Skip to main content
Praxikon
Agent check

Free template · Excel and PowerPoint · English and Dutch

The agent dossier: board deck and agent register for AI agents

The agent dossier brings together what you need to deploy AI agents safely and within the rules: a board deck on the risks, the rules and the first measures, and an agent register in Excel in which you record for each agent what it does, who answers for it, what it may do and which rules apply. Both build on the Praxikon guide AI agents and the law.

Last checked against the law
Editor
, jurist, privacy and AI
Version and template ID
2.0 · praxikon:template:agentregister, praxikon:template:agentdossier-bestuursdeck
Legal basis
Articles 3, 4, 6, 12, 14, 16, 19, 25 to 27, 49, 50 and 111 and Annex III of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744; Articles 4, 5, 6, 9, 22, 24, 26, 28, 30, 32 and 35 GDPR

Who is this template for?

  • Privacy officer or AI leadUsually keeps the register, guards the intake and compares the register periodically with what actually runs; assesses the GDPR role, the legal basis and the DPIA for each agent (Articles 6, 22 and 35 GDPR)
  • Owner of an agent (team lead or head of department)Answers for the agent in the department that uses it and must be able to demonstrate how it is managed (Article 5(2) GDPR)
  • IT and securitySupply the technical facts: connections and permissions, logging, kill switch and the results of the last test
  • Procurement and contract managementRecord the contract with the vendor: the data processing agreement (Article 28 GDPR) and no training on your data without an agreement
  • Product team that builds an agent or deploys it under its own nameIs usually the provider and then carries Article 50(1) AI Act, telling people they are dealing with AI; for high-risk systems also logging and a stop button (Articles 12 and 14)
  • Board or managementDecides on agents with extensive permissions or high risk

What is inside

Agent register (Excel)

An agent register, or AI agent inventory, is the list that records, for each AI agent, what it does, who is responsible for it, what it may do and which rules apply. No framework we have read prescribes an agent register with fixed fields and the AI Act has no internal register duty; this workbook is a working model with fourteen fields per agent, not a legal form.

  • About this template: six steps for using the workbook, plus fields for organisation, keeper, version and the date of the last comparison with what actually runs
  • Agent register: one row per AI agent with fourteen fields in five groups: who and what, what the agent may do, what you can verify and stop, what the law asks, and how the agent works with others and is tested; room for 30 agents
  • A filled-in row as an example: the customer service agent of a web shop (fictional)
  • Drop-down lists for the dangerous triangle, the approval, the logging and the kill switch, with a colour for what is still unknown or missing, and red when all three legs of the triangle are present without a recorded approval beforehand
  • Guide: for each field one or two sentences on what belongs in it and why, with the article where the law covers it

Board deck on AI agents (PowerPoint)

A ten-slide board deck with which a privacy officer, compliance lead or CISO briefs the board on AI agents in one meeting: what an agent is, the five risks that come with it, which rules apply, who is responsible and what the board decides now. With speaker notes and sources per slide.

  • Ten slides in the Praxikon house style, 16:9, with little text per slide so you can tell the story yourself.
  • The five risks of the agent check and the dangerous triangle in one picture.
  • The rules on one slide: the AI Act, the GDPR and the Dutch Cybersecurity Act, each with the right date.
  • Who is responsible: provider, deployer, controller and processor.
  • The six controls, the agent register and a plan for the first ninety days, with three decisions for the board.
  • Speaker notes with the source per slide.

How to use the template

  1. If you have nothing yet, start with the free Agent check. It gives a pre-filled entry; you fill in name, owner, vendor, connections, interaction and the date of the last test yourself.
  2. Put every agent on its own row: also vendors' agents, agents inside software you already have and agents employees switched on themselves.
  3. Complete the fourteen fields and read the guide for a field when in doubt. If you do not know an answer yet, choose Still unknown and find out.
  4. If you already have an AI register, add these fields to it and point each agent to the lines in the record of processing it touches.
  5. Let new agents go live only through an intake, compare the register periodically with what actually runs and review an entry on every change.

