{"data":{"slug":"ai-agent-registry","title":"AI Agent Registry and Permission Matrix","type":"register","formats":["xlsx","docx"],"topics":["inventory","oversight","governance"],"frameworks":["eu-ai-act","nist-ai-rmf"],"short":"A register for agents that act — with tools, credentials and autonomy — and a permission matrix stating what each may do alone, with approval, or never.","covers":{"categories":["human_oversight","transparency","record_keeping"]},"version":7,"dataset_version":"ef1018b7a6a2","generated_at":"2026-11-12T05:14:18+00:00","citations":51,"downloads":7,"files":[{"format":"xlsx","filename":"ai-agent-registry-v7.xlsx","bytes":34558,"url":"https://aipolicytracker.org/templates/ai-agent-registry#download"},{"format":"docx","filename":"ai-agent-registry-v7.docx","bytes":13249,"url":"https://aipolicytracker.org/templates/ai-agent-registry#download"}],"url":"https://aipolicytracker.org/templates/ai-agent-registry","inside":["Registry sheet: agent, purpose, model, tools, credentials, owner, kill switch, logging","Permission matrix sheet: agents against actions (read, write, send, execute, pay, browse, act for a user) with Allowed / With approval / Denied dropdowns","Duties sheet: the oversight and transparency duties on record that apply to autonomous systems"],"legal_basis":["eu-ai-act","us-nist-ai-rmf"],"caveat":null,"covered_obligations":[{"slug":"australia-vaiss-testing-human-control-transparency","title":"Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6)","policy":"australia-voluntary-ai-safety-standard","source_reference":"Guardrails 4, 5 and 6","url":"https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency"},{"slug":"us-california-ccpa-admt-pre-use-notice","title":"Give consumers a Pre-use Notice before using automated decision-making technology for a significant decision","policy":"us-california-cppa-admt-regulations","source_reference":"Cal. Code Regs. tit. 11, § 7220","url":"https://aipolicytracker.org/obligations/us-california-ccpa-admt-pre-use-notice"},{"slug":"us-california-ccpa-admt-opt-out","title":"Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal","policy":"us-california-cppa-admt-regulations","source_reference":"Cal. Code Regs. tit. 11, § 7221","url":"https://aipolicytracker.org/obligations/us-california-ccpa-admt-opt-out"},{"slug":"us-california-ccpa-admt-access","title":"Answer consumers' requests to access information about how automated decision-making technology was used about them","policy":"us-california-cppa-admt-regulations","source_reference":"Cal. Code Regs. tit. 11, § 7222","url":"https://aipolicytracker.org/obligations/us-california-ccpa-admt-access"},{"slug":"us-california-ccpa-risk-assessment-submission","title":"Submit risk assessment information to the California Privacy Protection Agency each year","policy":"us-california-cppa-admt-regulations","source_reference":"Cal. Code Regs. tit. 11, § 7157","url":"https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment-submission"},{"slug":"us-california-sb-53-transparency-report","title":"Frontier developers must publish a transparency report before deploying a new frontier model","policy":"us-california-sb-53","source_reference":"Business and Professions Code Section 22757.12 (as added by SB 53)","url":"https://aipolicytracker.org/obligations/us-california-sb-53-transparency-report"},{"slug":"us-colorado-admt-advance-notice","title":"Notify consumers before automated decision-making technology influences a consequential decision","policy":"us-colorado-automated-decision-making-technology-act","source_reference":null,"url":"https://aipolicytracker.org/obligations/us-colorado-admt-advance-notice"},{"slug":"us-colorado-admt-adverse-decision-disclosure","title":"Disclose the use of the technology and the principal reasons after an adverse consequential decision","policy":"us-colorado-automated-decision-making-technology-act","source_reference":null,"url":"https://aipolicytracker.org/obligations/us-colorado-admt-adverse-decision-disclosure"},{"slug":"us-colorado-admt-human-review","title":"Offer meaningful human review of an adverse consequential decision","policy":"us-colorado-automated-decision-making-technology-act","source_reference":null,"url":"https://aipolicytracker.org/obligations/us-colorado-admt-human-review"},{"slug":"us-colorado-admt-record-keeping","title":"Keep records of consequential decisions influenced by