AI Governance

Why HR needs its own AI governance

AI is now built into most HR software: resume ranking, chat and voice screening, interview summaries, scheduling, performance insights, attrition prediction. Much of it arrives through vendor updates rather than a buying decision, so many HR teams are using AI they never formally approved.

Employment is also one of the most regulated uses of AI. Hiring tools are classed as high-risk under the EU AI Act. NYC Local Law 144 requires bias audits and notices for automated employment decision tools. The Colorado AI Act, replaced in May 2026 by SB 26-189, requires notice, an explanation within 30 days of an adverse decision, data correction, human review and three years of records from employers whose automated tools materially influence employment decisions, starting January 1, 2027. Title VII, the ADA and the ADEA apply to AI-assisted decisions just as they do to human ones, and an employer can be held responsible for discrimination caused by a vendor's tool. Governance is how an employer shows it took those obligations seriously.

The core components

1. An AI inventory. A list of every AI-enabled tool or feature in HR: what it does, what data it uses, which decisions it influences, the vendor, and the internal owner. Most teams find more than they expected.
2. Risk classification. Sort uses by impact. Drafting a job ad is low risk. Ranking or rejecting candidates, scoring interviews, or flagging employees for performance action is high risk.
3. A written policy. Approved tools, prohibited uses (for example, emotion recognition in interviews, or entering employee medical data into public chatbots), required reviews and who signs off.
4. Pre-deployment review. For high-risk tools: vendor documentation, validation evidence that the tool measures job-related criteria, adverse impact testing, data protection review, and legal sign-off.
5. Human oversight. Defined points where a trained person reviews or decides, as described in human in the loop.
6. Transparency. Notices to candidates and employees about AI use, accommodation routes and, where required, the right to request human review.
7. Ongoing monitoring. Regular bias audits, pass-rate analysis by group, accuracy checks and incident handling when something goes wrong.
8. Accountability. A named owner for each system and a cross-functional group (HR, legal, IT security, data privacy, often DEI) that approves high-risk uses.

Frameworks to build on

You do not need to invent a framework. Two are widely used:

• NIST AI Risk Management Framework (AI RMF 1.0, 2023). A voluntary US framework organized around four functions: Govern, Map, Measure and Manage. It is a practical structure for the inventory, risk assessment and monitoring steps above.
• ISO/IEC 42001 (2023). An international standard for an AI management system, similar in style to ISO 27001 for information security. Some vendors certify against it, which can help in procurement.

For hiring specifically, the federal Uniform Guidelines on Employee Selection Procedures (1978) still set the basic expectations for validating selection tools and checking adverse impact, including the four-fifths rule of thumb.

A worked example

A national retailer hiring 20,000 store associates a year finds, during its first AI inventory, nine AI features across its ATS, screening chatbot, assessment vendor and scheduling tool. Two are high risk: the ATS's applicant ranking and the assessment's automated scoring.

The governance group asks both vendors for validation studies and adverse impact data, commissions an independent bias audit for the NYC stores, adds candidate notices to the career site, and sets a rule that ranking can order the review queue but not auto-reject. Pass rates by sex and race/ethnicity are reviewed quarterly by the TA analytics team. One quarter shows a drop for older applicants at the assessment step; the vendor traces it to a timed section, and the retailer removes the time limit for that section after checking it was not job-related.

Getting started

• Build the inventory first; you cannot govern what you have not listed.
• Write a two-page policy before a 40-page one. Approved tools, prohibited uses, review triggers, owners.
• Add AI questions to every HR software purchase and renewal: data used, testing done, audit results, explainability, human override.
• Train recruiters and HR staff on what the tools do and do not do.
• Review the program at least annually, and whenever a law changes or a vendor adds a significant AI feature.

Rules vary by state and country, so involve employment counsel.