AI for HR

Policy Structure

1. Purpose & Scope — who it applies to, which tools are covered
2. Approved Use Cases — explicitly list permitted HR applications
3. Prohibited Uses — sole automated decisions, sensitive data in public tools
4. Data Classification — what data enters AI, redaction requirements
5. Accountability — named AI lead, escalation path, review cadence

Key Principles

• Transparency — disclose AI use to candidates and employees
• Human oversight — no consequential decision without human review
• Proportionality — match governance rigour to risk level
• Continuous improvement — schedule policy reviews (at minimum annually)
• Vendor alignment — require contractual compliance from AI providers

EU AI Act

• Employment AI classified high-risk
• Emotion recognition prohibited in workplaces
• Transparency rules from Aug 2026
• High-risk employment rules from Dec 2027

GDPR

• Art 22: protection against solely automated decisions with legal/significant effects
• Right to meaningful information about decision logic
• Data minimisation and purpose limitation

EEOC (US)

• Title VII applies to AI-based selection
• Four-fifths rule is not a safe harbour
• ADA applies to AI assessments
• Employers liable for vendor tool bias

AU Privacy Act

• Applies to AI using personal info
• Employee-records exemption doesn't cover prospective employees
• APP 5 notice at collection
• OAIC warns against public GenAI for personal info

NIST AI RMF

The US National Institute of Standards and Technology AI Risk Management Framework provides a voluntary, flexible structure for managing AI risks across four functions:

• Govern — culture, roles, policies
• Map — context and risk identification
• Measure — analysis and tracking
• Manage — response and monitoring

ISO/IEC 42001

The first international standard for AI management systems. Provides a certifiable framework covering:

• AI policy and objectives
• Risk assessment processes
• Data governance controls
• Performance evaluation
• Continual improvement cycles

AU DTA Policy

The Australian Digital Transformation Agency's policy for government AI use, relevant as a benchmark for private-sector best practice:

• Mandatory risk assessments
• Transparency reporting
• Human oversight requirements
• Alignment with AU AI Ethics Principles

1. Before Training

Pre-processing

• Audit training datasets for demographic imbalances
• Remove or re-weight biased historical labels
• Identify and address proxy variables
• Augment underrepresented groups with synthetic or additional data
• Document data lineage and known limitations

2. During Modelling

In-processing

• Apply fairness constraints to the optimisation objective
• Use adversarial debiasing to prevent learning protected attributes
• Regularise for equal error rates across groups
• Select model architectures less prone to memorising bias
• Cross-validate across demographic subgroups

3. After Modelling

Post-processing

• Adjust decision thresholds per group to equalise outcomes
• Monitor live predictions for disparate impact
• Set alerts for drift in fairness metrics
• Conduct periodic third-party audits
• Maintain a bias incident register

Testing Workflow

1. Define scope — which tool, which decision, which populations
2. Collect demographic data — actual or synthetic test sets with known attributes
3. Run paired tests — identical profiles differing only on protected attributes
4. Measure disparities — selection rates, score distributions, rank orderings
5. Apply the four-fifths rule — as a starting signal, not a safe harbour
6. Investigate root causes — which features drive disparate outcomes
7. Document and remediate — record findings, adjust or discontinue

What to Look For

• Selection rate differences — are some groups consistently ranked lower?
• Score clustering — do scores for a group bunch near the threshold?
• Feature dominance — does one input (e.g. university name) drive most decisions?
• Edge case behaviour — how does the tool handle atypical profiles?
• Temporal drift — do disparities grow over time as the model updates?

Remember: the four-fifths rule (80% threshold) is an initial screen, not a compliance guarantee.

Design Principles

• Advisory not determinative — AI recommends, humans decide
• Meaningful review — humans see enough context to genuinely evaluate, not rubber-stamp
• Cognitive load management — don't overwhelm reviewers with hundreds of AI flags
• Override authority — clear mechanism to disagree with AI recommendation
• Feedback loops — human corrections improve the model over time

Common Pitfalls

• Automation bias — humans defer to AI because "the computer knows best"
• Theatre oversight — a human "reviews" 200 decisions in 10 minutes
• Missing context — reviewer can't see the data the AI used
• No training — reviewers don't understand what the AI does or its limitations
• No accountability — unclear who is responsible when things go wrong

Research shows people prefer human involvement over purely automated decisions — design systems that deliver genuine, not cosmetic, oversight.

What Happened

Amazon developed an AI recruiting tool trained on 10 years of historical hiring data. The system was designed to rate candidates on a 1-to-5 star scale.

The tool systematically penalised CVs containing the word "women's" (e.g. "women's chess club") and downgraded graduates of all-women's colleges.

Amazon scrapped the tool after internal discovery.

Key Lessons

• Historical data encodes historical bias — a decade of male-dominated tech hiring produced male-biased training data
• Removing protected attributes isn't enough — the model found proxies (women's colleges, gendered language)
• Internal testing caught the problem — but only after significant investment; earlier auditing would have been cheaper
• Scale amplifies harm — automated bias affects every candidate, not just some
• Transparency matters — Amazon's willingness to scrap the tool set a precedent

1. Bias Has Many Sources

Historical data, representation gaps, proxy variables, biased labels, and deployment mismatches all introduce bias — often invisibly and without intent.

2. Mitigate at Every Stage

Pre-processing (data), in-processing (model), and post-processing (thresholds and monitoring) each catch different forms of bias. Use all three.

3. Fairness Is a Choice

Demographic parity, equalised odds, and calibration cannot all be satisfied simultaneously. Your organisation must choose which form of fairness to prioritise.

4. Real Cases Have Real Costs

Amazon scrapped years of work. iTutorGroup paid $365K and changed its processes. The cost of not auditing far exceeds the cost of auditing.

