07 / Cyber compliance
Control what your security agents can do.
An AI scan can become an exploit on a customer's production system. A good purpose does not stop breach notice duties, data protection enforcement, or contract claims.
Devekko builds the technical controls and records that you and your counsel need. We do not give legal advice.
Build the controls that decide the outcome
Limit each scan
Record the tenant, the system, and the permitted actions for each run. Block any target that the record does not name. Make read-only the default mode.
Stop at first proof
Stop the agent after it proves a flaw. Require a person to approve each further step, and each action that changes data. Give staff a stop control that they can test.
Keep independent evidence
Keep network logs outside the agent. Record what the agent read, where each copy went, and when each person learned of the access.
Prepare the notice plan
List each duty and time limit that applies to your customers. Name the person who sends each notice. Prepare the text for your counsel to review.
Start with the law where you operate
These guides explain how each legal system treats an AI scan that becomes an exploit. They separate the text of the law from our reading of it. We found no court or regulator decision on these exact facts.
Each guide has a worksheet that lists the rules, the time limits, and the records to prepare. A qualified lawyer in each jurisdiction must review your position.
What the work includes
We start with a map of your agents: their tools, their credentials, and the tenants that they can reach. We then test the limits on a system that you own, and we record the result.
The work can include target checks, write blocks, approval steps, log retention, and an incident rehearsal. It can also include a list of customer permissions for your counsel to put in the contract. We agree the scope in a proposal.
A few useful answers
Before we begin.
Do you give legal advice?
No. Devekko is a development agency. Our guides are research, and your counsel decides what the law requires for your business.
Does this make us compliant?
We cannot promise that. Controls and records support your position, but compliance depends on your facts, your contracts, and each regulator. We do not issue a certification.
Who is this for?
This work is for a SaaS or hosting platform that runs AI agents on systems that its customers use. It also fits a vendor that sells an AI scan product.
Do you run scans on our customers?
No. We test the controls on systems that you own or that you have written permission to test.
Can we start with a small scope?
Yes. A useful first scope is one agent, one environment, and one notice plan.
Legal research guides / 5 public articles
Read the law where you operate.
Each guide states the law as of November 3, 2026, and has an editable worksheet. The guides are research and not legal advice.
- EU lawWhen an AI security scan becomes an exploit: EU law
- UK lawWhen an AI security scan becomes an exploit: UK law
- Australian lawWhen an AI security scan becomes an exploit: Australian law
- US federal lawWhen an AI security scan becomes an exploit: US federal law
- US state lawWhen an AI security scan becomes an exploit: US state law
Your next project
Bring one security agent to the conversation
Describe what the agent does, what it can reach, and who reviews its results. We can use that to define the first project.