the technology for three years","policy":"us-colorado-automated-decision-making-technology-act","source_reference":null,"url":"https://aipolicytracker.org/obligations/us-colorado-admt-record-keeping"},{"slug":"eu-ai-act-record-keeping","title":"Design high-risk systems to log events automatically","policy":"eu-ai-act","source_reference":"Article 12; Article 26(6) for deployers","url":"https://aipolicytracker.org/obligations/eu-ai-act-record-keeping"},{"slug":"eu-ai-act-transparency-to-deployers","title":"Provide deployers with clear instructions for use","policy":"eu-ai-act","source_reference":"Article 13","url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-to-deployers"},{"slug":"eu-ai-act-human-oversight","title":"Enable and assign effective human oversight","policy":"eu-ai-act","source_reference":"Article 14; Article 26(2) for deployers","url":"https://aipolicytracker.org/obligations/eu-ai-act-human-oversight"},{"slug":"eu-ai-act-transparency-article-50","title":"Disclose AI interaction and label synthetic content","policy":"eu-ai-act","source_reference":"Article 50","url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-article-50"},{"slug":"eu-ai-act-art-18-documentation-keeping","title":"Providers must keep high-risk AI documentation for ten years","policy":"eu-ai-act","source_reference":"Article 18","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping"},{"slug":"eu-ai-act-art-19-provider-log-retention","title":"Providers must retain automatically generated logs under their control","policy":"eu-ai-act","source_reference":"Article 19","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention"},{"slug":"eu-ai-act-art-26-7-worker-information","title":"Employers must inform workers and their representatives before using high-risk AI at work","policy":"eu-ai-act","source_reference":"Article 26(7)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-7-worker-information"},{"slug":"eu-ai-act-art-26-11-notice-to-affected-persons","title":"Deployers must tell natural persons that a high-risk AI system is used in decisions about them","policy":"eu-ai-act","source_reference":"Article 26(11)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-11-notice-to-affected-persons"},{"slug":"eu-ai-act-art-50-2-synthetic-content-marking","title":"Providers of generative AI must mark synthetic output as artificially generated in a machine-readable way","policy":"eu-ai-act","source_reference":"Article 50(2)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-2-synthetic-content-marking"},{"slug":"eu-ai-act-art-50-3-emotion-recognition-notice","title":"Deployers of emotion recognition or biometric categorisation must inform exposed persons","policy":"eu-ai-act","source_reference":"Article 50(3)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice"},{"slug":"eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure","title":"Deployers must disclose deepfakes and AI-generated text published on matters of public interest","policy":"eu-ai-act","source_reference":"Article 50(4)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure"},{"slug":"eu-ai-act-art-86-right-to-explanation","title":"Deployers must explain individual decisions taken with high-risk AI on request","policy":"eu-ai-act","source_reference":"Article 86","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-86-right-to-explanation"},{"slug":"us-new-york-gbl-1702-ai-notification","title":"Tell users at the start of an AI companion interaction, and at least every three hours, that they are not communicating with a human","policy":"us-new-york-ai-companion-safeguards","source_reference":"N.Y. Gen. Bus. Law § 1702","url":"https://aipolicytracker.org/obligations/us-new-york-gbl-1702-ai-notification"},{"slug":"us-new-york-city-local-law-144-publish-audit-summary","title":"Employers and employment agencies must publish a summary of the bias audit results","policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","source_reference":"NYC Administrative Code Section 20-871(a)(2); 6 RCNY Section 5-302","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-publish-audit-summary"},{"slug":"us-new-york-city-local-law-144-candidate-notice","title":"Employers and employment agencies must notify candidates and employees before an automated tool is used","policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","source_reference":"NYC Administrative Code Section 20-871(b)(1) and (b)(2); 6 RCNY Section 5-303","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-candidate-notice"},{"slug":"us-new-york-city-local-law-144-alternative-process-request","title":"Employers and employment agencies must let candidates request an alternative selection process or accommodation","policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","source_reference":"NYC Administrative Code Section 20-871(b)(1); 6 RCNY Section 5-303","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-alternative-process-request"},{"slug":"singapore-mgf-human-involvement","title":"Determine the appropriate level of human involvement in AI decisions","policy":"singapore-model-ai-governance-framework","source_reference":"Second edition, Part on human involvement in AI-augmented decision-making","url":"https://aipolicytracker.org/obligations/singapore-mgf-human-involvement"},{"slug":"singapore-mgf-genai-incident-reporting-and-provenance","title":"Report incidents and mark AI-generated content (generative AI framework)","policy":"singapore-model-ai-governance-framework","source_reference":"Generative AI framework, dimensions on incident reporting and content provenance","url":"https://aipolicytracker.org/obligations/singapore-mgf-genai-incident-reporting-and-provenance"},{"slug":"singapore-pdpc-ai-notification","title":"Notify individuals about the use of personal data in AI recommendations and decisions","policy":"singapore-pdpc-ai-advisory-guidelines","source_reference":"Advisory guidelines, section on notification obligation","url":"https://aipolicytracker.org/obligations/singapore-pdpc-ai-notification"},{"slug":"south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai","title":"AI business operators must notify users in advance that a product or service runs on high-impact or generative AI","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 31(1)","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai"},{"slug":"south-korea-ai-basic-act-art-31-generative-output-labelling-and-deepfake-notice","title":"AI business operators must label generative AI output and clearly flag realistic synthetic media","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 31(2) and 31(3)","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-31-generative-output-labelling-and-deepfake-notice"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-explanation-measures","title":"Operators of high-impact AI must be able to explain outputs and the main criteria behind them","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 34(1)","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-explanation-measures"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight","title":"Operators of high-impact AI must ensure human management and supervision","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 34(1)","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight"},{"slug":"us-texas-responsible-ai-governance-act-traiga-government-agency-ai-interaction-disclosure","title":"Government agencies must disclose to consumers that they are interacting with an AI system","policy":"us-texas-responsible-ai-governance-act-traiga","source_reference":"Business and Commerce Code Section 551.051","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-agency-ai-interaction-disclosure"},{"slug":"us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure","title":"Health-care providers must disclose the use of AI in patient services","policy":"us-texas-responsible-ai-governance-act-traiga","source_reference":"Business and Commerce Code Section 551.051","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure"},{"slug":"uae-pdpl-automated-decision-objection","title":"Respect the right to object to automated decision-making without human intervention","policy":"uae-personal-data-protection-law","source_reference":"Article on data-subject rights relating to automated processing (reviewer to cite article number)","url":"https://aipolicytracker.org/obligations/uae-pdpl-automated-decision-objection"},{"slug":"uk-principles-transparency-explainability","title":"Provide appropriate transparency and explainability","policy":"uk-ai-regulation-white-paper","source_reference":"Principle 2, Part 3","url":"https://aipolicytracker.org/obligations/uk-principles-transparency-explainability"},{"slug":"uk-principles-contestability-redress","title":"Provide routes to contest AI