: Risk management system documentation; Lifecycle risk analysis records; Post-deployment risk monitoring
Customer-facing or people-affecting without supervision ISO 42001 A.8.2 · ISO 42001 A.5.4 · ISO 42001 A.8.4 · EU AI Act Art.50 · EU AI Act Art.6 · EU AI Act Art.86 · EU AI Act Art.27
ISO 42001 A.8.2 System documentation and information for users

The organization shall determine and provide the necessary information for users of the AI system.

Evidence an auditor accepts: User documentation; Instructions for use; Training materials
ISO 42001 A.5.4 Assessing AI system impact on individuals or groups

The organization shall assess and document the potential impacts of AI systems to individuals or groups of individuals throughout the system's life cycle.

Evidence an auditor accepts: Per-system impact assessments; Fairness analysis; Privacy impact (link to PIA where relevant)
ISO 42001 A.8.4 Communication of incidents

The organization shall determine and document a plan for communicating incidents to relevant interested parties.

Evidence an auditor accepts: Incident communication plan; Incident notification records; Notification criteria and timing
EU AI Act Art.50 Transparency obligations for providers and deployers of certain AI systems

Providers and deployers of certain AI systems (incl those interacting with natural persons, emotion recognition, biometric categorisation, generative AI producing synthetic content, deepfakes, and AI-generated/manipulated text for public-interest information) shall inform users that they are interac...

Evidence an auditor accepts: User-facing AI-interaction notification; Machine-readable labelling of synthetic content; Deepfake/AI-text disclosure
EU AI Act Art.6 Classification rules for high-risk AI systems

Determine and record, for each AI system, whether it is high-risk. A system is high-risk where it is intended to be used as a safety component of, or is itself, a product covered by the Union harmonisation legislation listed in Annex I and that product must undergo third-party conformity assessment,...

Evidence an auditor accepts: A classification record per AI system naming the Annex I legislation or the Annex III use case considered, and the conclusion reached; The documented Art.6(3) assessment where an Annex III system is judged not high-risk, dated before placing on the market; Evidence the profiling rule was applied, so any system profiling natural persons is classified high-risk regardless of the derogation
EU AI Act Art.86 Right to explanation of individual decision-making

A deployer must, at the request of an affected person who has been subject to a decision the deployer took on the basis of the output of an Annex III high-risk AI system other than one listed under Annex III point 2, and which produces legal effects or similarly significantly affects that person in ...

Evidence an auditor accepts: A documented procedure for receiving and answering explanation requests, with an owner and a response time; Explanation templates per decision type, covering both the role of the AI system in the procedure and the main elements of the decision; A register of requests received and the explanations given
EU AI Act Art.27 Fundamental rights impact assessment for high-risk AI systems

Before deploying a high-risk AI system referred to in Art.6(2) (Annex III), public-law-governed deployers (and certain private deployers providing public services + financial services) shall perform a fundamental rights impact assessment (FRIA) describing the deployment context, the categories of af...

Evidence an auditor accepts: FRIA per in-scope deployment; Notification to market surveillance authority

Do this for every tool your teams use

Paste the list and get this classification for every entry at once, with the owner column, the findings per department, and the controls the register is evidence for. Ten entries free, no account.

Build my agent register

HubSpot Breeze agents · Ada