How to Write an AI Acceptable Use Policy for HR Teams

An AI acceptable use policy for HR teams should define which AI tools HR staff may use, which employee data may never enter them, which decisions require documented human review, and what notice employees and candidates receive. It differs from a company-wide AI policy because HR handles the most sensitive personal data and makes decisions that carry legal liability.

Key takeaways

  • Write a separate HR addendum to any company-wide AI policy, because HR data and decisions carry higher legal risk.
  • Classify HR data into tiers and tie each tier to approved tools, not to vague "use good judgment" language.
  • Name prohibited uses explicitly, especially AI making or recommending employment decisions without review.
  • Build in notice duties: Illinois has required notice of AI use in covered employment decisions since January 1, 2026.
  • Assign an owner, a review cycle and a simple process for requesting a new tool.

Why does HR need its own AI acceptable use policy?

Most company AI policies are written for general knowledge work: drafting emails, summarizing documents, writing code. HR work is different in two ways. First, HR handles data that is sensitive by default, including medical leave records, accommodation requests, investigation notes, compensation and immigration documents. Second, HR outputs often become employment decisions, and those decisions are regulated.

A typical failure looks like this: a recruiter pastes a batch of resumes into a consumer chatbot and asks for the "top five." No one intended to automate hiring, but the organization now has an undocumented selection procedure, candidate data in an unapproved tool and no record of how the shortlist was produced. A general policy that says "do not share confidential information" did not prevent it because it never addressed HR-specific scenarios.

If you have already published broad guidance for all employees, as discussed in our piece on giving employees guidance on workplace AI tools, treat the HR policy as an addendum with stricter rules for the people who handle workforce data.

What should an HR AI acceptable use policy include?

Keep the policy short enough to read in ten minutes, with detail moved into appendices. These are the clauses that matter most.

1. Scope and definitions

State who the policy covers (HR, talent acquisition, payroll, HR operations, people analytics, and contractors doing HR work) and define "AI tool" broadly. Illinois Public Act 103-0804 defines artificial intelligence as a machine-based system that infers from inputs how to generate outputs such as predictions, content, recommendations or decisions, and it expressly includes generative AI. Borrowing a statutory definition avoids arguments about whether a feature "counts."

2. Data classification tiers

Tie data sensitivity to tool approval. A simple three-tier model works for most teams:

TierExamplesAllowed in
Public or generalPublished job postings, public policy summaries, generic templatesAny approved AI tool
Internal personal dataNames, job titles, schedules, performance goalsEnterprise AI tools with a signed agreement that bars training on your data
RestrictedMedical and leave data, accommodations, investigations, compensation, Social Security numbers, immigration recordsOnly tools specifically approved for that data, or none

3. Approved tools list

Maintain a list of approved tools and the highest data tier each may receive. Make it a living appendix owned by HR technology so the policy text does not need to change every time a tool is added.

4. Prohibited uses

  • Using AI to make or recommend a hiring, promotion, discipline, termination or pay decision without documented human review.
  • Entering restricted data into any tool not approved for it, including personal accounts on consumer AI products.
  • Using AI to infer protected characteristics, health conditions or union activity.
  • Using ZIP codes or similar proxies for protected classes in any model or screening rule.
  • Sending AI-generated communications about leave, benefits or pay eligibility without checking them against the source policy.

The ZIP code item is not hypothetical. The Illinois amendment makes it a civil rights violation for an employer to use AI that has the effect of subjecting employees to discrimination, or to use ZIP codes as a proxy for protected classes.

5. Human review and accountability

Specify where a person must review AI output before it is used, who that person is, and how review is recorded. The NIST Generative AI Profile (NIST AI 600-1) identifies confabulation, meaning confident but false output, as a core generative AI risk. For HR, that means a named reviewer for anything that states a policy, a number or an eligibility rule.

