There is a particular kind of review every transformation program prepares for. It has a date. It has a template. It has a steering committee that knows what it is going to say before it convenes, because the metrics it will read were chosen, two years earlier, by the people now being measured. Adoption against target. Tickets inside SLA. Uptime. The post-implementation review is the examination the organization sets for itself, and like most examinations a body sets for itself, it tends to be passed.
This summer, a different kind of review arrives. Nobody on the inside scheduled it. Its date was set by a parliament. Its template was written by a regulator. And it will ask the organization questions the internal review was never designed to ask.
On the seventh of June, the European Union's Pay Transparency Directive falls due for transposition across all twenty-seven member states. The European Commission confirmed in December that it would grant no postponements; the deadline is firm. What is not firm is the readiness underneath it. Twenty-three of the twenty-seven have active legislation in progress. Four show no documented government action at all. Several — the Netherlands, Sweden — have signaled delay, with Sweden going so far as to seek a renegotiation of the directive itself. One deadline, applied uniformly, sitting on top of preparation that was never uniform. The pattern should feel familiar to anyone who has lived through a go-live: the date is met on paper, and the question of whether anything underneath it is actually sound goes politely unasked.
Across the Atlantic, the same season produced the opposite failure. Colorado's Artificial Intelligence Act — the most comprehensive state law in the country governing AI in employment decisions — was set to take effect on the thirtieth of June. Six weeks before that date, a federal court stayed its enforcement. State lawmakers passed a narrower replacement, pushed out to January 2027. An organization that had spent the spring building toward the June thirtieth requirement discovered that the requirement had moved. Texas defines algorithmic discrimination one way, Illinois another, New York City a third. And over the top of all of it, a federal administration is pressing for a national framework that would preempt the states entirely.
And then, on the twenty-fifth of May, from a quarter no operating model anticipated, Pope Leo XIV issued a forty-two-thousand-word encyclical placing artificial intelligence and the dignity of work at the center of the Church's social teaching. He warned that rapid automation risked leaving people in what he called forced inactivity. He was specific about what is not enough: "It is not enough to invoke ethics in the abstract; robust legal frameworks, independent oversight, informed users and a political system that does not abdicate its responsibility are required."
Four arrivals. A firm European deadline with uneven ground beneath it. A collapsed American law that proved the ground itself can move. A patchwork that refuses to resolve into a single rule. And a moral intervention, at the highest possible altitude, insisting that the abstract is insufficient. None of them was on anyone's project plan. All of them are reviewing the organization right now.
What the unscheduled review counts
The reason the internal review passes and the external one is feared is not that one is rigorous and the other is lax. It is that they count different things. The post-implementation review counts what the system did. The unscheduled review counts whether the organization can account for what it did to people.
Strip the four arrivals of their specifics — the thresholds, the jurisdictions, the filing dates — and a single question stands underneath all of them. Can you explain and justify the decisions your organization makes about people? Pay transparency asks it of compensation: can your job architecture account for why two people in the same work are paid differently? The AI Act and its American cousins ask it of automated decisions: when a system declined a candidate, ended a contract, or routed someone away from a promotion, can you reconstruct why? The encyclical asks it of the whole arrangement: when you redesigned the work, did the human person survive the redesign, or merely the workflow?
This is the question the post-implementation review was built not to ask. It is, almost exactly, what the ledger doesn't count. And it is the question every one of these regulations is a different surface of.
That observation has a practical consequence that most organizations miss, and it is the reason they keep scrambling.
The mistake is spending the compliance budget on compliance
Here is a thing practitioners know and rarely say plainly: compliance is what frees the money. When a transformation is justified as value creation, the budget moves slowly and is interrogated at every step. When the same work is named as regulatory risk — particularly in a portfolio company, where exposure is a number on a deal model — the check is signed. Risk is the most reliable funding mechanism the function has. Compliance, named as risk, opens the door that "better adoption" could not.
