A short piece of fiction, written by API Evangelist. The reader is imagined; the post, and every number and quotation from it, is real: "Five Hundred Eighteen Companies Hire For Sarbanes-Oxley And One For The Colorado AI Act," Kin Lane, November 4, 2026, https://apievangelist.com/2026/11/04/five-hundred-eighteen-companies-hire-for-sarbanes-oxley-and-one-for-the-colorado-ai-act/
Priya works as a compliance analyst, and she read the post on a Wednesday afternoon with a half-eaten sandwich beside her keyboard. Her team had been passing around a draft job posting for weeks. It was for someone to help with AI oversight, and it had stalled on a question nobody wanted to answer: what, exactly, should the posting say?
The table stopped her first. Five hundred eighteen companies out of 984 name Sarbanes-Oxley in their postings. The Colorado AI Act appears in one. She checked the arithmetic herself, which was a habit, and it held. The post says it counts companies, not mentions, and she appreciated that. She had been burned by dashboards that blurred the two.
Then the part about how the old laws show up. The examples were plain, almost dull: "Full sox compliance." She laughed a little, because that was nearly word for word what her own current posting said. Nobody had ever written a paragraph of prose about Sarbanes-Oxley in a job ad. It was simply assumed, like the stapler.
The EU AI Act was where she felt uncomfortable. The post says that it "is being handed to the privacy and compliance people who already carry GDPR, not to a new AI governance team." Priya was one of those people. She did not feel handed a mandate. She felt handed a pile. Still, she could not argue with the pattern, and she suspected the author would shrug at her discomfort, since the post is about postings and says nothing about how anyone feels.
She also pushed back, a little, on the section about AI hiring racing ahead of AI regulation hiring. Seven companies without the regulation's name for every one with it sounded damning, but the post itself concedes that a lot of compliance work never names the law in a posting. She thought that caveat deserved more weight than the headline gave it. Her own team did plenty of work that no ad would ever mention. Then again, she admitted, that was exactly the problem her stalled draft was trying to solve.
What stayed with her was the closing logic. Regulation shows up in hiring once it becomes somebody's job to prove compliance to an auditor. She thought about her draft, which described the role in soft terms like responsible AI and stakeholder alignment. An auditor could not do anything with those words. The post also reminded her that these numbers are "Directions, not measurements," and she decided she could live with that. She was not trying to measure the market. She was trying to write one clear paragraph.
She did not rewrite the whole posting. She did not call a meeting. She opened the draft, found the line about AI oversight, and added a sentence naming the EU AI Act next to GDPR, in the same list where the post showed it usually sits. Then she sent the draft back to her manager with a single note saying the role should be able to point an auditor to something, and that this was a start.
She finished the sandwich and closed the tab.