AI governance for HR: ownership, evidence and review

Create a practical AI register, assign accountable owners and review changes throughout the life of each use case. This practical guide to AI governance for HR brings together a step-by-step approach, illustrative examples, a reusable worksheet and answers to common questions. Start with the section closest to your current challenge, then use the working session to turn the guidance into a clear next action.

Govern the use case throughout its life

AI governance defines who may approve a use, what evidence is required and how the organisation responds when behaviour changes. It should connect to existing privacy, security, procurement and employment processes rather than create a separate committee with no delivery authority.

Start with an inventory of actual and proposed uses. Record the task, users, information, outputs and possible consequences. Include AI features embedded in existing software, not only standalone tools.

Assign responsibilities clearly

Name a business owner accountable for the use case and a technical or service owner responsible for operation. Identify the reviewers needed for data protection, security, legal issues and employee impact. Give users a clear route for questions and incidents.

Define who can stop or restrict a service and how the business continues without it. Accountability must remain clear when the supplier operates the model and another vendor provides the surrounding application.

Require evidence before approval

Document the purpose, information boundary, evaluation results, human review and remaining limitations. Use a level of review proportionate to the consequences, with specialist assessment for consequential employment uses.

The NIST AI Risk Management Framework organises risk work around governance, context, measurement and management. The register below is a practical adaptation for coordination, not a claim that completing a form establishes compliance with any law or standard.

Worked example: an added AI feature

Illustrative scenario: an existing HR supplier introduces automatic narrative summaries. The feature is not assumed approved simply because the underlying platform is already in use.

The owner checks the new data flow, contractual implications, access controls and output behaviour. A small approved test set includes incomplete records and conflicting information. The launch decision records permitted use, required review and stop conditions. If the supplier later changes the model, the owner assesses whether the original tests need repeating.

AI register worksheet

• Purpose and owner: What task is supported and who is accountable?
• Users and affected people: Who operates the service and who may be affected?
• Information: Which sources, permissions and retention rules apply?
• Evidence: What evaluation and specialist review support approval?
• Human control: Who checks outputs and who makes consequential decisions?
• Monitoring and incidents: What is recorded, who reviews it and who can stop use?
• Change and retirement: What triggers re-evaluation and how is the service ended?

Record an approval date, review date and any conditions. Keep a link to evidence rather than copying every document into the register.

Make review an operating habit

Monitor material errors, unexpected disclosures, user workarounds and changes in the task. Decide which issues require immediate suspension and which can be handled through a documented improvement plan. Preserve enough evidence to investigate without retaining unnecessary personal information.

Reassess after a significant model, data, workflow or policy change. Close a retired use case by ending access, handling retained records and confirming ownership of any remaining obligations. Use the acceptable-use framework for employee rules and the AI rollout guide for a controlled introduction.

Put the guide into practice

Set aside a working session with the people who own this process and one or two people who experience it. Use a fictional or appropriately authorised case, so the discussion can be specific without sharing unnecessary personal information. The purpose is to leave with a usable decision or document, not just agreement that the topic matters.

Prepare the case

List the AI uses already operating or being proposed, including features inside existing software. For each, describe the task, users, information and affected people. Identify an accountable owner. Do not assume a tool is low risk merely because staff describe it as an assistant or because a supplier enables it by default.

Write the starting assumptions down before discussing solutions. If the group disagrees on what happened, identify the information needed to resolve that difference rather than building a plan on an untested story.

Work through the decision

Choose one use case and assemble its approval evidence: purpose, data arrangement, evaluation, human review and remaining limitations. Ask who can accept each condition and who must be consulted. The register should point to meaningful evidence rather than contain only a green status and a service name.

Ask each participant to explain the proposed decision in their own words. Differences in interpretation often reveal an unclear criterion, a missing responsibility or an instruction that will be difficult to follow.

Test an exception

Introduce a significant model update, a new data source or a repeated error that reviewers miss. Decide whether the use should continue, be restricted or pause. Check who has authority to act and how the business continues. A governance process needs an operational response, not just a future committee meeting.

Record what changes in this situation and what remains the same. An exception should lead to a clear next step, with an owner, rather than an informal workaround that nobody can explain later.

Agree the handoff

Give the owner a review schedule and event triggers, along with incident contacts and retirement steps. Confirm how employees are told about changes to permitted use. Keep responsibilities clear across HR, IT, privacy, legal and suppliers so a gap is not passed between teams without resolution.

Finish by confirming the owner, the next action and the date when the result will be reviewed. Give the person receiving the work enough context to continue without repeating the whole discussion.

Frequently asked questions

Does every AI use need a committee?

The review route should be proportionate to the task and consequences. Some bounded uses may fit an established approval process, while consequential or complex uses need specialist review and senior accountability. What matters is clear ownership, appropriate evidence and authority to act. Creating a committee without defining decisions or operating responsibilities can add delay without improving control.

What belongs in an AI use-case register?

Record the purpose, owner, users, affected people, information, supplier, approval evidence, limitations and review triggers. Include how outputs are checked, incidents handled and the use ended. Link to controlled supporting documents rather than duplicating everything. Keep the register current when scope changes; an outdated inventory can create false confidence about what is actually operating.

When should an approved use be reassessed?

Reassess after material changes to the model, data, users, workflow, consequences or relevant requirements, and when monitoring reveals important failures. Define triggers before launch so review does not depend on someone remembering to ask. A scheduled review is also useful, but it should not delay a response to a significant incident or a change outside the original approval.

Review the first cycle

Check whether the register matches actual tools and whether owners can produce the evidence behind approval. Review how quickly material issues reach someone able to act. Simplify duplicate documentation, but preserve the information needed to understand decisions, conditions and remaining risks throughout the service’s life.

Keep a brief record of what was tried, what participants found useful and what needs to change. Compare the result with the original problem rather than judging success only by completion. If the process created extra work without improving clarity, quality or support, simplify it and test again. Share the agreed change with the people who will use it, and name the person responsible for keeping the guidance current.

About New Dynamics

New Dynamics connects goals, feedback, recognition and reviews around the way organisations work. This guide is published by the New Dynamics Editorial Team as part of our practical library for HR leaders, managers and People teams.

Use the examples and worksheets to structure your own discussions and adapt them to your organisation. Illustrative scenarios are not customer case studies. Policy and employment guidance needs appropriate local review before adoption.

For questions about this guide, corrections or a conversation about your performance management process, email contact@new-dynamics.com. Explore the complete guide library for related resources.