Search cases, suites, agents…⌘K
DEMO · synthetic data
← All agents
Compliance profile

Payroll Copilot

high-riskL2Gated

Explains pay, rates, and total compensation from the payroll system of record. · development · risk owner B. Weasley · next review 2026-10-20

Export audit bundle →

Risk classification

proposed from registry metadata; a compliance officer approves and signs
Proposed
Registry metadata: pillar payroll · PII scope high · answers cited in pay disputes
Annex III 4(b) — conservative: answers influence pay/leave outcomes
Approved — M. McGonagall (AI Governance Officer) · 2026-04-20
Gray zone under 4(b) — the copilot explains rather than decides — but managers act on its answers. Classified high-risk rather than argue the derogation.

Readiness

applicable controls with current evidence
EU AI Act13 of 14· 1 gap
NIST AI RMF10 of 11· 1 gap
ISO 420018 of 10· 2 gaps
SOC 28 of 8
Internal3 of 5· 2 gaps

EU AI Actregulation

Regulation (EU) 2024/1689
13 of 14 current
Art. 6(3)–(4) + Annex III 4(b)
Documented risk classification
met
Art. 9(1)–(2)
Risk management system
met
Art. 9(6)–(8)
Testing against predefined metrics
met
Art. 10(2)–(3)
Data governance and bias examination
met
Art. 10(5)
Special-category data safeguards
met
Art. 11 + Annex IV
Technical documentation
met
Art. 12(1)–(2)
Automatic record-keeping
met
Art. 13(1)–(3)
Transparency to deployers
met
Art. 14(1)–(4)
Human oversight
met
Art. 15(1)–(3)
Accuracy, declared and maintainedNM
met
Art. 15(4)
Robustness and fail-safetyAD
met
Art. 15(5)
Cybersecurity incl. AI-specific attacksAD
met
Art. 72
Post-market monitoringDR
Watch window and guardrail feed active, but the Art. 72 monitoring-plan document hasn't been assembled from them yet — due before production.
partial
Art. 73
Serious-incident reporting
met

NIST AI RMFvoluntary framework

NIST AI 100-1 · GenAI Profile AI 600-1
10 of 11 current · 1 n/a
MEASURE 2.1
TEVV documentation
met
MEASURE 2.3
Performance under deployment conditions
met
MEASURE 2.4
Production behaviour monitoredDR
met
MEASURE 2.5
Valid and reliableNM
met
MEASURE 2.6
Safety evaluated regularlySF
met
MEASURE 2.7
Security and resilienceAD
met
MEASURE 2.9
Model output explained and validated
comp-answer-judge@v1 is still in shadow (κ 0.71 < 0.80). Semantic scoring leans on the certified shared judges until it clears.
partial
MEASURE 2.10
Privacy risk examinedSF
met
MEASURE 2.11
Fairness and bias evaluatedFR
No decision output: the agent explains pay, it doesn't decide it. Fairness routes to Fairlearn only when behaviour reduces to a decision label.
n/a
MEASURE 2.13
Effectiveness of TEVV itself
met
MAP 5.1
Impact likelihood and magnitude
met
MANAGE 4.1
Post-deployment monitoring plan
met

ISO/IEC 42001certifiable standard

ISO/IEC 42001:2023 (AIMS)
8 of 10 current
A.2.2
AI policy
met
A.3.2
AI roles and responsibilities
met
A.5.2
AI system impact assessment process
met
A.5.4
Impact on individuals and groupsFR
Privacy and safety impacts assessed; the group-impact dimension is n/a-by-design for an explanatory agent, pending the annual reconfirmation that it still makes no decisions.
partial
A.6.2.4
AI system verification and validation
met
A.6.2.5
AI system deployment
met
A.6.2.6
Operation and monitoringDR
met
A.6.2.8
Recording of event logs
met
A.7.4
Quality of data for AI systems
payroll-comp-golden holds a declared-truth conflict (base_rate) pending SME review before Calendar@2026.3 adoption.
partial
A.7.5
Data provenance
met

SOC 2 Type IIauditor attestation

AICPA 2017 TSC (2022 points of focus)
8 of 8 current
PI1.1
Processing objectives defined
met
PI1.2
Input completeness and accuracy
met
PI1.3
Processing per specification
met
PI1.4
Output completeness and delivery
met
PI1.5
Input/output storage
met
CC3.2
Risk identification and analysis
met
CC7.2
Anomaly monitoring
met
CC8.1
Change management
met

US employment-AI lawstate & local law

NYC Local Law 144 · Illinois HB 3773 (in force 2026-01-01)
documented out of scope
NYC LL144 §20-871(b)
Annual independent bias auditFR
Not an AEDT: the copilot doesn't substantially assist or replace employment decisions. If a screening agent onboards, the cohort eval is the audit artifact.
n/a
NYC LL144 §20-871(c)
Advance notice to candidates and employees
No AEDT in use — no notice obligation.
n/a
IL HB 3773 (775 ILCS 5)
No discriminatory effect on terms of employmentFR
Output doesn't touch terms of employment. Reconfirmed at each classification review.
n/a

UKG AI Quality Policyinternal policy

UKG AI Quality Policy v2.1
3 of 5 current
AIQ-1
Regulated numbers never judged by an LLMNM
met
AIQ-2
Judges gate only while calibrated
comp-answer-judge@v1 gates nothing until κ ≥ 0.80 + SME certificate. Gate currently runs on grader packs + certified shared judges — the bar is holding, which is the control working.
gap
AIQ-3
Overrides attributed, justified, time-boxed
met
AIQ-4
Production data enters test data scrubbedSF
met
AIQ-5
Dataset composition pinned and revalidated
Pins present in every run; the pending base_rate conflict must resolve before the Calendar@2026.3 refresh lands.
partial