Creating Clear Guardrails for AI in HR

Artificial intelligence (AI) tools can draft a job description in seconds, compare leave policies across states and turn a messy process into a clean checklist. For busy HR teams, that’s a real gift. But HR work touches people’s livelihoods, private information and legal rights, and that raises the stakes for any tool that writes, summarizes or makes recommendations. That’s why every HR department using AI needs clear guardrails. The goal is to save time without adding legal, privacy or reputational risk. The guiding principle is simple: AI can support HR work, but qualified people remain responsible for reviewing its output and making employment decisions. 

Why AI Governance Matters Now

The regulatory picture for AI in employment is moving fast, and it’s moving toward human accountability. Several states have already acted, with requirements ranging from notice to recordkeeping. Here are some examples: 

Federal

There is no federal statute that specifically regulates AI in employment decisions. But Title VII of the Civil Rights Act of 1964, the Americans with Disabilities Act (ADA), the Age Discrimination in Employment Act (ADEA) and other anti-discrimination laws apply to a decision made with an AI tool just as they apply to any other decision. Federal officials are pushing for a more consistent national approach to AI regulation. Executive order 14365, issued Dec. 11, 2025, directed the attorney general to establish a task force to challenge certain state AI laws. The White House’s National Policy Framework for AI, released March 20, 2026, also called on Congress to override state AI laws considered unduly burdensome. The framework’s recommendations don’t override state laws on their own.  

What it means for HR: Continue following applicable state requirements where you have applicants and employees and monitor federal developments that could change your obligations. 

Illinois

An amendment to the Illinois Human Rights Act, enacted through House Bill 3773, took effect Jan. 1, 2026. It makes it a civil rights violation for employers to use AI in ways that result in unlawful discrimination based on protected classes or to use ZIP codes as a proxy for protected classes. It also requires employers to notify employees when they use AI for covered decisions, including recruitment, hiring, promotion, renewal of employment, training or apprenticeship, discharge, discipline and tenure. The Illinois Department of Human Rights proposed rules on when and how notice must be given in May 2026, then withdrew them in June. As of this writing, they have not been reissued. The notice requirement in the statute still applies. 

What it means for HR: Don’t wait for final rules. Give clear notice wherever AI touches a covered decision for Illinois applicants or employees and update your notice when the rules arrive. 

California

California has three sets of requirements to track: 

• Anti-discrimination regulations (in effect since Oct. 1, 2025): Civil Rights Council regulations clarify that using an automated decision system may violate California law if it harms applicants or employees based on protected characteristics. Tools that only assist human decision-making are covered, not just fully automated ones. Employers must keep employment records, including automated decision data, for at least four years. 

• Privacy regulations (beginning Jan. 1, 2027): For businesses covered by the California Consumer Privacy Act, California Privacy Protection Agency regulations require advance notice and provide rights to opt-out, subject to exceptions, and access information about certain automated decisions. These requirements apply when covered technology replaces or substantially replaces human decision-making in significant employment decisions. 

• No Robo Bosses Act (beginning July 1, 2027): Senate Bill 947, signed Sept. 30, 2026, bars employers from relying solely on an automated decision system to discipline or terminate an employee. If an employer relies primarily on a system’s output, a human must corroborate the decision using the underlying data or other relevant information. The employer must also provide written notice when communicating the decision. These protections cover employees, rather than applicants or independent contractors. 

What it means for HR: Inventory any tool that scores, ranks, flags or recommends, especially tools that feed discipline or termination. Document what your human reviewers actually examined and keep those records for at least four years. 

Colorado

Colorado replaced its original AI Act, enacted through Senate Bill 24-205, before its main requirements took effect. Signed in May 2026, Senate Bill 26-189 establishes a revised framework with compliance requirements beginning Jan. 1, 2027. It drops the original law’s impact assessments and risk management programs. When covered automated decision-making technology materially influences an employment decision, employers must: 

• Give advance notice that the technology will be used 

• Provide a plain-language explanation within 30 days after an adverse outcome 

• Provide a process to correct inaccurate personal data and, where commercially reasonable, request human review 

• Keep records needed to show compliance for at least three years 

The new law has no small employer exemption. The Colorado attorney general is still finalizing implementing rules, so details may change before the law takes effect. 

What it means for HR: Map which tools could materially influence employment decisions affecting Colorado applicants or employees. Prepare notices and procedures for explaining adverse outcomes, correcting data and handling review requests before Jan. 1, 2027. 