6. Notice and transparency

List the situations where employees or candidates must be told AI is in use. Illinois requires notice when AI is used for covered employment decisions such as recruitment, hiring, promotion, discipline and discharge. New York City requires notice before using an automated employment decision tool. Under California's privacy regulations, businesses using automated decisionmaking technology for significant decisions, which include hiring, work allocation, compensation, promotion and termination, must comply with pre-use notice and related requirements by January 1, 2027.

How do you handle AI features inside existing HR systems?

Many AI features arrive through updates to systems you already own: an HRIS that drafts job descriptions, an ATS that ranks applicants, a service desk that suggests answers. These bypass a policy that only governs "new tools." Add a clause requiring HR technology to review AI features before they are switched on, and to document whether the feature influences decisions about people.

The risk is greater when HR builds its own automations. Our article on the compliance gap in HR-built AI agents covers what happens when a no-code workflow starts making employment decisions without anyone classifying it as a selection tool.

Who should own and enforce the policy?

Ownership should sit with the CHRO or a delegate in HR operations, with legal, privacy and security as required reviewers. Practical enforcement depends less on discipline and more on making the approved path easy:

  • Provide at least one approved enterprise AI tool so staff are not tempted to use personal accounts.
  • Publish a one-page request form for new tools, with a target turnaround time.
  • Train HR staff with realistic scenarios, such as summarizing an investigation file or drafting a termination letter.
  • Log AI-assisted decisions in the same system of record as the decision itself.
  • Review the policy at least annually and whenever a relevant law takes effect.

What mistakes make HR AI policies fail?

  • Too abstract. "Use AI responsibly" gives no guidance at 4 p.m. on a busy day. Use examples.
  • Ban everything. Blanket bans push usage into personal accounts where you have no visibility.
  • No data tiers. Without tiers, staff cannot tell whether a performance note is acceptable to paste.
  • Ignoring vendors. The policy should require vendor terms that bar training on HR data and allow deletion.
  • Forgetting privacy law. Employee data rights still apply when AI is involved; see our overview of GDPR and employee data privacy in HRMS.

Frequently Asked Questions

Is an HR AI policy different from a company-wide AI policy?

Yes. A company-wide policy sets general rules for all employees. The HR addendum adds stricter data tiers, prohibited decision uses, human review steps and notice duties because HR handles sensitive personal data and makes regulated employment decisions. Both documents should use the same definitions and approved tools list so they do not conflict.

Can HR staff use consumer AI chatbots at work?

Only for public or general information, and only if your organization allows it. Personal or restricted employee data should go only into enterprise tools covered by an agreement that controls retention and prohibits training on your data. Spell this out with examples so staff can decide quickly without escalating every question.

Do employees need to be told when HR uses AI?

In some places, yes. Illinois requires notice when AI is used for covered employment decisions, New York City requires notice before using automated employment decision tools on candidates and employees, and California privacy rules add ADMT notice duties from January 1, 2027. Even where not required, notice builds trust and reduces disputes.

How often should the HR AI policy be updated?

Review it at least once a year and whenever a new law takes effect, a major vendor changes its AI features or you adopt a new category of tool. Keep the approved tools list in an appendix so it can change monthly without re-approving the whole policy.

Practical next steps

  1. Inventory the AI tools and features HR staff already use, including personal accounts.
  2. Draft data tiers and the approved tools list first, then the prohibited uses.
  3. Confirm notice duties for every state and city where you hire.
  4. Pilot the draft with recruiters and HR business partners and revise based on their questions.
  5. Publish, train and schedule the annual review. More governance resources are in our AI in HR guides hub.

Last reviewed: October 2026.