Data Minimisation

Collect and process only the data strictly necessary for the stated purpose.

• Don't feed entire employee files when a summary suffices
• Strip unnecessary fields before AI processing
• Question whether each data point is truly needed

Purpose Limitation

Use data only for the purpose it was collected for.

• Recruitment data shouldn't train attrition models without fresh consent
• Performance data collected for development shouldn't feed termination decisions
• Document and enforce purpose boundaries

Retention Limits

Don't keep data longer than necessary.

• Define retention periods for each AI data flow
• Auto-delete prompts and outputs after defined periods
• Ensure AI vendors honour your retention schedule

Questions to Ask Vendors

1. Where is data stored and processed? (jurisdiction matters)
2. Is our data used to train or improve your models?
3. What is your data retention policy? Can we enforce ours?
4. Do you offer zero data retention (ZDR)?
5. What encryption is applied at rest and in transit?
6. Who has access to our data within your organisation?
7. How do you handle data breaches and notifications?
8. Can we audit your data handling practices?

Red Flags

• Vague answers about data location or processing jurisdiction
• Customer data used for model training by default (opt-out rather than opt-in)
• No option for zero data retention on enterprise tiers
• No SOC 2 Type II or ISO 27001 certification
• No contractual data processing agreement (DPA)
• Inability to delete data on request
• Sub-processors in jurisdictions without adequate privacy laws

Zero Data Retention

ZDR means the AI provider processes your data but does not store prompts, responses, or any derivative data after the interaction completes.

• Available on enterprise tiers from major providers
• Essential for sensitive HR data
• Verify contractually — "ZDR" means different things to different vendors

Logging & Audit Trails

Even with ZDR, your organisation should maintain its own records.

• Log who used AI, when, and for what purpose
• Store audit metadata without storing the full prompt/response
• Enable investigation of complaints or bias reports

Access Controls

Not every HR team member needs access to every AI capability.

• Role-based access to AI tools
• Restrict sensitive data integrations to authorised users
• Separate development and production environments
• Regular access reviews aligned with joiner/mover/leaver processes

1. Classify Before You Process

Not all HR data should enter AI systems. Classify by sensitivity, apply appropriate controls, and never put high-risk data into public or free-tier tools.

2. The Exemption Has Limits

The Australian employee-records exemption doesn't cover candidates, contractors, or uses unrelated to the employment relationship. When in doubt, apply full privacy protections.

3. Transparency Is Non-Negotiable

A defensible AI notice tells people what data you collect, why, whether AI decides or advises, how long data is kept, and how to request human review.

4. Vet Your Vendors

Ask hard questions about data retention, training use, jurisdiction, and breach notification. Require contractual commitments — verbal assurances are not enough.

Continuous Feedback

• Real-time progress tracking — AI monitors goal completion signals from integrated tools (project management, CRM, code commits)
• Nudge systems — automated reminders for check-ins, feedback requests, and milestone reviews
• Sentiment analysis — AI detects tone shifts in feedback patterns that may signal disengagement
• Trend identification — surface patterns across quarters that point-in-time reviews miss

Implementation Considerations

• Privacy boundaries — monitor outputs and outcomes, not keystrokes and screen time
• Transparency — employees must know what data feeds the system
• Opt-in features — let employees choose which integrations they enable
• Manager training — AI surfaces data; managers must still have the conversations
• Bias checks — sentiment analysis and NLP tools carry their own bias risks

Pay Benchmarking

AI aggregates market data to provide real-time compensation benchmarks.

• Compare roles against industry, location, and company size
• Identify roles where pay is significantly above or below market
• Model the cost impact of compensation adjustments

Anomaly Detection

AI identifies pay outliers that warrant investigation.

• Flag unexplained pay gaps between similar roles
• Detect patterns in bonus allocation that correlate with demographics
• Surface "salary compression" where new hires earn more than tenured staff

Pay-Equity Analytics

Regression-based analysis to isolate the impact of gender, ethnicity, and other factors on pay.

• Control for legitimate factors (role, experience, location, performance)
• Quantify unexplained pay gaps
• Model remediation scenarios and budget impact

How It Works

AI analyses performance data, feedback patterns, and goal progress to generate tailored coaching prompts for managers before 1:1s.

• Conversation starters — "Ask about the Q2 project delay — data shows a 3-week slip"
• Recognition prompts — "Highlight the client satisfaction improvement — up 18% this quarter"
• Development nudges — "This employee's growth goal hasn't been discussed in 6 weeks"
• Difficult conversation prep — suggested talking points with empathetic framing

Design Principles

• Suggestions, not scripts — prompts should inspire the conversation, not dictate it
• Manager discretion — always optional; managers can ignore or modify any prompt
• Employee visibility — consider letting employees see the data that informs prompts
• Bias review — audit whether prompts differ systematically across demographic groups
• Privacy limits — prompts should reference work outputs, not surveillance data

The best coaching prompts make it easier for a good manager to be great — they don't try to turn a reluctant manager into a coach.

1. AI Accelerates, Not Replaces

Goal drafting, review summarisation, and calibration analytics save managers significant time — but the conversations, judgment calls, and relationship building remain fundamentally human.

2. Pay Equity Needs AI + Ethics

AI excels at benchmarking, anomaly detection, and regression analysis for pay equity — but the models themselves must be audited for the very biases they aim to detect.

3. Guard Against Dehumanisation

Research shows AI in HR can make employees feel reduced to data points. Design systems that augment human connection rather than replace it, and monitor for surveillance fatigue.

4. Measure What Matters

56% of HR teams don't formally measure AI success. Define metrics for both efficiency (time saved, cost reduced) and quality (fairness, employee experience, manager capability).