Connecticut

Connecticut enacted Senate Bill 5 in 2026. Since Oct. 1, 2026, an employer’s use of automated employment-related decision technology is not a defense to a discrimination claim. Beginning Oct. 1, 2027, covered employers using that technology to make, or substantially influence, an employment decision about a Connecticut applicant or employee must provide written notice before making the decision.  

What it means for HR: Identify tools that may trigger Connecticut’s notice requirements and prepare for compliance in 2027. 

Additional Considerations

New York City began enforcing Local Law 144 in July 2023. Before using covered automated hiring or promotion tools, employers and employment agencies must ensure an independent bias audit was completed within the previous year, publicly disclose required audit information and provide required notices. Covered applicants and employees must receive notice at least 10 business days before the tool is used. Requirements vary by jurisdiction, so employers should continue monitoring state and local developments. A sound AI governance approach combines appropriate human oversight with safeguards for fairness, transparency and accountability. 

6 Moments to Stop and Step Away From AI

Strong AI governance in HR starts with clear guidelines for when to stop, review or escalate AI use: 

1. When a decision affects someone’s job. Decisions about discipline, termination, performance ratings, pay and promotion need appropriate human review and consistent application of policy. Involve legal counsel when warranted. Beginning July 1, 2027, California requires human corroboration when an employer primarily relies on automated output to make a disciplinary or termination decision. 

2. When sensitive or identifiable data is involved. Names, IDs, medical information, Social Security numbers and banking details should never go into an AI tool. Use placeholders or anonymized examples instead. 

3. Before sharing AI-generated content. Treat content intended for employees, applicants or clients as a first draft. Review it for accuracy, clarity and appropriateness before sharing it. 

4. When someone expects legal advice or a compliance guarantee. Use AI-generated information as a starting point for research and refer legal questions to qualified counsel. 

5. When the risk of bias is high and the output can’t be validated. Don’t use unverified output to support an employment decision. Escalate for appropriate review before proceeding. 

6. When AI would replace your judgment. Pause, review the output and escalate when needed. 

Not Every AI Use Carries the Same Risk

Group your AI uses by risk and match the safeguards to each. Lower-risk drafting and research tasks can follow standard safeguards. Uses involving employee relations or performance documentation call for additional privacy, bias and HR review. In every case, AI output remains a draft that a qualified HR professional reviews, revises and approves. A useful screening question is, “Does the tool produce a score, ranking, recommendation or flag that influences a decision about a person?” If so, treat it as high risk, whether or not it’s marketed as AI. Before approving a new AI use, review its purpose, intended users, data inputs and potential impact on people. Uses involving personal, health, client-identifiable or financial information deserve heightened scrutiny and may be off-limits. Document approved uses, control changes to prompts and instructions and reassess periodically as laws, tools and business needs evolve.

4 Takeaways for Organizations

Even a small HR team can put these ideas into practice. 

1. Draw your red lines. Identify when AI may not be used and which employment decisions require additional review. 

2. Protect identifiable data. Use placeholders when drafting and only share personal or sensitive information through tools approved for that purpose. 

3. Know your tools and your notices. List every tool that touches hiring, performance, pay, discipline or termination, and confirm which state and local notice requirements apply to the people affected. 

4. Keep a paper trail. Record which tools you use, for what purpose and who reviewed the output. These records support accountability and may help demonstrate compliance. 

Retention requirements vary by jurisdiction and record type. Employers operating in multiple states may use the longest applicable retention period to set a consistent policy. Work with qualified counsel to determine whether records of AI use fall under those requirements and how long to keep them. Here are some of the retention requirements discussed above:

• Federal employment recordkeeping rule (29 CFR 1602.14)

  • Minimum Retention: 1 year from the record or personnel action, whichever is later

  • Notes: Applies to private employers covered by Title VII, the ADA or the Genetic Information Nondiscrimination Act (GINA); longer if a charge is filed.

• California Fair Employment and Housing Act regulations

  • Minimum Retention: 4 years from the record or personnel action, whichever is later

  • Notes: Expressly includes automated-decision system data.

• Colorado Senate Bill 26-189

  • Minimum Retention: 3 years from the date of the decision

  • Notes: Records needed to show compliance; begins Jan. 1, 2027.

AI can make HR faster. Clear governance is what keeps it trustworthy. Learn more about how isolved approaches responsible AI on our AI Ethics page, or talk with isolved HR Services about policies to guide AI use in your organization. 

^{Disclaimer: This post is for general educational purposes and is not legal advice. AI employment laws are changing quickly. Consult qualified counsel about your specific obligations.}