AI Policy for HR: A Company-Wide Template and Checklist

An AI policy for HR is the company-wide rulebook HR owns for how employees use generative AI at work and how the organization uses AI in employment decisions. It should name approved tools, ban certain data from prompts, require human review of hiring and discipline decisions, schedule bias audits, and spell out notice, vendor terms, training and enforcement.

This guide is for CHROs, HR policy owners and employment counsel who need one document that covers every employee, not just the HR team.

Key takeaways

• An AI policy for HR has two jobs: governing everyday employee use of generative AI, and governing AI that helps make decisions about candidates and workers.
• New York City's Local Law 144 requires a bias audit within one year before an automated employment decision tool is used, and notice to candidates or employees 10 business days before use.
• Since January 1, 2026, the Illinois Human Rights Act requires employers to notify employees when AI is used in covered employment decisions and bars using zip codes as a proxy for protected classes.
• Under the EU AI Act, AI used to screen applicants, evaluate candidates, or decide promotion or dismissal is high-risk, and those duties apply from December 2, 2027.
• The NIST AI Risk Management Framework is voluntary but gives HR, IT and legal a shared structure: Govern, Map, Measure and Manage.

What is an AI policy for HR, and how is it different from an HR team AUP?

An AI policy for HR is an organization-wide policy, usually issued by HR alongside IT and legal, that applies to every employee and to every AI system touching employment. It's broader than a team-level acceptable use policy.

Two terms first. Generative AI means tools that produce text, images, code or summaries from a prompt, such as chat assistants and the AI features now built into office suites. An automated employment decision tool (AEDT) is software that scores, ranks, filters or recommends people for hiring, promotion or other employment outcomes. Generative AI mostly creates confidentiality and accuracy risk; AEDTs create discrimination and notice risk.

If your HR department already has its own rules, keep them. Our guide to writing an AI acceptable use policy for HR teams covers that narrower addendum for staff who handle medical, pay and investigation records. The policy here sits above it and covers everyone.

Employees are already using these tools, so give employees practical guidance on AI tools rather than a blanket ban.

What should an AI policy for HR include?

A workable policy covers scope, approved tools, data rules, acceptable uses, human review, bias audits, notice, vendor terms, training and enforcement. The table shows what each must answer.

Section	Question it answers	Typical owner
Scope	Who and which systems does this cover, including contractors and AI features inside existing software?	HR and legal
Approved tools	Which tools are allowed, at what data level, and how does someone request a new one?	IT and security
Data rules	What data may never go into a prompt or an AI system?	Privacy and security
Human review	Which decisions must a qualified person make and document?	HR
Bias audits	Which tools are tested for adverse impact, how often, and by whom?	HR, legal and people analytics
Notice and consent	What do candidates and employees get told, and when?	HR and legal
Vendor contracts	What must a supplier agree to before its AI touches employee data?	Procurement and legal
Training and enforcement	Who must be trained, and what happens when someone breaks the rules?	HR and managers

Scope and approved tools

Cover employees, contractors and temps on any device used for work, and name AI features inside tools you already pay for. Publish a short approved tools list with three columns: tool name, the highest data level it's cleared for, and any restrictions.

Data rules

Write data rules as a short list people can remember. A practical version: never enter employee or candidate personal data, health or accommodation information, compensation details, customer confidential data, source code under restriction, or legal advice into any tool not cleared for that level. If you operate under GDPR or the California privacy rules, your employee data privacy obligations for generative AI shape this section heavily, including retention and whether a vendor may train models on your inputs.

Acceptable and prohibited uses

Acceptable: drafting emails, summarizing public documents, brainstorming, first drafts that a person edits. Prohibited: passing off AI output as verified fact without checking, generating content that impersonates a real person, inferring someone's emotions at work, and using any AI tool to make or recommend a hiring, pay, promotion, discipline or termination decision outside the approved process.

How should the policy handle AI in hiring and other employment decisions?

Treat any AI that scores, ranks or filters people as a regulated process: it needs documented human review, a bias audit schedule and advance notice. Anti-discrimination law applies to the outcome, whether a person or software produced it.

Title VII of the Civil Rights Act prohibits employment discrimination based on race, color, religion, sex and national origin, and its section 703(k) sets out how disparate impact claims are proven. It covers employers with 15 or more employees. For a step-by-step team process, see our EEO compliance playbook for AI recruiting tools.

Human review

Human review means a named, trained person looks at the evidence, can overrule the tool, and records why they agreed or disagreed. The EU AI Act puts this plainly for high-risk systems: Article 26 requires deployers to assign human oversight to people with the necessary competence, training and authority, and to keep system logs for at least six months where they control them. See our guide to designing real human oversight of AI HR decisions.

Bias audits

A bias audit is a test of whether a tool's outcomes differ across groups such as sex and race or ethnicity. In New York City, Local Law 144 requires an AEDT to have a bias audit within one year before use, a public summary of the results, and notice to candidates or employees 10 business days before the tool is used. The city began enforcing the law on July 5, 2023. Elsewhere, an annual audit plus a re-test after major model changes is a sensible default.

Where the rules come from

Rule	Where it applies	What your policy should reflect
Title VII	US employers with 15 or more employees	Adverse impact testing and human review of AI-assisted selection
NYC Local Law 144	AEDTs used for candidates or employees in New York City	Bias audit within one year before use, public summary, 10 business days' notice
Illinois Human Rights Act, as amended	Employers covered by the Act, from January 1, 2026	Notice of AI use in employment decisions; no discriminatory effect; no zip codes as proxies
EU AI Act, Annex III point 4	AI for recruitment, selection, promotion, dismissal, task allocation and performance monitoring of people in the EU	High-risk deployer duties from December 2, 2027 (Article 113), including oversight, logs and informing workers
NIST AI RMF 1.0	Voluntary, any organization	Governance structure: Govern, Map, Measure, Manage

State rules keep moving, so keep a short jurisdiction appendix and review it each quarter. Our roundup of state AI employment laws in Colorado, Illinois and NYC is a good starting list.

