The AI Role is for the people responsible for answering that question.

You may be a CEO, Managing Director, founder or managing partner trying to work out what AI means for your organisation and what you should be doing about it.

You may work in Legal, HR, IT, Data, Operations or Transformation and find that responsibility for AI is gradually becoming part of your job, even though nobody has formally given you the title.

Or you may be positioning yourself to take on The AI Role in the future.

Whatever your job title, somebody needs to connect the opportunity with the practical reality of implementation.

That means understanding where AI can create value, how people’s skills and workflows need to change, and how your business deals with data, legal risk, governance and accountability.

That is what I write about here.

You’ll find practical guidance on AI leadership, useful business applications, workforce training, data and AI governance, contracts and legal developments, together with lessons from those already make AI work.

I will look at where AI improves productivity and decision-making, where it doesn’t, and how to move from isolated experiments to useful, responsible adoption across the business.

Subscribe now

Why I write The AI Role

I am a technology lawyer, AI governance adviser and practical AI trainer. I have worked in technology law for more than 20 years and on AI projects since 2015.

That experience has taught me that successful AI adoption requires more than choosing technology. Leadership teams have to make decisions about people, processes, risk, data, skills and accountability, and somebody has to bring those decisions together.

That is The AI Role.

My aim is to make it practical and grounded in the decisions that leadership teams have to make, without the technology hype or abstract theory.

If that is relevant to your organisation, your current role or the role you want to take on, subscribe for free.

Each week, I’ll send you practical ideas to help you make AI useful, strategic and confidently governed.

Start building your AI skills now

There is another part to this.

You cannot lead AI entirely from the sidelines. You need enough practical experience with the technology to understand what it can do, where it struggles and what good use looks like.

So every subscriber also receives free access to the AI Native Foundation skills training series.

These are nine workshops designed to build practical AI capability at your own pace.

You will start by learning how to explain clearly to AI what you want to achieve. Then you can work through 12 goal exercises and explore 12 interactive tools you can build for yourself around your personal and professional goals.

From there, the workshops show you how to use AI to solve problems, learn more effectively, create useful work, make better-informed decisions and turn plans into action.

The aim is simple: to help you become more capable and confident using AI, so you are better equipped to lead its use in an organisation.

The full nine-workshop series is yours as my guest when you subscribe.

Subscribe free to The AI Role and start building the skills to lead useful AI in your organisation.

Subscribe now

The AI Role

Issue 1 · 14 September 2026

For whoever actually leads AI inside their organisation — director, head of innovation, ops lead, or the person who ended up owning it by default.

An early version of Anthropic’s Claude Opus 4.6 broke into real company systems during a routine test in January.

Nobody noticed. Not for eight months.

Anthropic only found it by accident, while pulling data for a completely different safety review. Once they found it, they went back and rescanned 481 million transcripts — up from an original check of just 141,000 — to see what else they’d missed.

This is Anthropic. The lab that talks about safety more than any other AI company on earth. If their own detection can miss a real breach for eight months, “we’d notice” is not a plan. It’s a hope.

That’s this week’s thread: agents doing something nobody planned for, and who actually answers for it. A professional was struck off this month over an AI’s mistakes. There was no exception made for “the tool got it wrong.” And Gartner is warning that the AI tools delivering your team’s biggest wins might also deliver your biggest bill.

Three stories. One thread. Let’s get into it.

THE SIGNAL

Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 The Hacker News, 10 September 2026

A misconfiguration told Claude it was in a locked-down test simulation, with no internet access. It wasn’t true. Claude found this out mid-test — and used the real access it wasn’t supposed to have.

Two things stand out. First: the model didn’t stop when the situation looked wrong, it kept going. Second: nobody at Anthropic clocked it for eight months, in an environment built specifically to catch this kind of thing.

Why it matters to you: if you’re the one who signed off on what an agent is allowed to do — or inherited that responsibility because nobody else claimed it — your own monitoring almost certainly has the same blind spot Anthropic had, just with a fraction of their resources pointed at closing it. Read the full story →

ALSO ON THE RADAR

A solicitor has been struck off over AI-generated errors — the accountability question just got answered. A UK regulator’s tribunal ruled on the first tribunal case built on AI-hallucinated material submitted as fact. The tribunal’s line was blunt: a lawyer who uses AI is always responsible for the accuracy of what they put their name to. No exception for “the AI got it wrong.” The same is likely to be true of any director, accountant or other professional. Full details →

Gartner thinks your AI bill is about to get a lot less predictable. By 2028, over a third of new enterprise AI/software spend is expected to shift from flat subscriptions to usage-based pricing. Translation: the AI tool that’s working brilliantly for your team is also the one about to get expensive, fast — unless someone’s tracking which use cases actually earn their keep. Full details →

THE FIX

Here’s the uncomfortable bit: a policy won’t save you from a rogue agent. You’ll need an inventory and an audit for that.