outcomes and seek redress","policy":"uk-ai-regulation-white-paper","source_reference":"Principle 5, Part 3","url":"https://aipolicytracker.org/obligations/uk-principles-contestability-redress"},{"slug":"uk-ico-automated-decision-safeguards","title":"Apply safeguards to solely automated decisions with significant effects","policy":"uk-ico-ai-data-protection-guidance","source_reference":"UK GDPR Article 22 as amended by the Data (Use and Access) Act 2025","url":"https://aipolicytracker.org/obligations/uk-ico-automated-decision-safeguards"},{"slug":"us-omb-m-25-21-use-case-inventory","title":"Publish an annual AI use-case inventory","policy":"us-omb-m-25-21","source_reference":"Section 3","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-use-case-inventory"},{"slug":"us-washington-eshb-2225-ai-disclosure","title":"Tell users that an AI companion chatbot is artificially generated and not human, at the start and at least every three hours","policy":"us-washington-eshb-2225-ai-companion-chatbots","source_reference":"ESHB 2225 (Chapter 168, Laws of 2026), sec. 3","url":"https://aipolicytracker.org/obligations/us-washington-eshb-2225-ai-disclosure"},{"slug":"us-washington-eshb-2225-minor-disclosure","title":"Where the user is known to be a minor or the chatbot is directed to minors, repeat the not-human notice at least every hour","policy":"us-washington-eshb-2225-ai-companion-chatbots","source_reference":"ESHB 2225 (Chapter 168, Laws of 2026), sec. 4(1)(a), (2) and (3)","url":"https://aipolicytracker.org/obligations/us-washington-eshb-2225-minor-disclosure"},{"slug":"us-washington-eshb-2225-protocol-publication","title":"Publish the self-harm protocol and the number of crisis referral notifications issued in the preceding calendar year","policy":"us-washington-eshb-2225-ai-companion-chatbots","source_reference":"ESHB 2225 (Chapter 168, Laws of 2026), sec. 5(3)","url":"https://aipolicytracker.org/obligations/us-washington-eshb-2225-protocol-publication"}],"versions":[{"version":7,"generated_at":"2026-11-12T05:14:18+00:00","dataset_version":"ef1018b7a6a2","changelog":"Dataset 4559f86f527b → ef1018b7a6a2. Sheet \"Oversight duties\": 35 → 43 rows (+8). Record citations: 43 → 51.","stats":{"sheets":{"Registry":0,"Permission matrix":0,"Oversight duties":43},"blocks":52,"headings":11,"citations":51}},{"version":6,"generated_at":"2026-10-16T05:30:03+00:00","dataset_version":"4559f86f527b","changelog":"Dataset 1e8ea28a8a93 → 4559f86f527b.","stats":{"sheets":{"Registry":0,"Permission matrix":0,"Oversight duties":35},"blocks":52,"headings":11,"citations":43}},{"version":5,"generated_at":"2026-10-09T05:30:01+00:00","dataset_version":"1e8ea28a8a93","changelog":"Dataset 52bd836b1d6b → 1e8ea28a8a93.","stats":{"sheets":{"Registry":0,"Permission matrix":0,"Oversight duties":35},"blocks":52,"headings":11,"citations":43}},{"version":4,"generated_at":"2026-10-08T05:30:02+00:00","dataset_version":"52bd836b1d6b","changelog":"Dataset 9710140e23e4 → 52bd836b1d6b.","stats":{"sheets":{"Registry":0,"Permission matrix":0,"Oversight duties":35},"blocks":52,"headings":11,"citations":43}},{"version":3,"generated_at":"2026-10-06T05:30:01+00:00","dataset_version":"9710140e23e4","changelog":"Dataset 3335c39da4b7 → 9710140e23e4.","stats":{"sheets":{"Registry":0,"Permission matrix":0,"Oversight duties":35},"blocks":52,"headings":11,"citations":43}},{"version":2,"generated_at":"2026-09-27T05:30:02+00:00","dataset_version":"3335c39da4b7","changelog":"Dataset 914895c3103e → 3335c39da4b7. Sheet \"Oversight duties\": 34 → 35 rows (+1). Document: 53 → 52 blocks. Record citations: 42 → 43.","stats":{"sheets":{"Registry":0,"Permission matrix":0,"Oversight duties":35},"blocks":52,"headings":11,"citations":43}},{"version":1,"generated_at":"2026-09-26T13:05:06+00:00","dataset_version":"914895c3103e","changelog":"First version, built from dataset 914895c3103e.","stats":{"sheets":{"Registry":0,"Permission matrix":0,"Oversight duties":34},"blocks":53,"headings":11,"citations":42}}]},"meta":{"license":"CC BY 4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","disclaimer":"This template is generated from the records on aipolicytracker.org. It is an informational resource, not legal advice, and completing it does not make an organisation compliant with any law or standard. Every row that cites a duty links to the record it came from; check the official source before relying on it."}}