Which produces the trap. The organization, having unlocked the budget by naming compliance, then spends the budget on compliance. It buys the audit, files the report, meets the date, and changes nothing structural. The pay-gap report is produced; the architecture that made the gap remains. The bias assessment is filed; the system that required assessing is untouched. The deadline is satisfied and the underlying question — can you account for how you treat people? — is exactly as unanswerable on the eighth of June as it was on the sixth. So the next regulation arrives and finds the same gap, and the organization pays to close it a second time, having closed it the first time only on paper. It pays for the same gap twice.
The move that breaks the cycle is unglamorous and almost never taken. Fund through the deadline; architect to the question. The compliance trigger is legitimate and the budget it frees is real — so use that budget to build the thing underneath the requirement rather than the requirement itself. Build the capacity to explain a pay band, not the report that discloses it. Build the capacity to reconstruct an automated decision, not the assessment that this quarter's auditor will accept. You get the scare-budget once per cycle. Spent on theater, it buys you until the next deadline. Spent on architecture, it means the next deadline finds you already sound — and the one after that.
You cannot project-manage a moving target
There is a reason this has to be built as a standing capability rather than a project, and Colorado is the proof. An organization that ran its compliance as a project — scoped to the June thirtieth effective date, resourced to hit it, scheduled to wind down afterward — watched the date relocate to January 2027 and the requirements change shape underneath it. The project had a target. The target moved. This is not an anomaly of one state's politics. In the age of AI, the cadence of regulation is now faster than the cadence of any project cycle, and it will keep moving, because the technology it is chasing keeps moving.
What does not move is the question. And a standing capacity to answer it — a place in the organization where can we explain this decision about a person? is always answerable — satisfies every version of the requirement at once. Notice that the EU AI Act's human-in-the-loop, Colorado's human-review-and-reconsideration, and the Pope's call for independent oversight are not three different demands. They are one demand, described by three authors. Build the standing function once and you have met all of them, and the next several besides, without standing up a fresh project each time the parliament moves.
This is the difference between an organization that anticipates and one that scrambles. The scrambling organization treats each law as a new event. The anticipating one understands that the law is a lagging indicator — a late codification of a demand that was legible years earlier in litigation, in public sentiment, in the questions candidates and employees had already begun to ask. Pay transparency did not appear from nowhere in 2026; the demand was visible for a decade. The organizations that were not surprised by it were not better lawyers. They were better readers of the leading signal.
And the leading signal has just been crystallized, in public, at an altitude no operating model can ignore. When the dignity of work under automation becomes the subject of a papal encyclical, the question has left the IT steering committee. It has become a matter the culture is now watching. You do not have to share the faith to read the instrument. The encyclical is not a regulation. It is the clearest available reading of where the regulations are going — because it names the demand the regulations are slowly catching up to.
The question to carry into the room
If there is one thing to take from all of this and keep, it is not a checklist. Checklists expire the moment the statute is amended. It is a question, and it is the question to ask of any decision the organization makes about a person:
If a regulator, a journalist, or the person themselves asked us to justify this — could we, today?
Wherever the answer is no, that is the gap. It is the gap the pay-transparency report will expose, the gap the AI audit will find, the gap the next law — whichever jurisdiction writes it — will land on. It is also, and this is the part the compliance frame obscures, a question about dignity before it is a question about law. To be able to account for how you treated someone is the minimum form of taking them seriously. The encyclical's word for the failure to do so is forced inactivity — people moved aside by systems no one will explain to them. The regulator's word for it is liability. They are describing the same thing from different ends.
The transformation industry has a rich vocabulary for what an organization gains when it modernizes. It has almost none for what it owes the people the modernization moves. The unscheduled review is the moment the bill for that second thing comes due. The organizations that have been architecting to the question rather than to the deadline will find the review counts in their favor. The rest will pass it on paper, the way they passed the last one, and will not understand why something still feels wrong on the eighth of June.
The work after go-live was always this work. The regulation simply set a date for it.
Clover & Myrtle is a vendor-independent HR transformation practice. The work the industry forgets — after go-live, and underneath the deadline.
cloverandmyrtle.com/journal