This article is general information, not legal advice.

What notice and consent should employees and candidates get?

Tell people before an AI system is used on them, in plain language, with a contact for questions. Reuse one notice across postings, portals and the handbook.

In Illinois, Public Act 103-0804 amended the Human Rights Act so that an employer must notify employees when it uses AI for recruitment, hiring, promotion, discharge, discipline or other terms of employment, and failing to give that notice is itself a violation. The state's Department of Human Rights sets rules on timing and delivery, so point to a notice procedure you can update separately.

For EU workplaces, Article 26 also requires employers to inform workers' representatives and affected workers before putting a high-risk AI system into service at the workplace.

What should vendor contracts require?

Before a supplier's AI touches employee or candidate data, the contract should settle data use, audit support and change notice, or your policy means little.

At minimum, require the vendor to: state whether your data trains its models and allow you to opt out; disclose subprocessors; support your bias audits with the data and documentation you need; keep logs for the period your policy sets; notify you of material model changes before they go live; and delete data at contract end. Our AI vendor due diligence questionnaire for HR tech turns these into questions you can send with an RFP. If you hire in the EU, check that the supplier can give you the instructions for use and information you'll need under the EU AI Act's high-risk employment rules.

How do you write and roll out the policy, step by step?

Start from an inventory of what's already in use, draft against the template below, test it with real employees, then train and enforce.

1. Inventory current AI use. Ask IT for sign-ins and extensions, ask system owners which AI features are on, and survey employees anonymously.
2. Classify each use. General productivity, customer-facing, or employment decisions, which get the strictest rules.
3. Map to a framework. Use the NIST AI Risk Management Framework functions to assign who governs, who maps risks, who measures outcomes and who manages incidents.
4. Draft the sections. Use the outline below; put tool lists and jurisdiction rules in appendices.
5. Test with real scenarios. A recruiter pasting resumes into a chatbot, or a manager drafting a warning letter with AI. If the policy gives no clear answer, fix it.
6. Train by role. Everyone gets a short baseline; recruiters, HRIS admins and managers who use decision tools get deeper training.
7. Publish and review. Collect acknowledgments and review at least every six months.

AI policy template outline

1. Purpose, scope and definitions (generative AI, AEDT, human review, bias audit).
2. Approved tools list and the request process.
3. Data rules and prohibited data categories.
4. Acceptable and prohibited uses, with examples.
5. Employment decisions: human review, documentation, appeal route.
6. Bias audits: frequency, owner, re-test triggers.
7. Notice and transparency.
8. Vendor minimum terms.
9. Training, reporting and enforcement.
10. Ownership and review date.

Common mistakes and when this does not apply

The most common failure is a policy that only lists standalone chatbots, while most real use now comes through AI features added to email and HR suites.

• Banning everything. Total bans push use onto personal accounts where you have no visibility.
• Vague data rules. "Use good judgment" isn't a rule. Name the data categories.
• Treating enforcement as only discipline. Make it easy to report an accidental paste of sensitive data.
• No owner. Without a named owner and review date, the approved tools list goes stale within months.

When this does not apply: a very small employer with no AI in hiring may only need a data rules list and an approved tools list until it adopts a screening tool.

FAQ

Who should own the AI policy, HR or IT?

HR should own the policy because it governs employee conduct and employment decisions, while IT and security own the approved tools list and technical controls. Legal reviews the notice and jurisdiction sections. Name one accountable owner, usually in HR, and a small cross-functional group that approves changes, so nobody can assume someone else is keeping it current.

Can employees use free public AI chatbots at work?

Many employers allow it for public, non-sensitive tasks such as drafting a generic email or researching a public topic, and forbid any personal, customer or confidential data in those tools. The safer pattern is to provide an approved enterprise tool with contractual data protections, so employees have a sanctioned option and less reason to use personal accounts.

Do we need a bias audit if we don't hire in New York City?

Local Law 144 only mandates audits for tools used in New York City. Elsewhere, Title VII disparate impact rules and state laws such as Illinois's still apply to outcomes, so testing selection results by group is the main way to spot a problem before it becomes a claim. An annual audit is a reasonable internal standard.

How often should an AI policy be updated?

Review the full policy at least every six months, and update the appendices whenever a new tool is approved, a vendor changes its model, or a new law takes effect. EU high-risk duties start December 2, 2027, and state rules are still changing, so a fixed annual review is usually too slow for this topic.

What to do next

• Run a two-week inventory of every AI tool and AI feature in use, including those inside existing HR and office software.
• List every tool that scores, ranks or filters people, and set a bias audit and human review owner for each.
• Draft the policy against the 10-part template above and test it on five real scenarios from your own teams.
• Write one plain-language AI notice and add it to job postings, the careers portal and the employee handbook.

Sources

• NIST: AI Risk Management Framework
• NYC Department of Consumer and Worker Protection: Automated Employment Decision Tools
• Illinois General Assembly: Public Act 103-0804
• EEOC: Title VII of the Civil Rights Act of 1964
• European Commission AI Act Service Desk: Annex III
• European Commission AI Act Service Desk: Article 26

Last reviewed: October 2026.