Digital workers need a compliance manager too
The Air Canada ruling, the AI Act after the omnibus, Gartner’s forecast and ISO 37301 applied to an agent.
AI agents, governed · New, October 2026
Somewhere in your business, probably this quarter, a piece of software is going to start emailing customers, answering them, booking meetings and making promises, all with your company’s name at the bottom. Our job is to settle three things before it does: what it may do, who answers for it, and what you could prove if it went wrong. We run compliance and quality systems for people. This is the same discipline, pointed at software.
Most of the firms we talk to are somewhere on the same road. Somebody has a chatbot on the website. Sales has a tool that drafts outreach. A vendor has been in with a demo of a digital worker that will chase the invoices and ring the leads, and the price looked reasonable. What nobody has done yet is write down what the thing is allowed to do, or who will read what it did last week.
That is the gap we work in. It is not a technology problem. The platforms are good and getting better, and in a well-run firm an agent can be easier to govern than a tired human, because it writes down everything it does. The problem is that nobody in the building owns it. The managing director signed the contract and assumed IT had it. IT set up the integration and assumed sales had it. The compliance officer heard about it from a customer complaint.
What we do about it is deliberately unglamorous. We take the agent through the same questions we would ask about any new role, because ISO 37301, which is the standard our compliance work is built on, has never cared who fills a role. Which obligations does the job touch. Who, by name, is accountable for it. What stops it going wrong, and how would you know. And on the day a customer disputes what it promised, what do you put in front of the tribunal. We write the answers down and leave you with the file Air Canada did not have when its chatbot case came up in front of the Civil Resolution Tribunal.The case, and the rules, in full →
The work comes in six pieces, and a thirty-person firm rarely needs all six at once. Most start with the job description and the ownership question, because those two are where the trouble usually is, and add the rest as the agent is given more to do. None of it requires new software. It requires a few pages that somebody has signed, and a diary entry that somebody keeps.
01
One page, signed by whoever owns compliance: what it may do alone, what it may only draft for a person to send, and what it must never touch.
02
Which laws and contracts the job touches. For a sales agent: PECR, the GDPR lawful basis for the data it works from, consumer law on the claims it makes, your own terms of business.
03
The things it may never say, the most it may ever offer, and the point at which a person has to read before anything goes out. Short enough to pin up.
04
A named person who reads a sample of the agent’s work on a set day and can switch it off without asking. The sample size, the log and the escalation route, designed and written into your register.
05
How the full conversation is kept, how the approved instructions are versioned and signed off, and how you would export all of it the day you changed vendor.
06
Article 50 of the AI Act (tell people they are dealing with AI, live since 2 August 2026), the Article 4 literacy duty, and the ICO’s expectations on automated processing. Aligned to ISO/IEC 42001 where that helps, without claiming a certificate you do not hold.
Mainly owner-managed and mid-sized firms in the UK, Malta and the wider EU that are about to buy an agent, or bought one last year and have a nagging feeling about it. Regulated sectors get the most out of it: insurance brokers, financial services, iGaming, care providers, anyone whose customers can take a complaint to an ombudsman. It is also for the compliance officer who has just found out that sales has had an AI assistant since March. We do not sell the agents and nobody who does pays us, which is rather the point.
One honest limit: we do not pick your platform. If you want us in the room for the demo, we will come, and we will bring the five vendor questions from the article that sits behind this page.
It starts, like everything we do, with a free half-hour call. You tell us what the agent is meant to do and where it is in the buying process, and we tell you whether this is a two-day job or a longer one, or whether you need us at all. Some firms do not. If the agent only drafts and a person sends everything, a careful hour with your own compliance officer may be enough, and we will say so.
Where it goes further, the first two days are the AI Agent Diagnostic, run under the same 8X Method as the rest of our work. The thing people are surprised by is how little of it is technical. Most of day one is spent with the people who will have to live with the agent, who tend to know already where it will embarrass the firm, and with the vendor contract, which tends to say less than the salesperson did.
Is this the same as the AI Act consulting I keep getting emails about. Not quite. Most of that is aimed at the high-risk category, which now starts in December 2027 and covers things like recruitment and credit scoring. A sales or support agent in a small firm is usually not high-risk. The duties that do apply to it already, telling people they are dealing with AI and supporting your staff’s AI literacy, are modest, and we fold them into the file rather than selling them as a project of their own.
Stefan’s doctoral research at Signum Magnum College is on how AI changes the work of leaders and managers, and what that means for quality and compliance. This page is where that research meets practice. See also AI in operations, for the AI that helps a person do a job rather than doing the job itself.
The Air Canada ruling, the AI Act after the omnibus, Gartner’s forecast and ISO 37301 applied to an agent.
Obligations and risk registers to ISO 37301 and ISO 31000, which this work plugs into.
Where AI earns its place, function by function, with the records and checks sorted first.
Where the weekly sample usually ends up living: part-time operations leadership.
What the regulation asks of a small jurisdiction, and of the firms inside it.
Tell us what the agent is meant to do, and we will come back on fit and scope.
What all our work is for
Leaders and managers who decide faster and on better information. You see it in margin, cash, complaints and the time work takes.
Each rule that applies to you has an owner, and the proof is on file, so managers are not firefighting.
The work is done the same way each time and checked, so managers can trust the figures they get.
The transparency duty in Article 50 has applied since 2 August 2026: people must be told they are dealing with an AI system. The AI literacy duty in Article 4 has applied since February 2025. The high-risk obligations now start on 2 December 2027 and mostly cover areas such as recruitment and credit, so a sales or support agent in a small firm is usually outside them.
The AI Act does not, unless your agent is used in the EU. UK GDPR, the Data (Use and Access) Act 2025 and consumer law do, and the ICO expects you to remain responsible for what your tools do with personal data. The Air Canada ruling is Canadian, but UK courts take the same view of a company and its tools.
No. We do not sell agents and nobody who does pays us. We will sit in on a vendor demo with you and ask the questions about logs, instruction changes, ceilings and exports, but the choice stays yours.
The free call is 30 minutes. The AI Agent Diagnostic is two days. Building the rest usually takes two to four weeks of part-time work on both sides, and then the agent runs draft-only for thirty days before it is let off the lead.
Then we start with the record. We find out what it has sent, to whom, and under what instructions, and we draft the job description and controls page from there. Most firms in that position are relieved to have a file within a fortnight.
Your next step
The free 30-minute call is the usual first step with us. Too early for a conversation? Run the founder health check on your own; you end up with a score out of 24 and the one area we would look at first.