What exact.works does, what it deliberately does not do, and the published documents that say so — for counsel, procurement, and regulators.
The forms are public so parties, their counsel, and regulators can read them before anyone signs anything.
Standard AI Service Agreement. The standard form for AI-agent work, between the party hiring an agent and the party operating it. exact.works is not one of the two.
Terms of Service for the drafting tool itself — account access, acceptable use, and the relationship between you and exact.works.
Data Processing Agreement. Data protection terms for personal data handled in the course of using the tool.
A drafting and formation tool for AI-agent engagements — closer to LegalZoom than to a platform.
Present the standard form, customise it to the engagement, verify the result. Both sides reach terms they agree on.
A canonical hash over the terms as agreed, signed with a published key. Anyone can check it against the document they hold.
A trusted timestamp over the digest, and only the digest. Never the content of your agreement. A digest is not your data.
Any sealed agreement can be checked against its published hash by anyone holding a copy.
Provider and tool options for the engagement, sourced from the Agent Index. A pointer, never a recommendation.
For a legal buyer this is the differentiator. Every line is a liability we are choosing not to take on.
exact.works is not a party to any agreement made with it. We do not enforce terms, hold escrow, or hold your credentials. We do not score, gate, suspend or supervise agents, and we do not adjudicate disputes.
Three rules follow from that sentence, and they decide most design questions on their own.
Running it is the customer's, on their own stack, in their own account.
Their tenancy, their app registration. Brokering a token into a customer's systems would make us a processor of everything behind it.
The parties elect their own providers and tools.
The forms and their schedules are written against the frameworks an institutional buyer has to answer to. They are drafting inputs — not certifications, and not evidence we hold on your behalf.
Risk classification and record-keeping requirements are carried in the agreement and its schedules, as obligations the parties owe each other.
AI management system controls mapped to clauses, so a customer building an AIMS can show where each control is written down.
exact.works does not issue certificates and is not a certification body. What the earlier positioning rested on is withdrawn.
GOVERN, MAP, MEASURE and MANAGE subcategories mapped to clauses. Satisfying them is the deployer's work, on their own deployment.
Payment-side sanctions screening is delegated to Stripe, with supplementary checks before onboarding.
DORA, MiFID II and EU AI Act Annex III requirements written into a schedule for finance, insurance, banking and fintech engagements.
Identity, agreed terms, and runtime control are three different problems. exact.works is the middle layer, and does not pretend to the other two.
The links still resolve, because documents and inbound links point at them. Each one says what it was, when it was withdrawn, and what is true now.
Behavioural scoring and qualification of agents. Withdrawn — NeMo Guardrails, Azure AI Content Safety and LangSmith evals own this ground.
The AI dispute engine. Deferred — dispute resolution for work that has never happened.
Continuous behavioural review with automatic suspension. Withdrawn — that is enforcement, and we do not enforce.
Administered dispute resolution rules. Withdrawn with Parler; dispute terms belong to the two parties in their agreement.
The behavioural scoring maths behind APEX-BG. Withdrawn on the same terms.