AI agents now do compliance busywork, so workers need new skills

AI agents are already doing a lot of routine compliance work, and workers in that field are being told to build new skills. Yair Kuznitsov, CEO of Anecdotes, makes the case in a BleepingComputer piece. He says agents now test controls, collect evidence and match company practices to rule frameworks. The jobs that last, he argues, belong to people who can direct those agents.

What changed

GRC stands for governance, risk and compliance. It is the work of proving a company follows laws, standards and its own rules. Kuznitsov says this used to fill a manager's week. Now agents do the task, and the human moves up a level to direct and oversee them. He calls this GRC Agentification. He also says agents improve every quarter.

Skill one: judge the data

An agent is only as good as what it is fed. Kuznitsov warns that screenshots, stale exports and a spreadsheet rebuilt at midnight can produce confident, nicely formatted nonsense. His advice is to trace one control's evidence back to its source, such as the system setting or data feed that produced it. The goal is to tell whether data is trustworthy or merely available.

Skill two: manage the agents

The old job was gathering evidence. The new one is governing the agents that gather it. Kuznitsov says to treat each agent like a direct report. Before it touches live systems, write down what good looks like. He lists these measures:

• The business outcome the agent owns
• The efficiency it adds
• The cost it takes out
• The accuracy bar it must clear
• The escalation rate, meaning how often it may hand a decision back to a person

Then watch those numbers. He says an agent that drifts, escalates everything, or hits its accuracy target by doing less is sending a signal.

Skill three: communicate clearly

Agents increasingly pass work to each other with no person in between. Kuznitsov says that without visibility, this becomes a liability nobody can explain. He recommends writing instructions so precise an agent cannot reasonably misread them, closer to a runbook than an email. He also wants every handoff between agents to leave a visible, time-stamped trail that a person can review.

How to read this

This is an opinion piece from the head of a company that sells GRC software, and it points readers to its product. The article gives no figures on how many jobs are changing or how fast. Still, the advice is practical and does not require buying anything. Kuznitsov says teams can start on all three skills this quarter with the program they already run.