Sources

Comments

Post a Comment

Popular Posts

Why Workday Onboarding Breaks Down for Frontline Employees

Image
The Onboarding Gap Nobody Talks About Workday's onboarding module is well-designed for its intended audience: office-based, desk workers with reliable computer access, personal email addresses, and the digital literacy to navigate a web-based portal. For this population, Workday onboarding works well, it automates tasks, routes approvals, collects documents, and creates a reasonably smooth first-week experience. But most organizations using Workday have a substantial population of frontline workers: warehouse employees, retail staff, manufacturing workers, healthcare aides, food service workers, drivers. For this population, the standard Workday onboarding experience frequently fails in ways that are predictable, documented, and, crucially, fixable. Understanding why it breaks down and what actually works is increasingly urgent as labor market competition for frontline talent intensifies. How Standard Workday Onboarding Is Designed Workday's new hire onboarding (delivered throu...
Read more

How to Improve the Customer Experience (CX)

Customer experience is the sum of every interaction a customer has with your company, from the first ad they see to the way a return gets handled years after the purchase. Companies that take this seriously outperform those that treat CX as a support function. The ones that struggle tend to confuse customer satisfaction scores with actual improvements, or fix the wrong things. Here's a practical look at what actually moves CX forward. Start with where customers actually struggle Most CX improvement programs begin with surveys. Surveys are useful but limited, they capture what customers are willing to articulate after the fact, which tends to under-report friction in the middle of an experience and over-index on the most recent interaction. The richer data comes from observing behavior directly: where do customers drop off in a purchase flow? Where do support tickets spike? What search queries are people entering on your site that suggest they can't find what they're loo...
Read more

Infor HCM Software Engineer Jobs: Salary Factors and Skills

An Infor HCM software engineer's salary depends mostly on the type of employer, the depth of Infor platform knowledge, and location. Engineers who combine general software skills with hands-on experience in Infor CloudSuite HCM, Lawson, Infor ION integrations and payroll logic tend to command more than generalist developers, because that combination is scarce in the job market. What does an Infor HCM software engineer actually do? The title covers several different jobs, and pay follows the job more than the title. Broadly, these engineers build, configure, integrate and support the Infor human capital management stack, which includes core HR, payroll, benefits, talent management and workforce management. Many organizations still run the older on-premises Infor Lawson system alongside or instead of the cloud suite, so experience with both is common. Typical responsibilities include: Building and maintaining integrations between Infor HCM and payroll providers, benefits carrie...
Read more

UKG Union Contract and Overtime Rules for Multi-Site Food Plants

Multi-site food manufacturers running UKG often struggle with one thing: each plant has its own union contract, shift pattern and overtime rules, while the timekeeping system is configured centrally. The fix: document every contract rule precisely, map it to UKG pay rules and work rules, test against real timecards, and handle true exceptions with add-ons rather than core customization. Disclosure: The author works at CloudApper, which makes the UKG add-ons discussed in this article. Why are union contracts so hard to configure in UKG? Federal law sets a floor. Under the Fair Labor Standards Act, non-exempt employees must receive at least one and a half times their regular rate for hours worked over 40 in a workweek. Collective bargaining agreements frequently go further, and food plants often have several agreements across locations. Common contract provisions include: Daily overtime after 8 hours, or after 10 on a four-day schedule. Double time on the seventh consecutive day o...
Read more

How Do I Log In and Sign In to Workday HCM

Workday HCM is the system your organization uses to manage everything from your pay stubs and benefits to time off requests and performance reviews. Getting in is usually simple once you know where to go, but first-time login, password resets, and single sign-on setups can trip people up if no one has walked them through it. Here's what you need to know. How to find your Workday login URL Workday doesn't have one universal login page. Each organization has its own tenant, a dedicated instance with a unique URL. Your company's HR department or IT team should have provided the URL when you were onboarded. It usually looks something like your-company.workday.com or wd3.myworkday.com/yourcompany . If you weren't given the URL, check your onboarding email, your company's intranet, or ask HR directly. Some organizations also link to Workday from their internal HR portal. Don't try to guess the URL, there's no central directory, and guessing wrong just takes...
Read more

