What changed this week — and what it means

So what · Last week the question was which Workday agents to switch on; this week it is which agents, built by anyone, may touch your employee data. If you run Workday, the governance gap is now a window: the building blocks are live but the policy-checking layer is not due until early 2027. Before anyone in IT or a business unit builds a custom agent, decide who approves it, which data fields it may read or write, and who reviews its logs. Workday itself cites research showing models can misapply HR policy even when handed the right policy, so treat agent output on pay, leave and eligibility as something a person verifies until the checking layer ships. Ask your account team what these components cost to run and whether data accessed by third-party models is covered by your existing data-use terms.

So what · Two of the three largest HCM suites now sell task-level workforce planning, and both describe it as advice, not automation. Task-level data is only as good as the underlying skills data, so before you pilot either product, audit yours: how current is your skills inventory, who maintains it, and would employees recognise their own profile? The practical use is the redesign conversation SAP's survey points to: pick two or three roles where AI is already absorbing tasks and map which tasks stay human, which are augmented and what the remaining role is worth. Treat any "task disruption" score as a hypothesis to test with managers, and keep it out of individual performance or termination decisions, where California's SB 947 and the EU AI Act both apply scrutiny.

So what · The notable change is the Winston Interview agent: an AI that conducts candidate screening conversations is a different regulatory object from a ranking score, and it is the kind of tool that notice and audit rules in New York City, Illinois, California and Colorado were written for. If you run SuccessFactors or SmartRecruiters, ask SAP for the bias-testing documentation and the human-review controls for each hiring agent before enabling any, and ask which features are generally available versus early release. With no published metrics, run your own baseline: record time-to-shortlist and recruiter hours today so you can judge the agents against something real. Our applicant match comparison shows what to ask for on explainability and switch-off controls.

So what · The pattern is that AI sped up the top of the funnel and handed the cost to the middle: more applicants, less certainty, and recruiters rebuilding trust by hand. Measure that cost in your own team before buying another sourcing tool: track hours spent verifying candidates per hire and the share of AI-assisted shortlists that survive interviews. If verification is the bottleneck, the fix is structured assessment and credential checks early in the process, not a better resume parser. Satisfaction with tools falling 13 points in a year also gives you leverage at renewal, since a market where two-thirds of buyers are open to switching is one where vendors should be asked for outcome-based commitments.

So what · The court stay tempts a wait-and-see posture, and it is the wrong one: the law date has not moved and the rules that define what "compliant" means are being written this month. If you hire or manage in Colorado, ask counsel this week whether to file a comment before October 26, and get your tool inventory (what automated tools touch hiring, promotion, pay or discipline, and who owns each) in a state where you could answer a regulator's first question. One inventory serves Colorado, California's January 1 CCPA date, California's SB 947 and Connecticut's 2027 notices, so building it once is cheaper than four separate projects. Our analysis of the January 1, 2027 cliff covers the notice side.

So what · Employee monitoring, not hiring AI, is where European and Asia-Pacific regulators are acting now, and the UK proposal could make consultation with worker representatives a legal step before you roll out productivity or sentiment tooling. Inventory every monitoring feature in your HR, collaboration and security stack that touches employees outside the US, covering location, email, cameras, biometrics and any "engagement" scoring, and check each against local data-protection and works-council rules before the next renewal. Our EU AI Act article remains accurate on the December 2, 2027 high-risk date.