C suite solutions. People, risk and sustainability
AI for People, Risk and Sustainability
Rules change monthly. Your evidence still lives in spreadsheets.
Five offices protect your company. A new rule arrives, legal interprets it, compliance writes the policy, HR trains the people, risk tests the controls and sustainability reports the result. Each office does its part. The obligation still slips through the gaps. We look at the whole chain and put agents exactly there.
The short answer
It takes on the reading, checking and evidence work these teams carry. Agents scan new rules and map them to obligations, review contracts, triage screening alerts, test controls on the full population, collect ESG data from source systems and answer employee questions.
The bigger gain shows up between teams. When legal, compliance, HR, risk and sustainability work from one register of obligations and one layer of evidence, nothing falls between them. Leadership and the board get one view instead of five.
The tension
Everyone in this group protects the company. But each office is measured on a different number, so each one guards its own part of the obligation.
Sustainability Office
Emissions and disclosure
Are we on our pathway, and can we prove it?
HR Office
Talent and skills
Do we have the people the strategy needs?
Legal Office
Exposure and cycle time
Are we protected, without slowing the business?
Compliance Office
Findings and coverage
Are we within the rules everywhere?
Risk Office
Risk within appetite
Do we see what could hurt us, in time?
Each number can look healthy while an obligation sits unowned between two offices. That gap is what regulators, auditors and journalists find first.
The obligation relay
This is how a rule really moves through a company, from the regulator’s website to the annual report. Watch the handoffs. That’s where obligations slip, evidence goes missing and cost piles up.
Leg 1
Rule
Legal Office
Leg 2
Policy
Compliance Office
Leg 3
People
HR Office
Leg 4
Controls
Risk and Compliance Offices
Leg 5
Evidence
All five offices
Leg 6
Report
Sustainability and Compliance Offices
Handoff 1
New rules read late
Guidance is published. Nobody maps it to what the company must change.
Agent. Scans new rules and maps each obligation to policies, controls and owners.
Handoff 2
Policies nobody reads
The policy is approved. Staff still don’t know what it means for them.
Agent. Answers policy questions in plain language and targets training by role.
Handoff 3
Controls tested on samples
A few cases are checked. The rest are assumed fine.
Agent. Tests the full population and flags real exceptions.
Handoff 4
Evidence chased by email
Before every audit, teams hunt for proof of what they did.
Agent. Collects evidence continuously as controls run.
Handoff 5
Reports built by hand
ESG and regulatory reports assembled from spreadsheets each cycle.
Agent. Pulls data from source with full lineage and drafts the disclosure.
The loop nobody closes. Lessons that never change the rules.
Audit findings, incidents, complaints and fines rarely flow back into the policy, the risk register or the training. So the same gap shows up next year. Agent. Findings agents link every finding to the obligation, policy and control behind it and track the fix.
Inside each office
Each office has its own canvas. Here’s the short version of each, with the three value leaks we’d look at first. The full canvas covers what the office runs and governs, its processes and its control tower.
Chief Sustainability Officer
Sustainability Office
Deliver the targets and report them with the rigour of the financials.
Office page live
Explore the Sustainability Office →
Where value leaks
Data collected in spreadsheets
Capture, checks and KPIs straight from source systems
Scope 3 on estimates
Supplier data agents collect and check primary data
Assurance gaps
Full lineage from source document to disclosure
Measured on
Emissions against target, CSRD and ISSB compliance, ESG ratings and assurance readiness.
Control tower
Emissions against pathway
Primary data share
Open assurance points
Chief Human Resources Officer
HR Office
Attract, develop and keep the people the strategy needs, through AI adoption.
Office page live
Explore the HR Office →
Where value leaks
HR service tickets
Employee service agents resolve routine requests
Skills gaps unknown
A skills map built from real work data
Slow hiring
Screening and scheduling agents, with a person making every decision
Measured on
Time to hire, regretted attrition, engagement, skills coverage and AI adoption.
Control tower
Time to hire
Regretted attrition
Skills coverage
General Counsel
Legal Office
Protect the company, enable deals and manage disputes at sensible cost.
Office page live
Explore the Legal Office →
Where value leaks
Contract review queue
Clause extraction and playbook review agents
Missed obligations
Every contract obligation tracked with its owner
Outside counsel bills
Every invoice line checked against agreed terms
Measured on
Contract cycle time, outside counsel spend, litigation exposure and regulatory findings.
Control tower
Contract cycle time
Outside counsel spend
Obligations due
Chief Compliance Officer
Compliance Office
Keep the company within the rules of every market, and prove it.
Office page live
Explore the Compliance Office →
Where value leaks
Screening false positives
Low risk alerts closed with the evidence attached
Regulatory mapping by hand
Every rule linked to policies and controls
KYC refresh backlog
Documents gathered, checked and reviews drafted
Measured on
Findings and fines, control coverage, time to implement change and false positives.
Control tower
Open findings
Alert backlog
AI systems classified
Chief Risk Officer
Risk Office
See enterprise, credit and operational risk in time to act on it.
Office page live
Explore the Risk Office →
Where value leaks
Risks spotted late
Risk sensing across news, data and operations
Controls tested on samples
Full population testing
Scenarios built by hand
Stress tests run in days, not weeks
Measured on
Risk within appetite, losses, control effectiveness and time to report.
Control tower
Top risks
Control effectiveness
Risk appetite use
Agents that work across offices
The biggest wins in this group come from shared foundations. One register of what the company must do, and one layer of proof that it did it.
