AI compliance lead
The one who proves to an outsider that the rule is being kept
An AI compliance lead classifies their organisation’s uses by the risk the law assigns them and assembles what proves it, like an accountant keeping the paperwork ready before an audit.
- Floor 4The Organisation
- P1Writes the brief, reads the code
- Emerging titleIt appeared recently. What it covers is not yet stable from one employer to the next.
What they answer for
The deliverableA file that holds in front of a third party: classification of uses, evidence, a log of decisions. If they leave, the organisation can no longer demonstrate what it claims.
The profile
Five activities, scored 0 to 3- ResearchProducing knowledge that does not yet exist.
- BuildShipping a system that runs, deploys and breaks.
- OperateKeeping it in production: cost, incidents, drift, on-call.
- VerifyMeasuring, testing, attacking. Producing a verdict that holds.
- LeadDeciding, persuading, driving adoption, answering to others.
What the work is
A dated obligation
The trade has a date of birth, which is rare. The European AI regulation has required every deployer to ensure their staff’s AI literacy since February 2025, and its main deadline falls on 2 August 2026. An obligation looking for a post-holder creates a trade more reliably than a fashion does.
The real work
The real work is inventory work before it is legal work. You have to know what is running, what it decides, about whom, and on which data, in an organisation where nobody has ever kept that list. Classification by risk level comes afterwards, and it is the easy part.
The trap
The trap is believing that compliance protects. It documents. A correct classification of a badly designed use produces an impeccable file for a questionable decision, and that is exactly what governance should have prevented upstream. The two trades hold each other up, and neither replaces the other.
A week in the role
- Inventory: finding what is running, including what nobody declared.
- Classification by risk level, use by use and not tool by tool.
- Assembling evidence, which has to exist before anyone asks for it.
- Training, because staff literacy is an obligation and not an intention.
Ways in
- From compliance or law, learning enough of the technical side not to be told just anything.
- From data protection, where inventory and legal basis are already reflexes.
- What the role does not require: knowing how to program. It requires being able to read an architecture.
Reading an advert
2 signs- The advert talks about compliance and never mentions an inventory.
- That is where it all starts. An organisation that does not know what is running can classify nothing.
- The post has no direct line to the executive.
- A compliance function without access to the level that decides produces recommendations. That is not the same thing as a decision.