AI Governance in HR: A Policy and Audit Template for Hiring and People Decisions

Ask an HR leader whether the team uses AI in hiring, and the first answer is often “a little.” Then the list starts: resume screening in the ATS, interview scheduling, a chatbot on the careers page, an interview notetaker, writing help for job descriptions, a skills engine that suggests internal candidates and a performance tool that drafts review summaries. Each was bought for a sensible reason. Few were reviewed as a whole.

That gap is what AI governance in HR closes. It is not a single policy document. It is a working system: a list of every AI tool that touches people’s decisions, a way to rank them by risk, clear rules for each tier, named owners, and a regular audit. This guide gives you that system as a template, mapped to the EU AI Act and to US rules such as New York City’s Local Law 144.

Definition: AI governance in HR is the set of policies, roles, controls, and audits an organization uses to decide which AI tools may influence hiring and people decisions, how humans oversee them, and how their results are checked for accuracy and fairness.

Why AI governance in HR is now a compliance task

Under the EU AI Act, Annex III lists employment as a high-risk area. Point 4(a) covers AI used for recruitment and selection, such as placing targeted job ads, filtering applications, and evaluating candidates. Point 4(b) covers AI used to make or influence decisions about working conditions, promotion, termination, task allocation, and the monitoring and evaluation of performance and behavior.

Some parts of the Act already apply. Since 2 February 2025, emotion recognition in the workplace has been prohibited, with narrow medical and safety exceptions, and organizations must take steps to make sure staff who use AI have enough AI literacy. The obligations for high-risk employment systems apply later. Following the Digital Omnibus changes, they are scheduled for 2 December 2027. Check the current position with counsel before you set internal deadlines.

The Commission’s draft guidelines on high-risk classification, summarized by DLA Piper, point to a key test: whether the AI output has a material influence on the decision. A human making the final call does not by itself take a system out of scope. Final guidance is expected by the end of 2026.

In the US, New York City’s Local Law 144 already requires employers using automated employment decision tools to commission a bias audit no more than one year before use, publish a summary of the results, and notify candidates. A December 2025 audit by the New York State Comptroller found enforcement by the city’s consumer protection agency to be weak, and law firms have read that as a sign of closer scrutiny ahead.

Step 1: Build an AI use inventory.

You cannot govern tools you do not know about. Ask HR operations, talent acquisition, people analytics, and IT to list every system with an AI or automated scoring feature, including features switched on inside larger platforms. For each one record:

• Tool and vendor, and the feature name inside it
• Which decision it supports: sourcing, screening, interviewing, offer, pay, performance, promotion, scheduling, or exit
• What it produces: a score, a ranking, a recommendation, a summary, or a fully automated action
• Which data it uses about candidates or employees
• Countries and worker groups affected
• Business owner and the HR person accountable for its use
• Contract status, including whether the vendor has provided documentation and instructions for use

Expect surprises. Many teams find AI features they never formally switched on, such as automatic candidate matching or suggested interview questions.

Step 2: Sort tools into risk tiers.

Classify each inventory entry so effort goes where the stakes are highest.

When unsure, place a tool in the higher tier until legal review says otherwise. The test is influenced by the outcome, not the vendor’s label.

Step 3: Write the HR AI policy.

Keep the policy short enough that recruiters and managers will read it. A practical template has eight clauses:

1. Scope: which tools, decisions, countries, and people the policy covers.
2. Approval: no AI tool that affects hiring or people decisions goes live without review by HR, legal, privacy, and IT security.
3. Prohibited uses: emotion recognition at work, inferring protected characteristics, and any fully automated rejection or dismissal.
4. Human oversight: who reviews AI outputs, what training they need, and their authority to override the tool.
5. Transparency: how candidates and employees are told that AI is used and how they can ask questions or request human review.
6. Data: what data each tool may use, how long it is kept, and who can access it.
7. Testing and monitoring: how often outcomes are checked for adverse impact and accuracy, and what happens when a check fails.
8. Incidents: how staff report a problem, who investigates, and when a tool is paused.

Link the policy to your wider company framework rather than writing it in isolation. TechsterHub’s guide to building an AI governance framework covers the company-wide layer.

Step 4: Set human oversight that is real.

Article 26 of the AI Act, on the obligations of deployers, asks organizations using high-risk systems to assign human oversight to people with the competence, training, and authority to do it. In HR terms, that means:

• Reviewers see the AI output and the underlying information, not just a score.
• Reviewers have time to disagree. A recruiter screening 300 applicants an hour is not overseeing anything.
• Overrides are recorded with a reason, and override rates are reported.
• Reviewers know the tool’s known limits, such as weak results for career changers or non-standard resumes.

Article 26 also asks deployers to use systems according to the provider’s instructions, make sure input data is relevant, monitor operation, keep automatically generated logs for at least six months, and inform workers’ representatives and affected workers before using a high-risk system at work. Build those duties into the owner’s job description for each high-risk tool.

Step 5: Agree on what vendors must provide

Most HR teams deploy AI they did not build, so contracts carry much of the governance load. Ask every vendor of a high-risk tool for instructions for use, a description of the data the model was trained and tested on at a level they can share, bias testing results and method, logging capabilities, notice of material model changes, and support for your own audits. Put these in the contract, not in a sales email.

Our reviews of tools such as Syndio and our guide to pay equity software show the kind of documentation strong vendors publish.

Step 6: Run the audit.

Use this checklist every review cycle for each high-risk tool:

1. Confirm the inventory entry is current: feature, data, countries, and owner.
2. Check that the tool is used as the vendor’s instructions describe.
3. Pull outcome data by stage and test for adverse impact across the groups you can lawfully analyze.
4. Sample individual decisions and check that a human reviewed them with the information needed.
5. Review override rates and the reasons given.
6. Confirm notices to candidates and employees are live and accurate.
7. Confirm logs exist and are kept for the required period.
8. Check for vendor model changes since the last audit.
9. Record findings, actions, owners, and due dates, and report them to the governance group.

For tools used on candidates in New York City, add the Local Law 144 items: a current independent bias audit, a published summary, and candidate notices.

Who owns what?

• CHRO: accountable for the policy and for decisions to approve or retire high-risk tools.
• HR technology or HR operations lead: maintains the inventory and coordinates audits.
• Legal and privacy: classify tools, review notices and contracts, and track regulation.
• IT security: reviews data flows, access, and logging.
• People analytics: runs adverse impact testing.
• Works council or employee representatives where they exist: consulted before high-risk tools go live.

A 90-day starting plan

• Days 1 to 30: build the inventory, switch off any prohibited features, and name an owner for each tool.
• Days 31 to 60: classify tools, draft the policy, and send vendor documentation requests.
• Days 61 to 90: run the first audit on the two or three highest-risk tools, publish notices, and train reviewers.

FAQs: