Weekly Editorial, W40
Oracle put a count and a date on 25 agents, while SAP and HiBob let their own September deadlines pass without a word and a national security body said it could not reach Dayforce. The useful test of a vendor this week was whether it answers for what it said.
Theme 01
Three vendors had an agent date in late September and one security disclosure needed a reply. Only one of the four produced a statement a buyer could hold.
On 29 September Oracle announced Fusion Claw, a governed runtime for its agents, and said 25 new agentic applications were "available today", in a portfolio it counts at 75. Each run produces an Outcome Receipt recording the authority applied, the evidence used and the result. The release gave no price and no error rate.
The next day September ended. SAP's chief executive had told investors on 8 September the company would have "400, 200 now in September" agents. SAP's news feed closed the month without a count and has published nothing in October. Its HR conference opens on 5 October with no preview.
HiBob wrote on 16 September that its Galileo agents "will be available in Q3 2026." The quarter ended and its newest release is still that one, in the future tense. Neither absence proves a slip. A quiet on-time release looks the same from outside as a missed one.
Oracle's receipt says what an agent did on one run. It does not say how often runs go wrong. Added up, receipts become an error rate, and the customer holding them can do that sum before the vendor chooses to. Oracle has not published that total.
The sharpest test of answering came on 28 September. Poland's national computer emergency team published two critical flaws in Dayforce Payroll that need no login, one in password recovery, and stated that its attempts to contact the vendor were unsuccessful. Four days later the public records were unchanged and Dayforce had said nothing.
Every agent permission model announced in September assumes the login holds. A flaw beneath authentication sits under all of them. Whether a vendor publishes a security contact, and whether a coordinator gets a reply, is something a buyer can check before signing.
Theme 02
Two large vendors changed who does the work this week, in opposite directions, and a third chose to take a feed from the broker instead of owning the benefits.
On 1 October Gusto announced a professional employer organisation, due "in the coming months", and Gusto HR Partners, which gives an owner access to a senior HR leader who is a Gusto employee. A third product, Business Compliance, registers a business with state agencies when it hires in a new state, and is available to every customer now.
The aim is stated in the release: customers grow "without leaving the Gusto platform they already know." A growing small business has usually left self-serve payroll for a PEO at exactly this point. Gusto serves more than 500,000 US employers and gave no price for any of the three.
Most vendors here spent September announcing agents that act. Gusto announced a named human for terminations, hiring standards and benefits design. That is a different answer to who is accountable when advice is wrong, and vendors with service arms can sell it where software-only entrants cannot.
BambooHR took the other route the same day. It connected its payroll to Employee Navigator, the benefits platform used by 7,000 US brokers, so deductions set during enrolment arrive in the next pay run. BambooHR sells its own benefits administration. Here it leaves the choice with the broker and takes the data.
Workday moved in the opposite direction on people. A regulatory filing on 29 September disclosed a cut of about 2.5% of its workforce, "primarily within Workday's Product and Technology team", with charges of up to $80 million. Revenue guidance was held. The filing attributes nothing to AI.
The reduction falls on the organisation that builds the product, two weeks before the customer conference on 12 October. Workday says it will keep hiring in "key strategic areas", so this is a change in who builds as much as how many. Customers will see it, if at all, in release cadence.
Theme 03
Two new rules and one funding round point the same way: the people an employer answers for are increasingly not the ones on its employee record.
On 1 October UK right-to-work liability reached contractors and subcontractors. The Home Office's final code extends the scheme to workers, individual subcontractors and online matching services, at £60,000 per worker for a repeat breach. A business can be treated as the employer of someone supplied through a contracting chain, or sent under a substitution clause.
The code limits penalties to engagements that begin on or after 1 October. That sets the size of the job: a check when a contractor is taken on, not a review of everyone on site. Most HR systems hold this evidence on the employee record. A subcontractor usually sits in a supplier ledger, where no check is designed in.
The EU's new social security rules, adopted on 28 September, require employers to notify and request a certificate before a posted worker starts. Assignments of three days or fewer are exempt in every sector except construction. The UK rule lands hardest on labour-only subcontractors. Both treat the building site as the place the old record fails.
The EU regulation also sets clocks. A posting to one member state is capped at 24 months, a worker recruited to be posted needs three months of prior cover, and multi-state workers are reassessed every two years. The posting articles apply two years after the text enters into force, which is unlikely before late 2028.
Miter, which sells payroll to US contractors, raised $40 million on 30 September and said it pays roughly two in every hundred American construction workers. Its argument is that labour data, who worked on which job and cost code, is the centre of a construction business. It is expanding from pay into safety and payables.
Theme 04
A third platform company addressed the small-business back office inside a fortnight, and the vendor behind the best-known ledger showed that what an assistant may touch is decided surface by surface.
On 29 September Meta launched Muse for Small Business with fifteen connectors. QuickBooks is the only accounting ledger and no payroll vendor is on the list. Intuit's post says customers go to QuickBooks itself for "compliance-heavy" work such as payroll, closing the books and filing taxes.
That is a choice about one surface. Intuit's connector in Claude and its plugin in ChatGPT have answered payroll questions since 28 July, and Intuit's own release lists "run payroll" among what comes next there. Gusto's connector already lets a customer run payroll from the conversation. The vendors differ in how far, and where.
OpenAI reported on 30 September that small firms give finance and accounting a 3.7 times larger share of their agent use than larger firms do. Its explanation is that small firms have no specialist to hand the work to. These are ratios, from OpenAI's own users, and payroll is not a category in the table.
Read together, the owner's first stop for a finance question is moving to a general assistant, and the accounting or payroll product becomes what that assistant reads from. OpenAI also said its tools can now be triggered by events in a connected application. A payroll system that can start the conversation, at a deadline or a tax notice, changes who prompts whom.
Next