What the law will and will not do for you

A common response to the argument for a Chief Workforce Officer is that regulation will solve the problem. The European Union's AI Act, in force since 2024 and phasing in its obligations over the following years, places duties on organisations that deploy high-risk systems, including systems used in employment and in access to services. Liability rules are being revised. Surely, the argument goes, once the law requires accountability, accountability will exist.

I think this gets the relationship between law and organisation backwards, and the history of every previous compliance regime shows why.

Regulation assigns duties to a legal person: the company. It requires that there be oversight, that risks be assessed, that records be kept, that a human be able to intervene. It does not, and cannot, say which human. The law tells the organisation what must be true. The organisation has to decide who makes it true, and in the absence of that decision the duty is met on paper by a committee and in practice by no one. Anyone who has watched data-protection obligations land in a company without a data-protection officer, or safety obligations land without a safety function, knows the pattern: the regulation creates the requirement, the organisation creates a document, and the gap between them is discovered by an incident.

There is a second limitation. Regulation is written for the systems that exist when it is drafted, and classifies them by use. It will catch the recruitment agent, because employment is a named high-risk area. It is less clear that it catches the agent drafting customer responses, or the one that reorganises a team's workflow, or the forty others that a business unit subscribed to last quarter. The organisation's exposure runs across all of them. Its legal duties run across some. Governing to the legal boundary leaves the rest ungoverned, which is where the next failure will come from.

Third, the law moves slowly and the technology does not. By the time an obligation applies to a category of system, the systems in use have changed, often several times. An organisation whose only governance is compliance will always be governing last year's agents.

None of this is an argument against regulation. It is an argument that regulation presupposes something inside the organisation that it cannot itself create: a role that holds the duties, understands the work, and has the authority to act. For data protection that role became the data-protection officer. For safety it became the safety function. For the workforce of people and agents, it does not yet have a settled name, and I have been calling it the Chief Workforce Officer.

What would that role do with the law? Treat it as a floor, not a design. Maintain the register of agents that the law will eventually require and that the organisation needs anyway. Assign the named accountable human for every agent, including the ones the law does not reach, because the customer who gets the wrong answer does not check the regulation first. Keep the records of selection, deployment, evaluation and update that make it possible to answer a regulator's question, and, more importantly, to answer the board's. And watch the legal boundary move, so that the organisation is ahead of it rather than discovering it.

The law will tell you that someone must be responsible. It will not tell you who. That second question is the one that determines whether the first is answered, and it is the organisation's to decide.