Legal
Compliance
Risk
One obligation register
Every rule, contract duty and policy linked to its controls, owners and deadlines.
Compliance
Risk
Sustainability
One evidence layer
Proof collected as work happens, ready for auditors, regulators and assurance providers.
HR
Legal
Compliance
People and AI policy
AI literacy by role, rules for AI in HR decisions and policy answers for every employee.
All five
A protection control tower
One view of obligations, risks, people and disclosures for the board and the audit committee.
All of this runs on one enterprise AI platform, Cortex, which plugs into your HR, legal, GRC and ESG systems. Every office builds on the same foundation and the same controls.
What the board would open before every audit committee
Illustrative
People, risk and sustainability control tower
Sample data to show the view. Not client results.
Rule changes
23
In flight
Legal and Compliance
Tested in full
78%
▲ from 12%
Risk and Compliance
Open findings
11
2 overdue
Compliance Office
Emissions
+3%
Above pathway
Sustainability Office
Scope 3 primary
34%
▲ from 9%
Sustainability Office
Attrition
6.2%
▼ 1.1 pts
HR Office
From obligation to evidence
Obligations
412
With a policy
371
With a control
318
Tested
247
Evidence ready
229
Handoff alerts this week
New AML guidance affects 14 obligations, 6 without an owner
Handoff 1. Rule to policy
Remote work policy questions up 3x since the update
Handoff 2. Policy to people
Expense control failing in two entities, found in full testing
Handoff 3. People to controls
Energy data for four sites missing for the quarterly report
Handoff 5. Evidence to report
Illustrative example. Figures are invented to show how the view works. In discovery we build it on your own data and KPIs.
Your industry changes the relay
The relay is the same everywhere. Where the obligations come from, and where they slip, is not. Here’s where the pressure sits in the industries we work in, and the handoff we’d look at first.
CPG
Packaging, product claims and Scope 3
Evidence to report
Supplier emissions data and claims checks
FMCG
Product safety, labelling and many markets
Rule to policy
Regulatory scanning across markets
Retail
Consumer law, supply chain due diligence and staff turnover
Policy to people
Employee policy answers and HR service agents
D2C
Consumer rights, privacy and green claims
Rule to policy
Claims review and privacy obligation tracking
Automotive
Product compliance, supply chain and emissions
Evidence to report
Supplier data collection and product obligation tracking
Healthcare
Patient safety, privacy and clinical staff shortages
Policy to people
Skills mapping and policy answers for staff
Energy
Transition targets, NIS2 and permits
Evidence to report
ESG data from operational systems
Manufacturing
Safety, emissions and supplier due diligence
People to controls
Full population control testing and supplier checks
Logistics
Customs, transport emissions and sanctions
Controls to evidence
Sanctions screening triage and emissions data
BFSI
AML, DORA, consumer duty and model risk
Rule to policy
Regulatory mapping and alert triage
B2B technology
Privacy, customer audits and AI rules
Controls to evidence
Evidence collection and questionnaire answering
The rules are changing
EU AI Act, Annex III
High risk rules apply to AI used in hiring, promotion and managing people, under the Digital Omnibus
Regulation 2026/1744
Sustainability reporting
Sustainability data reported and assured with the same rigour as the financials
Scope and timing depend on your company
Already in force
Third party, incident reporting and resilience rules for financial services and critical sectors
Applies to suppliers too
Your intervention map
Bring your HR, legal, compliance, risk and sustainability leaders and the finding you never want to see again. We bring the canvases. In one session we map your relay and mark where agents would pay back first.
01
Your office canvases
The offices in your obligation relay, mapped to how your teams really work.
02
Your value chain
Your relay placed on your industry and company, with the rules and systems behind each leg.
03
Your intervention points
Each handoff leak with an agent design, its controls and the KPI it moves. Delivered as a mind map, an architecture view or an interactive dashboard.
AI for people, risk and sustainability, answered
What can AI do for HR, legal, compliance, risk and sustainability teams?
Agentic AI takes on the reading, checking and evidence work these teams carry. Agents scan new rules and map them to obligations, review contracts, triage screening alerts, test controls on the full population, collect ESG data from source systems and answer employee questions. Leaders get one view of obligations and risk instead of five separate registers.
How can AI help with regulatory change?
Regulatory scanning agents read new rules and guidance as they’re published, extract the obligations, and map each one to the policies, controls and owners it affects. Legal and compliance review the mapping. Changes that took months to track are visible within days.
Can AI cut compliance cost without adding risk?
Yes, because it increases coverage at the same time. Testing agents check the full population of transactions instead of a sample, and triage agents close low risk alerts with the evidence attached. Your team spends its time on the real exceptions, and the evidence trail gets stronger.
Can AI help with CSRD and ESG reporting?
Yes. ESG data agents capture and check data from ERP, energy, travel and supplier systems, calculate KPIs and keep the lineage from source to disclosure. Supplier data agents collect primary Scope 3 data. Reporting cycles get shorter and assurance gets easier.
Is AI used in HR high risk under the EU AI Act?
AI used for recruitment, promotion, task allocation or performance decisions falls under the high risk category in Annex III. Under the Digital Omnibus, those obligations apply from 2 December 2027. That means risk management, human oversight, documentation and logging for every such system.
Does this work with our HR, GRC and legal systems?
Yes. Agents work with Workday, SAP SuccessFactors, ServiceNow, Archer, OneTrust, MetricStream, contract management systems and your document stores. Nothing needs replacing to start.
