Most organisations now have an AI policy document. Almost none of them change a single thing that happens in a hiring panel, a performance review, or a redundancy conversation. An AI policy for HR teams that sits in a SharePoint folder isn't a safeguard — it's a liability waiting for a tribunal to find it.

That gap is the whole problem. Policies get written to satisfy an audit, not to survive contact with a real decision. And right now, with 19 US states already carrying AI employment laws on the books according to SHRM, that gap is closing fast whether you're ready or not.

What does a dead-on-arrival AI policy for HR teams look like?

It's vague, unowned, and disconnected from actual workflows. Nobody can name who signs off an AI-assisted hiring decision, so nobody does. It gets written once, filed, and never opened again.

Look at the language first. "AI should be used responsibly" tells a hiring manager nothing when they're staring at a shortlisting tool that's just screened out half their candidates. There's no named accountability, no escalation path, and no definition of what "responsible" actually means in a recruitment context versus a performance review.

Then look at where it connects — or doesn't. Most AI policies for HR teams are written in isolation from the actual tools being used in recruitment, performance management, and employee communications. The policy lives in one document. The AI tool lives in the ATS. The two never meet.

SHRM's State of AI in HR research found only 49% of organisations using or piloting AI even have a policy governing workforce use. For the other half, there isn't a gap between policy and practice — there's no policy at all. For the half that do have one, enforcement is usually the missing piece. Nobody checks whether managers follow it, and nobody's job depends on them doing so.

What does a working AI policy for HR teams actually require?

A working AI policy for HR teams requires three things: a human sign-off on any decision that affects someone's job, hard red lines around hiring and performance data, and a review cycle measured in months, not years. Skip any one of these and the document is decorative.

Start with sign-off. If an AI tool scores, ranks, or flags a candidate or employee, a named human has to review that output before it touches a real decision. Not a rubber stamp — an actual check, with the authority to overrule the system.

Next, draw the red lines explicitly. Hiring and performance data are the two areas where AI errors do the most damage, and they're also the two areas regulators are watching closest. The ICO's 2024 audit of AI recruitment tools flagged exactly this kind of risk — automated filtering with no human oversight and no clear record of how decisions were reached.

Finally, treat the policy as living, not archived. An annual review cycle means the document is already a year out of date by the time anyone reads it again. Quarterly reviews, tied to actual incidents and tool changes, keep the policy honest. If nothing's changed in the quarterly review, that's fine — but you need to have looked.

Why is HR's job bigger than ticking a compliance box?

Because compliance is the floor, not the job. HR's real role is modelling the judgement that stops a bad AI output from becoming a bad decision — and training every manager in the building to do the same.

That means teaching managers to challenge an AI recommendation out loud, in the moment, rather than deferring to it because it looks objective. An algorithm's confidence score isn't evidence. It's a starting point for a conversation a human still has to finish.

It also means owning the line between efficiency and risk before someone else draws it for you. CIPD research on AI in the workplace consistently stresses that governance has to sit with people professionals, not IT or legal, precisely because HR understands the human impact of a bad call in a way neither function does on its own.

If HR doesn't own that line, a regulator will draw it with a fine attached. Or a tribunal will draw it with a judgment attached. Either way, the line gets drawn — the only question is whether you were the one holding the pen.

Does your AI policy for HR teams survive contact with a real decision?

Test it against one scenario this week: an AI tool recommends rejecting a candidate, or flags an employee's performance as declining. Walk through exactly what your policy says should happen next. If you can't answer in under a minute, the policy doesn't work yet.

Most policies fail this test instantly. They were written for an audit, not for a Tuesday afternoon when a hiring manager is staring at a tool's output and deciding whether to trust it. That's the moment the policy actually has to earn its place.

Run that test before legislation forces the issue. However confident your organisation feels about its current document, confidence isn't the same as evidence that it works.

Here's what to do with that:

  • Pull your current AI policy and test it against one live decision this week — hiring, performance, or comms.
  • Name a single accountable owner for every AI touchpoint in recruitment and performance management.
  • Move your review cycle from annual to quarterly, starting now, not at the next audit date.