Hiring the Machines

Companies believe they are buying AI tools. They are, in fact, onboarding a workforce — and few have written the rulebook.

When executives talk about artificial intelligence at work, they usually mean a copilot: a clever assistant an employee opens to draft an email, summarise a contract or debug a function. AI, in this telling, is a better tool — software you pick up and put down, like a spreadsheet with opinions. It is a comforting frame, because it changes nothing structural. The staff stay the same; they simply get faster.

That frame is breaking. The more useful analogy for what comes next is not software procurement. It is staffing.

The shift is visible in the numbers. Gartner expects 40% of enterprise applications to carry task-specific AI agents by the end of 2026, up from less than 5% a year earlier. Adoption is already near-universal in intent: in Omada’s survey of nearly 600 identity and security leaders at American enterprises, more than eight in ten organisations are using or piloting agentic AI, and security is the leading concern attached to it. Microsoft’s own telemetry, published in its 2026 Work Trend Index, shows active agents growing roughly fifteenfold year on year.

Two caveats matter, and both strengthen the argument rather than weaken it. Piloting is not production — the number of firms running agents at scale is far smaller than the number experimenting. And Gartner expects more than 40% of agentic-AI projects to be scrapped by 2027, undone less by weak models than by unclear value, runaway cost and thin governance. The bottleneck is not intelligence. It is control.

Which raises an awkward question no procurement form asks: who is managing them?

Consider what a human employee requires the moment they join. An identity and a badge. A defined set of things they may touch, and many they may not. A job description. A manager. A code of conduct. A record of what they did. And, eventually, an exit that revokes access on the way out. This machinery — dull, bureaucratic, indispensable — is roughly what an HR function, plus IT, exists to provide. It is how organisations manage the risk of distributing agency across many actors at once.

Agents need every item on that list. Most firms are granting them few of them. Non-human identities — the credentials that let software authenticate and act — now outnumber human ones by a wide margin; research cited in KPMG’s Cybersecurity Considerations 2026 puts the ratio above 80 to one, while Omada’s respondents more often report 50 to one or higher, with executives citing higher ratios than the practitioners actually running the systems. That gap is itself the finding: most organisations are underestimating their own scale.

Governance has not kept up. Omada found that credential practice for AI agents remains uneven, with static credentials and shared accounts still common — the machine equivalent of a shared master password. Accountability is typically spread across security, identity and DevOps teams, which in practice means no single function owns the estate. Sophos, surveying 5,000 IT and cybersecurity leaders across 17 countries, found 71% had suffered an identity-related breach in the past year, and two-thirds of ransomware victims traced the incident to their most serious identity attack. Every ungoverned agent is a colleague with system access, no supervisor and no file.

Call it the shadow workforce — the digital equivalent of hiring hundreds of contractors, handing each a master key, and keeping no record of who they are.

A department, not a memo

None of this is solved by a one-page AI policy circulated to staff. Human resources did not emerge because companies felt sentimental about people; it emerged because managing many workers at scale demanded a dedicated function — hiring standards, access rules, conduct policy, review, records and a clean way to show someone the door. A workforce that is increasingly machine will demand comparable discipline for its non-human members.

The vocabulary is already converging, if mostly in vendor marketing: Workday, which sells the software, urges clients to give agents job descriptions, security badges and probation periods, and to onboard them rather than merely install them. Discount the sales pitch and the underlying logic survives.

Boardrooms are noticing. Mercer’s Global Talent Trends 2026, drawing on roughly 12,000 executives, HR leaders, investors and employees, found 82% of C-suite leaders believe HR’s future lies in managing human talent and digital agents side by side. Gartner expects that by 2029 at least half of knowledge workers will need new skills to work with, govern or build agents. Caution is running alongside: KPMG’s quarterly AI pulse found 61% of US companies not yet comfortable with autonomous agents, requiring a human in the loop.

The most telling evidence is Microsoft’s. Testing 29 factors behind whether AI actually delivers value, its 2026 index found organisational conditions — culture, manager support, talent practices, clear rules for how people and AI work together — outweighed individual skill and mindset by roughly two to one. The constraint on returns is not the quality of the model or the enthusiasm of staff. It is the scaffolding around them.

That is why the discipline is a moat rather than a cost centre. A firm that can onboard an agent with a scoped identity, a defined mandate, an audit trail and an off-switch can deploy the next hundred with confidence — and, in regulated industries, prove to a supervisor that it has. A rival treating each agent as a bolted-on feature will stall at the pilot stage or discover its shadow workforce in an incident report. Trust compounds: the more safely you can grant autonomy, the more you can afford to grant.

AI as a tool an employee uses is not the destination; it is the on-ramp. The destination is a workforce part human and part software, held to compatible rules. That is a matter of quarters, not decades. Companies that start treating agents like employees now will hire at a speed their competitors cannot safely match. The rest will write the handbook after the incident, which is the one time it is too late.

Scale and govern your AI workforce

Contact us to explore our turnkey solutions.