Common mistakes

  • Building a separate list next to the AI register. Two registers covering the same systems must be maintained twice, and then they drift apart. Add the fields to your AI register and point to the record of processing.
  • Listing only the agents IT knows about. Employees switch on agents themselves: compare the register periodically with what actually runs, such as licences, connected apps, API keys and MCP configurations.
  • Entering 'IT' as the owner. Record one named person in the department that uses the agent.
  • Recording what the agent is meant to see instead of what it can see. Note the categories of data and data subjects it can reach, with special categories separate.
  • Changing the test date without a real test. Change the date only after a real test.
  • Confusing the agent register with the EU database under the AI Act or the Algorithm Register. Those are external registrations; the agent register is an internal working model.

When do you need legal advice?

  • The agent takes part in decisions about people. If it filters applications or evaluates candidates, that is listed in Annex III (point 4(a)), with high-risk obligations from 2 December 2027 for providers and deployers (for systems already in use before that date: Article 111(2)). The Article 6(3) exception never applies where the system profiles people. If it takes decisions with legal or similarly significant effects without meaningful human involvement, Article 22 GDPR applies, and you carry that duty as controller.
  • Your role may shift. If you have the agent developed for you and put it into service under your own name, you are the provider and Article 50(1) AI Act falls to you. If you change the purpose of a vendor's agent so that it becomes high-risk, you become its provider (Article 25(1)(c)).
  • A vendor or connection uses your data for its own purposes. For training, for example. If it does so with your agreement, it is itself the controller for that and, as controller, you need a legal basis to hand the data over (Article 4(7) GDPR); if it does so outside your instructions, it infringes the GDPR (Article 28(10)). A sub-processor needs your prior written authorisation (Article 28(2)).

Frequently asked questions

What is an agent register?

An internal overview with one fixed line per AI agent: task, owner, connections and permissions, approval, logging, kill switch, role and risk class. It is a working method, not a legal term.

Is an agent register mandatory?

Not as such. The AI Act requires no internal register, and no framework we have read prescribes an agent register with fixed fields. The record of processing under Article 30 GDPR is, as a rule, mandatory.

How does it differ from the AI register and the record of processing?

The record of processing captures processing activities, the AI register AI systems with role and risk class, the agent register what an agent can do: connections, permissions, approval, kill switch. Extend your AI register rather than building a separate list.

Which agents belong in it?

All agents your organisation uses: self-built, vendor agents, agents inside software you already have and agents employees switched on themselves. The Commission notes broad agreement that an agent processes input from its environment and acts on it; there is no legal definition.

Who maintains the register, and how often?

Every agent has an owner in the department that uses it; the register itself is usually kept by the privacy officer or the AI lead. There is no statutory frequency: update an entry whenever something changes and compare the register, for instance every quarter, with what actually runs.

May I adapt the workbook and share it within my organisation?

Yes. You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

Who is this board deck for?

For anyone who has to brief the board on AI agents: a privacy officer, DPO, compliance lead, AI governance lead or CISO. The slides carry little text; you tell the story yourself, with the notes as support.

May I adapt the slides?

Yes. You may adapt the deck and use it internally, with the credit to Praxikon. It remains an aid and not legal advice for your situation.

What else is in the agent dossier?

An agent register in Excel with fourteen fields per agent, a filled-in example and guidance per field. Slide 8 of the deck refers to it.

Does every AI agent fall under the AI Act?

An agent is usually an AI system within the meaning of Article 3(1) AI Act. Which duties apply depends on your role and the agent's task. If it processes personal data, the GDPR applies as well.

Use and credit

You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

How to cite this template: Source: Praxikon, The agent dossier: board deck and agent register for AI agents, version 2.0, as of 6 October 2026, https://www.praxikon.com/en/templates/agentdossier

This template is a tool, not legal advice for your situation. It reflects the law as of 6 October 2026. Legislation, guidance and supervisory practice may change after that date. Using this template does not guarantee compliance: applying it in your organisation remains your own responsibility.

Praxikon is a trade name of Embed AI · Chamber of Commerce 90283597