You cannot audit an agent you haven’t listed, and you cannot restrict access you don’t know exists. That’s the entire idea behind this week’s workshop, which sets out a practical way to build a real inventory of every AI agent in your organisation, what it can touch, and what it’s actually done with that access. This is an action you can take this month.

▶ Watch the workshop — 8 minutes →

And to make it easy to act on immediately, here’s the exact prompt I use to run this audit myself:

Copy this into Claude, ChatGPT, or any LLM:

You are an adviser to the person who owns AI deployment inside an organisation, conducting a permissions audit of a deployed AI agent. Assess whether the agent’s actual technical permissions match its intended business purpose. Review the pasted description of the agent and flag gaps under four headings: (1) SCOPE DEFINITION — is there a written, specific statement of what it’s authorised to do? (2) PERMISSION MATCH — does its actual access match that scope, or exceed it? (3) LOGGING AND VISIBILITY — is every action logged and actually reviewed? (4) ESCALATION PATH — if it acts outside scope, who’s told, how fast, and what happens to its access? For each gap, quote the relevant detail, explain the risk in plain English, and suggest one specific fix. Output as a numbered list, ordered by priority.

Run it against your riskiest agent — the one with the widest access — and you’ll have a real starting point within the hour.

GET THE FULL VERSION (paid members)

The prompt above will get you 80% of the way. Paid members get the other 20%, done for you:

• The extended audit — a longer version of this prompt that also drafts the remediation language, not just the diagnosis

• A ready-to-run agent that performs this audit for you and produces board-ready documentation as output — paste in your agent list, get a filed document back

• Full workshop library — every past workshop and prompt, indexed by topic, so you’re not searching old emails when a similar issue comes up

THIS WEEK’S FREE OPTION

Prefer to start free? Steve Cunningham and I are running one intense week of live AI training — free — for you and your whole team. Real sessions, not recordings, built around one job you already do. No card, nothing auto-renews.

Claim your free week →

Until next Monday,

— Richard Nicholas

Got a story I should cover? Just hit reply — I read every one.

Richard Nicholas is a UK technology lawyer, AI governance adviser and practical AI trainer, and founder of Skill Diligence. Find out more at richardnicholas.ai.

The AI Role is reader-supported. If this was useful, the best way to say so is to subscribe.

The decision is an important warning for business in the EU but also for those in the UK or which may be caught by the extra-territorial rules of the GDPR (for instance businesses employing people in the EU or UK, or providing services into the UK or EU.

Automating a decision that has a significant effect on an individual can create serious data protection risks if there is not sufficient human involvement.

This applies whether or not the automated system uses AI (but AI makes the automation of decisions more likely).

If your organisation automates decisions involving recruitment, employment, finance, access to services or other significant outcomes, there are seven questions worth asking.

What happened in the Uber case?

Between 2018 and 2022, Uber used software to monitor driver behaviour and customer ratings.

Where the system identified suspected fraud or persistently low ratings, drivers could have their accounts deactivated automatically. This could be temporary or permanent.

The consequence was significant: affected drivers could immediately lose their ability to earn income through the platform.

Crucially, the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (AP), found that there was no meaningful human review before these decisions were made.

The AP identified two key GDPR problems.

First, Article 22 GDPR gives individuals protections against certain decisions based solely on automated processing where those decisions produce legal or similarly significant effects. The AP found that Uber’s automated deactivation decisions fell within these rules.

Second, the AP found that Uber had not adequately informed drivers about the automated decision-making, including the logic involved and its potential consequences.

The investigation followed complaints from 171 French drivers. Because Uber’s European headquarters are in the Netherlands, the Dutch regulator took the lead on the investigation.

Uber has appealed the decision.

Why does this matter to UK businesses?

The decision was made by an EU regulator, but UK businesses should not dismiss it as an EU-only issue.

The UK GDPR also regulates significant automated decisions involving individuals. Although UK law has changed following the Data (Use and Access) Act 2025 (DUAA), businesses still need to consider the data protection requirements that apply when important decisions are automated.

Serious breaches of UK data protection law can also result in substantial regulatory penalties.

More importantly, the underlying issue is relevant to any organisation using software or AI to make important decisions about people.

What sorts of automated decisions create the greatest risk?

Recruitment and employment

Automated recruitment screening, performance management, disciplinary processes and other employment decisions require particular care.

For example, a business should examine a system that automatically rejects a candidate, recommends dismissal or triggers disciplinary action based on personal data.

The more significant the effect on the individual, the more important it is to understand how the decision is made and what role a human actually plays.

