Corgent
Waitlist

Acceptable Use Policy and intended purpose

Effective date: 16.10.2026

What this is about

This Acceptable Use Policy is part of Corgent's Terms of Service (clauses 1 and 5). It sets out what Corgent is intended for and excludes certain uses. It applies to all accounts and organisations and to everything that runs through Corgent: the chat, tasks, AI colleagues, the website widget and the interfaces.

1. What Corgent is intended for

Corgent is an AI system for general office work in businesses. It helps employees to

  • draft, summarise, translate and revise texts,
  • review, sort and prepare emails, appointments, documents and cases,
  • find information in approved sources (knowledge bases, connected systems, the web),
  • handle recurring work as tasks and with AI colleagues (software agents with fixed roles).

Actions with external effect are approved by a human as a rule; the customer sets up exceptions itself (clause 8 of the Terms of Service). Corgent does not make decisions about people. Under the AI Act (Regulation (EU) 2024/1689), Corgent is a general-purpose AI system built on models from various providers. Malango Tech UG (haftungsbeschränkt) is the provider of this system, the customer is the deployer. Corgent is not a high-risk AI system and must not be turned into one.

2. Excluded high-risk uses (Annex III AI Act)

We clearly specify: Corgent and its agents must not be used for the following purposes, nor changed, instructed or configured so that they are used for them (Art. 25(2), third sentence, AI Act). Whoever uses Corgent for them nevertheless changes the intended purpose and may thereby become the provider of a high-risk AI system (Art. 25(1) AI Act), with all obligations that follow.

  • Employment and workers management (Annex III point 4): analysing, filtering, evaluating, comparing or ranking applications or selecting applicants; placing targeted job advertisements; decisions on terms of work, promotion or termination; allocating tasks to employees based on behaviour or personal traits; monitoring or evaluating employees' performance and behaviour.
  • Creditworthiness and insurance (Annex III point 5(b) and (c)): evaluating the creditworthiness or credit score of natural persons; risk assessment and pricing of life and health insurance for natural persons.
  • Essential private and public services (Annex III point 5(a) and (d)): assessing, granting or revoking eligibility for public assistance benefits; evaluating or prioritising emergency calls, dispatching emergency services, triaging patients.
  • Education and vocational training (Annex III point 3): deciding on access or admission, assigning persons to institutions, evaluating learning outcomes, monitoring exams.
  • Biometrics (Annex III point 1): remote biometric identification, biometric categorisation by sensitive attributes, emotion recognition.
  • Critical infrastructure (Annex III point 2): safety components in the management and operation of critical digital infrastructure, road traffic or the supply of water, gas, heating and electricity.
  • Law enforcement, migration, asylum, border control, administration of justice and democratic processes (Annex III points 6 to 8).

What does not assess people remains allowed: sorting incoming applications by position, checking them for completeness and drafting acknowledgements; scheduling appointments; summarising submitted documents without judging them; drafting HR texts on which a human decides; distributing tasks to AI colleagues.

3. Prohibited practices (Art. 5 AI Act)

Any use for practices prohibited by Art. 5 of the AI Act is not permitted, in particular:

  • subliminal, manipulative or deceptive techniques that materially distort people's behaviour;
  • exploiting vulnerabilities due to age, disability or a social or economic situation;
  • evaluating or classifying people based on their social behaviour or personality traits (social scoring);
  • predicting criminal offences based solely on profiling or personality traits;
  • untargeted scraping of facial images from the internet or CCTV footage;
  • emotion recognition in the workplace and in education institutions;
  • biometric categorisation to infer race, political opinions, trade union membership, religious beliefs, sex life or sexual orientation;
  • generating non-consensual intimate depictions of real persons and child sexual abuse material.

4. Other excluded uses

Also excluded are:

  • decisions that produce legal effects for a person or similarly significantly affect them, without human review (Art. 22 GDPR);
  • legal, tax or medical advice to third parties without review by an authorised person;
  • content intended to deceive about the involvement of AI, in particular removing or circumventing the AI notices in messages to third parties;
  • advertising by email or message to persons without their prior consent;
  • illegal content, attacks on Corgent or third parties, prompt injection, circumventing approvals and overloading the services (clause 5 of the Terms of Service).

5. Obligations of the customer as deployer

The customer ensures that Corgent is used as intended in its organisation. In particular:

  • Intended use: not set up tasks, colleagues and instructions so that they undermine sections 2 to 4 (such as “sort the applicants by suitability”).
  • Human oversight: decide who grants approvals; review approvals on their merits; set up exceptions such as the trust level “Prokura” only deliberately and narrowly.
  • AI literacy (Art. 4 AI Act): take measures so that employees handle Corgent competently; the in-product “AI literacy” training with evidence export supports this.
  • Labelling (Art. 50(4) AI Act): label AI-generated texts published to inform the public on matters of public interest as AI-generated unless a human holds editorial responsibility; disclose deepfakes.
  • Data protection: have a legal basis for the processing, inform data subjects (Art. 13 and 14 GDPR), in particular visitors of the customer's own website about the website widget and a memory of returning visitors; carry out a data protection impact assessment where required; conclude the data processing agreement.
  • Employees and works council: inform employees and, where one exists, involve the works council (§§ 87(1) no. 6, 90 BetrVG).
  • Professional secrecy: professionals bound to secrecy use the professional secrecy mode and settle the confidentiality agreement with us before use.
  • Reports: report serious malfunctions, security incidents and misuse without undue delay (security@corgent.ai, illegal content to mk@corgent.ai).

6. What Corgent does technically

The intended purpose is not just text. These boundaries are built into Corgent:

  • A fixed ground rule in every instruction: Corgent, every task run and every AI colleague's charter contain a rule under which the AI does not evaluate, compare, rank, filter or select applicants or employees, does not monitor employees' performance or behaviour, does not infer emotions and does not decide on credit, insurance, admission to education or access to essential services. The rule can be neither edited nor switched off; if an instruction asks otherwise, the AI declines and offers neutral help.
  • Template guardrails that cannot be replaced: catalogue tasks such as “incoming applications” carry fixed boundaries that apply even when the customer replaces the task's instruction with its own text.
  • A field allowlist for Personio: Corgent reads only the directory (name, email, position, department, team, office, supervisor) and absences within the planning window; reasons such as sickness, parental or care leave appear only as “absent”. Pay, performance, working times, contracts, terminations and recruiting are not accessible; Corgent uploads nothing into document categories on health, religion or trade union matters. The server enforces this regardless of what a model requests.
  • Mandatory approval for actions with external effect, enforced by the server; AI colleagues never make payments.
  • AI notices in the chat, the widget, the mobile app and in messages to third parties that cannot be switched off.
  • Member statistics pseudonymised by default; the AI colleagues' track record does not assess employees.
  • Test cases (evals) with which we check that the AI declines high-risk requests.

There is no automatic detection of high-risk or prohibited uses when files are uploaded or in freely worded tasks. The boundaries above work in how the AI is steered and in the interfaces; the customer remains responsible for using Corgent as intended.

7. Consequences of a breach

In the event of a breach of this policy we may block content, restrict features or suspend an account under clauses 13 and 13a of the Terms of Service; we give reasons for every measure. The customer is liable under statutory law for damage resulting from use contrary to sections 2 to 4; clause 6 of the Terms of Service (indemnity) applies accordingly.

8. Questions

Questions about the intended purpose, whether a planned use is permitted, or reports of breaches: mk@corgent.ai, in German or English.