Most writing about AI agents uses examples where being wrong is cheap. Draft a marketing email, summarise a meeting, suggest a subject line. If it's off, someone shrugs and edits it.
Compliance is not that. A corporate secretary's work is deadline-driven, evidentially demanding, and audited. Getting an officer's details wrong isn't an awkward email — it's a filing error with a regulator attached.
Which makes it a useful place to talk about what agents actually do in a serious workflow, because none of the comfortable hand-waving survives.
Entivault is the compliance platform we build and run for corporate secretaries: an ACRA-shaped entity register, a compliance calendar, document generation, and a shared client inbox. Claude on AWS Bedrock reads filings and screening hits, extracts entity and officer data, and drafts CDD assessments for a human to approve.
That last clause is the whole design.
Where the time actually goes
The work is not mostly judgment. It's mostly transcription and cross-referencing — the same overhead as everywhere else, wearing a suit.
A new entity arrives as a bundle of documents. Someone reads them and types the details into the register: entity name, registration number, incorporation date, registered address, the officers and their identifiers, the shareholding. Then they check what's stated against what's on file, notice the address in one document doesn't match the other, and work out which is current.
Then screening. A name goes into a database and comes back with hits — some obviously the wrong person, some plausibly right, a few requiring real thought. Each one needs a recorded conclusion with reasoning, because the file has to defend itself years later to someone who wasn't there.
None of that is why anyone qualified. But it's most of the hours, and it's exactly the shape of work — extract, compare, reconcile, draft — that a language model is genuinely good at.
Three things this workflow forces you to get right
Extraction has to cite its source. Not "the registered address is X," but "the registered address is X, from page 2 of this document, this line." When a reviewer disagrees they need to see what the agent was looking at, in one click. In an audited workflow, an unsourced fact is worse than a missing one — a gap gets filled, a confident unsourced claim gets believed.
Contradiction is a finding, not a bug. Documents disagree constantly. Different vintages, an address updated in one place and not another, a name transliterated two ways. The naive design picks one and moves on, which is exactly the behaviour you must not have. The correct output is both values, both sources, flagged. An agent that surfaces "these two documents disagree about the incorporation date" has done something genuinely valuable, and it's the kind of catch that gets missed at 6pm on a filing deadline.
Screening resolution is a draft, permanently. A screening hit needs a documented judgment: is this the same person, and if not, why not. The agent assembles the comparison — name, date of birth, nationality, known associations, what matches and what doesn't — and drafts the assessment with its reasoning.
It does not conclude. A person does, and their name goes on it. That isn't a staging post on the way to automation; it's the permanent design. The decision carries professional liability, and liability doesn't delegate to software. What the agent removes is the twenty minutes of assembly before the judgment, not the judgment.
Deadlines are half the product
The compliance calendar is the unglamorous half and arguably the more valuable one.
Every entity carries recurring obligations with fixed dates. Missing one has consequences that don't care why. Traditionally this is a spreadsheet, a diary, and someone's memory — and it scales badly, because the failure mode isn't doing the work wrong, it's not remembering the work exists.
An agent that knows the register, knows the obligations that attach to each entity type, and watches the calendar can chase the missing document, prepare the filing pack, and escalate when a client has gone quiet. That's the follow-up loop again, in a context where the cost of a missed follow-up is a statutory penalty rather than an awkward silence.
Why a regulated workflow is a good first agent, not a bad one
The instinct is that compliance is too risky to be early. We'd argue the opposite, for one reason: the domain already knows how to run a review process.
The four-eyes principle exists. Approval is normal. Audit trails are expected, not resented. Nobody in the room needs convincing that a draft should be checked before it goes out, because that's how the work has always been done.
Compare that to a domain with no review culture, where introducing an approval queue feels like bureaucracy. In compliance, the approval queue is just the job, and the agent slots into a slot that already existed.
The unfamiliar part isn't the oversight. It's who produces the first draft.
What this generalises to
Every professional services workflow has the same structure hiding in it: a large amount of assembly, a small amount of judgment, and a requirement that the judgment be defensible.
The mistake is trying to automate the judgment, because that's the part that looks impressive. The opportunity is automating the assembly, completely, so the judgment gets made by someone who has all the material in front of them and hasn't spent forty minutes gathering it.
That's a less exciting claim than most AI marketing. It's also the version that ships into a regulated business and stays there.
If you have a workflow shaped like this, a 30-minute call gets you a scoped agent plan within 48 hours — the workflow, the eval set, and how much autonomy the agent gets.