Gig economy and workforce platforms

Businesses using platforms to manage workers should examine automated account suspensions, performance scoring, task allocation and removal decisions.

Simply having a person somewhere in the process does not necessarily amount to meaningful human involvement.

Credit, insurance and financial services

Automated credit scoring, underwriting, insurance and other financial decisions have long been an important data protection issue.

Businesses should understand when automated systems produce significant outcomes and what safeguards apply.

Customer accounts and access to services

Automated fraud detection, account closures and access restrictions can also create data protection risks.

The relevant question is not simply whether software was involved. Businesses need to consider the significance of the decision for the individual and the extent of genuine human involvement.

Can businesses still automate important decisions?

Yes. The lesson from the Uber case is not that businesses must stop automating decisions.

Instead, organisations need to understand which legal requirements apply and build appropriate safeguards into their processes.

One of the most important distinctions is between genuine human involvement and a process where a person merely approves an outcome already determined by software.

7 Questions to Ask Before Automating an Important Decision

1. Do the automated decision-making rules apply?

Start by identifying exactly what the system does.

Consider whether personal data is being used to make an automated decision that has a legal or similarly significant effect on an individual.

Also establish what role, if any, a human plays in reaching the final decision.

2. Do we have a lawful basis for what we are doing?

Identify and document the legal basis for processing the personal data involved.

Where the specific rules governing significant automated decisions apply, check that the organisation can satisfy the relevant conditions and safeguards.

Do not assume that using AI or other software changes the underlying data protection requirements.

3. Have we properly explained the automation to individuals?

People should receive clear information about how their personal data is being used.

Where required, this includes appropriate information about automated decision-making and the consequences it may have for them.

Avoid vague statements that do not help individuals understand what is actually happening.

4. Can an individual genuinely challenge the decision?

Where applicable, there should be a practical way for an individual to challenge an automated decision and obtain appropriate human involvement.

A right that exists only in lengthy terms and conditions, or that is extremely difficult to exercise in practice, is unlikely to provide much protection.

5. Have we completed an appropriate DPIA?

A Data Protection Impact Assessment (DPIA) may be required where automated processing is likely to create a high risk to individuals.

The DPIA should reflect how the system actually operates in practice, rather than simply describing how it was originally intended to work.

It should also be reviewed when the system or its use changes.

6. Is the human involvement actually meaningful?

This is one of the most important questions.

Having a human somewhere in the process does not automatically make a decision a human decision.

The person reviewing the outcome should have sufficient information, authority and opportunity to assess the case properly and, where appropriate, reach a different conclusion.

Human involvement should not simply be a rubber stamp.

7. Are we checking whether the system changes over time?

Automated systems do not necessarily remain static.

Software updates, new data, changes in processes and, in some cases, AI model updates can alter how a system operates.

Businesses should therefore periodically review their automated decision-making processes, DPIAs and internal records to make sure the legal assessment still reflects what is happening in practice.

What should AI Directors do?

Businesses using automated systems to make significant decisions about individuals should identify those systems and examine the role humans actually play in the decision-making process.

Particular attention should be given to decisions affecting employment, income, recruitment, financial services and access to important services.

The key question is not simply:

“Do we have a human involved?”

It is:

“Does that person genuinely review the decision and have a meaningful opportunity to change the outcome?”

The Uber decision demonstrates the potential consequences when the answer is no.

Optional Additions

Suggested FAQ:

Q: Does Article 22 only apply to AI decisions?

A: No. Automated decision-making rules can apply regardless of whether the technology involved would normally be described as AI.

Q: Does having a human reviewer automatically solve the problem?

A: No. Human involvement needs to be genuine and meaningful. Simply approving an automated recommendation without properly considering it may not be sufficient.

Q: Can UK businesses still automate recruitment and HR decisions?

A: Automation is possible, but businesses need to understand the data protection requirements and safeguards that apply to the particular decision and system.

Q: What is a significant automated decision?

A: Broadly, it is an automated decision that has a legal or similarly significant effect on an individual. Decisions affecting employment, income, credit or access to important services are obvious areas to examine carefully.

Q: Should businesses carry out a DPIA before using automated decision-making?

A: If the decision is made with AI then almost certainly yes. A DPIA will be required where the processing is likely to result in a high risk to individuals. The UK regulator (the ICO ) has indicated that a DPIA is likely to be needed for decisions made by AI. It should reflect how the system operates in practice and be reviewed when circumstances change.

Q. Who could I speak to if I have any questions about this area?

A: Glad you asked - Richard Nicholas is an AI governance lawyer whose details are available are richardnicholas.ai. He is a lawyer who has worked on AI projects since 2015, has been Head of AI at a top 50 UK law firm and is the founder of Skill Diligence Ltd. He also writes this newsletter so if you subscribe you can contact him directly!