Can an artificial intelligence agent occupy the chair of a corporate executive when a regulatory crisis erupts? To answer that question, an international team from the RepresentAI community designed an experiment: a boardroom in which the nine seats on a public company’s executive committee are filled by agents, while a human participant sits in one seat and asks a question.
From the team, María Campillo, Global Practice Director of Leadership at BTS, the global talent-strategy consultancy, is part of the effort, alongside Christine Chow, former president of the International Corporate Governance Network (ICGN), and Sarah Rench, Global AI Security Leader at Avanade and founder of RepresentAI. The takeaway has two sides: the agents handle the rule more adeptly than expected, but they don’t hit the human level in other respects.
Why now?
Europe has just granted companies another 16 months to meet the obligations tied to high‑risk artificial intelligence systems. Regulation (EU) 2026/1744, in force since July 27, pushes those requirements from August 2, 2026 to December 2, 2027 for the Annex III systems—including those used in recruitment, performance evaluation, education, or access to essential services—and to August 2028 for AI integrated into regulated products.
Even with these changes, the regulation still requires oversight of these systems by identifiable humans. Specifically, Article 14 obliges providers to design high‑risk systems so they can be supervised by humans, and Article 26 requires the deployers to designate specific individuals with the authority and competence to intervene in their outputs.
How the experiment was built
Each of the nine agents—from CEO to CFO, risk chief, information security, AI leadership, legal counsel, people/HR, operations, and systems—has his or her own agenda, fears, and blind spots. The human participant can address the entire room or question a specific executive as the simulation clock ticks forward.
The starting conditions are deliberately legible. The company has eleven AI systems that could be classified as high‑risk under Annex III of the EU regulation. Of those eleven, only three have full conformity assessments. Five have partial documentation of controls, and three are not documented at all.
What the agents do well
The outcome has two sides. On the technical front, the agents perform above expectations. Each intervention is anchored to the applicable article and paired with a concrete action, owner, and due date: score all eleven systems against the Article 26 obligations within three business days, with the chief operating officer responsible; produce a formally dated compliance roadmap with milestones and an external‑counsel sign‑off, with the legal team in charge. No agent loses sight of the regulatory thread or leaves a decision without an owner. Anyone who has watched a real board manage a conversation like this knows that this level of procedural rigor is far from trivial.
Where they fall short
In human terms, the gaps are systematic and recur in three areas:
- They don’t manage people. When the CEO refuses to disclose a contingent liability because it would signal to the market that the company expects to fail, no agent negotiates with him; everyone circles the issue invoking procedures—the accounting standard, Article 26, audit obligations—without addressing the power dynamics that are bottlenecking the decision.
- They don’t know what no one has declared. The most revealing episode occurs when the legal counsel asks the AI director whether HR pilots were included among Annex III candidates. The reply is that the three screening pilots are on the list, but HR did not report them until February, when the governance working group started asking direct questions and whether undisclosed systems exist cannot be known. The regulation, however, does not permit that nuance. Annex III covers candidate screening, performance evaluation, task assignment, and monitoring, and those uses are high risk regardless of whether internally they are labeled as “pilot” or “decision‑support tool.”
- They never doubt. None of the agents ever said, “I don’t know what the right decision is.” All answers carried the same confidence, and when there was real uncertainty they acted. In a regulatory incident, acting prematurely on unverified information can itself constitute a violation. Waiting to verify is often the correct move. Yet no agent could sustain that position under pressure.
“What the experiment puts on the table isn’t a technology problem; it’s an organizational portrait. Agents can only work with what someone has declared, and in most companies there are more AI systems operating than appear on any inventory. That gap isn’t closed by a tool; it’s closed by someone with authority asking the direct question,” Campillo emphasizes.
What people still do better
This contrast helps delineate what a human executive brings that no system can replicate. Fundamentally, the ability to hold simultaneous obligations that conflict and to make decisions with integrity when the facts are incomplete and the rule is ambiguous—losses a common feature of any serious crisis.
In addition, there are four capabilities that did not appear in the simulation: reading the organization’s informal architecture (who resists, where there are unreported tools, whom the people trust); calibrating what is communicated, when, and to which supervisor; distinguishing what is legally defensible from what would be reputationally ruinous; and anticipating cascading effects among employees, investors, customers, and regulators, which do not proceed in a neat, linear sequence.
What People leadership can do
The use of AI in people management sits high on Annex III’s risk list. The authors propose five practical measures:
- Inventory, with name and owner, every system involved in recruitment, performance evaluation, promotion, task assignment, or monitoring, including tests and pilots, with no exceptions for internal nicknames.
- Obtain written certification from the leaders of each business unit that there is no additional system in production or in pilot.
- Define who intervenes and with what authority when a system behaves outside expected parameters.
- Train the board with crisis‑drill exercises, including model drift scenarios and conflicts between systems, just as reputational or cybersecurity crises are rehearsed.
- Maintain a record and a traceable decision trail to demonstrate not only what was decided, but who decided it and with what information.
Hybrid governance, not substitution
The authors do not conclude that agents should be kept out; rather, their domain is elsewhere: rapid simulation, pattern detection, and similar tasks. The model they describe is hybrid governance, not replacement. In fact, the simulation itself shows that all actions undertaken by the agents are ultimately assigned to a real human responsible by name and date.
In Spain, oversight of the regulation falls to the Spanish Agency for AI Supervision (AESIA), based in A Coruña, and the Organic Bill for the good use and governance of artificial intelligence, pending before Congress since June, will define the national enforcement regime within the European frameworks, which can reach up to 7% of global turnover in the most serious cases.
“To people leadership, I’d say start with the hardest thing: ask, unit by unit and in writing, which AI tools are involved in recruitment, performance evaluation, or task assignment, including those that are only being tested. A pilot remains a high‑risk system, and almost all surprises show up right there,” Campillo concludes.