How to Search in Workday: Find Reqs, Reports, People and Tasks

To search in Workday, type into the global search bar at the top of any page, press Enter, then use the category filters on the left of the results to narrow to people, organizations, tasks and reports or other object types. Workday only returns items your security roles allow you to see, so missing results often mean an access issue rather than a typo. How does Workday search work? Workday uses a single global search box rather than separate menus for each module. Everything in the tenant, from a worker's profile to a job requisition to a custom report, is an object that search can find if you have permission to view it. Three points explain most search behavior: Security trimming. Results are filtered by your security groups. A recruiter and a payroll partner typing the same term will see different results. Categories. After you press Enter, results are grouped into categories that appear as filters. Clicking one hides everything else. Related actions. Once you open an...
Read more

New Apple Watch Health Features Will Be Available This Year, but Blood Pressure and Blood Sugar Sensors Will Not Be Available Until Next Year

Image
What Apple confirmed for its upcoming watch lineup Apple's annual health feature announcements for its Watch lineup continue to generate significant attention, both from health enthusiasts who track every new sensor addition and from the clinical research community that increasingly uses consumer wearables in studies. The pattern that has emerged over the past several product cycles is consistent: Apple confirms a set of features that will ship with the current year's model and acknowledges separately that other, more complex sensors are still in development and will not arrive on schedule. This year's announcement followed that pattern closely. Several new health monitoring capabilities are confirmed for the current Apple Watch generation, representing meaningful additions to what the device can track passively. At the same time, the two most anticipated sensor additions, continuous blood pressure monitoring and non-invasive blood glucose measurement, will not be availa...
Read more

The Future of Employee Healthcare Key Concerns and Strategies for 2024

In a rapidly evolving professional landscape, employers are grappling with an array of challenges as they plan employee-sponsored healthcare strategies for 2024. A recent survey conducted in the US in August 2023 sheds light on the primary concerns and emerging trends in the realm of employee healthcare. Mental health, healthcare costs, pharmacy expenditures, and transformative technologies are at the forefront of employer considerations, signaling a need for comprehensive and innovative approaches to employee well-being. Rising Mental Health Concerns A staggering seven in 10 employers reported a surge in mental health concerns, marking a significant uptick from the previous year. With 77% of employers experiencing an increase and an additional 16% anticipating future challenges, the mental health landscape is a top priority. The implications of the ongoing pandemic, remote work dynamics, and societal shifts are evident as employers grapple with addressing and supporting the mental ...
Read more

How Digital Marketing Helps Your Business Grow: A Practical Plan

Digital marketing helps a business grow by putting it in front of buyers at the moment they search, compare and decide, then measuring which efforts produce revenue. Search, content, email, paid ads and social channels let even small teams reach targeted audiences, test messages cheaply and shift budget toward what works, something print and broadcast advertising rarely allow. How does digital marketing actually drive business growth? Growth comes from three levers: reaching more of the right people, converting more of them into customers and keeping those customers longer. Digital channels touch all three. Reach. Search engines, professional networks and industry newsletters connect you with people already looking for what you sell. Conversion. Clear landing pages, case examples and easy contact options turn interest into conversations. Retention. Email, customer education content and community channels keep existing customers engaged and open to expansion. The underlying ...
Read more

ERP Solution Guide: How to Choose the Best ERP for You

What Is an ERP System and Why Does It Matter? An enterprise resource planning (ERP) system is software that integrates the core functions of a business — finance, inventory, procurement, human resources, manufacturing, and customer management — into a single, connected platform. Instead of data living in separate spreadsheets or standalone applications that don't talk to each other, an ERP creates one source of truth for the entire organization. For growing companies, the question is usually not whether they need an ERP but when and which one. Getting this decision right has long-term consequences. A poorly chosen ERP creates more problems than it solves — forcing teams to work around the system, creating data integrity issues, and consuming IT resources in an endless cycle of customization and maintenance. A well-chosen ERP, on the other hand, becomes the operational backbone that lets a company scale without proportionally growing its administrative overhead. Understandin...
Read more