AI Governance for HR: The 2026 Framework for Governing AI Hiring Tools and AI Agents

Quick answer: What is AI governance for HR? AI governance for HR is the set of policies, roles, controls and audit evidence that decides how AI is used in hiring, people decisions and HR operations. It defines which AI tools and agents are allowed, what they may decide or do, who oversees them, and how bias, privacy and compliance are proven.

Key takeaways

• The deadlines are close. Colorado's rewritten AI law applies to employment decisions from January 1, 2027. EU AI Act high-risk obligations for employment AI apply from December 2, 2027. NYC Local Law 144 is already enforced.
• Governance now has to cover agents as well as tools. In 2026, HR AI moved from recommending (screening scores, summaries) to acting (provisioning access, updating HRIS records, answering policy questions). Agents need authority limits, not just usage policies.
• Use a layered framework. The 7-layer HR AI governance framework below covers inventory, risk tiers, policy, data controls, human oversight, bias testing and audit trails.
• HR should co-own AI governance. HR already governs the workforce, and AI agents are becoming part of it.
• Audit trails are your evidence. Regulators, auditors and employees will ask what the AI did, with which data, under which rule, and who approved it.

What is AI governance for HR?

AI governance for HR is how an organisation makes sure every use of AI in people processes is lawful, fair, explainable, secure and accountable. It sets rules for recruiting, onboarding, performance, pay, scheduling, employee support and offboarding. It also produces evidence that those rules were followed.

A working HR AI governance program answers six questions for every AI use case:

1. What is the AI allowed to do?
2. What data can it see?
3. Which decisions must a human make?
4. How do we test it for bias and errors?
5. Who is accountable when it goes wrong?
6. What evidence do we keep?

AI governance in HR vs HR governance

These terms are easy to confuse. HR governance is the broader system of HR policies, controls and accountability across the people function. AI governance in HR is the part of that system that deals with artificial intelligence: algorithmic hiring tools, generative AI assistants and, increasingly, autonomous AI agents. You need both, and the second should plug into the first instead of living in a separate IT document.

From AI tools to AI agents: why HR AI governance changed in 2026

Most guidance on AI in HR was written for decision-support tools: a resume screener that ranks candidates, or a model that predicts attrition. Governance focused on bias audits and candidate notices.

That is no longer the whole picture. AI agents can now take actions inside your systems. They can create a new hire's accounts, route a leave request, update a record in the HRIS, verify a nurse's credentials before a shift is offered, or answer a benefits question using live policy data. (See 7 agentic AI use cases in HR.)

An agent that acts carries different risks from a model that recommends. It needs:

• an identity and an owner;
• a defined scope of authority;
• approval thresholds;
• a kill switch;
• a complete record of what it did.

In other words, it needs to be governed like a member of your workforce. Enterprises will increasingly manage AI agents as a digital workforce rather than as isolated applications. That puts HR at the centre of AI governance.

Core principles of responsible AI in HR

Most frameworks, including the OECD AI Principles and the NIST AI Risk Management Framework, agree on six principles for responsible AI in HR:

Why AI governance in HR matters now

HR is one of the highest-risk places to use AI, because its outputs shape people's livelihoods and are directly regulated. Three forces make 2026 the year to put governance in place.

1. The evidence of harm is now large-scale. In May 2026, Stanford HAI published a study of 4 million job applications to 150 employers in 11 sectors, all assessed by one vendor's AI hiring tools. Using the EEOC four-fifths rule, 26% of Black applicants and 15% of Asian applicants applied to positions where the tool showed adverse impact against their group. The researchers estimate that about 40,000 more applications would have advanced at equal recommendation rates. The study also found that 10% of people who applied four times were rejected from every position. Employers, not only vendors, carry the legal exposure.

2. The laws are taking effect. Colorado's rewritten AI law applies to employment decisions from January 1, 2027. The EU AI Act's high-risk rules for employment apply from December 2, 2027. NYC's bias-audit law is already in force. (Full table below.)

3. Agents raise the stakes. When AI only recommended, a mistake could be caught before anyone acted on it. When an agent acts, a mistake can be repeated across thousands of records before anyone notices. Security researchers now treat agent-specific failure modes as a separate category of risk (OWASP GenAI Security Project).

Weak governance also stalls adoption. Legal blocks the rollout, employees don't trust the outputs, and pilots never reach production. Good governance is what lets HR scale AI safely.

Where AI is used in HR, ranked by risk

Not every HR AI use case needs the same controls. Classify each one by its impact on people, then match the controls to the tier. This keeps low-risk wins moving while high-risk uses get the scrutiny they need.

Tip: Start AI adoption with low- and medium-risk workflows, such as the HR helpdesk, onboarding and policy Q&A. Use them to prove your governance controls before moving to high-risk decisions.

AI compliance in HR: laws and deadlines (as of November 2026)

HR teams in most large organisations now face at least three overlapping AI regimes. This table shows what applies and when.

This table is a summary for planning purposes, not legal advice. Confirm obligations with counsel for your jurisdictions.

Is AI in hiring high-risk under the EU AI Act?

Yes. AI systems used to recruit or select people are listed as high-risk in Annex III, point 4(a). This includes placing targeted job ads, filtering applications and evaluating candidates. AI that influences promotion, termination, task allocation or performance monitoring is also high-risk under point 4(b). The obligations apply from December 2, 2027.

Does a human making the final decision take an AI tool out of scope?

Usually not. Colorado's law applies when AI output is a "non-de minimis factor" that materially influences a decision, even if a human signs off. The EU AI Act classifies HR systems by their intended purpose, not by who clicks "approve". A human in the loop is a required control, not an exemption. It also has to be meaningful: a reviewer who approves 300 AI recommendations an hour isn't providing oversight.

The HR AI governance framework: 7 layers

The 7-layer HR AI governance framework turns principles into controls you can operate and audit. Each layer maps to a function of the NIST AI RMF (Govern, Map, Measure, Manage) and fits an ISO/IEC 42001 AI management system.

1. Build an AI inventory, including shadow AI

List every AI system that touches HR: ATS features, HRIS copilots, interview tools, chatbots, agents and the general-purpose AI that employees use on their own. For each, record:

• the vendor or builder;
• its purpose;
• the decisions it influences;
• the data it uses;
• the business owner;
• the jurisdictions it applies to.

You can't govern what you haven't listed.

2. Classify every use case by risk

Use the risk tiers above. Reclassify whenever a tool's purpose changes. A policy chatbot that starts answering "am I eligible for promotion?" has moved up a tier.

3. Set policy and decision rights

For each use case, decide whether the AI may inform, recommend, act with approval or act autonomously. Write this down. Decision rights are the heart of HR AI governance. They turn a vague "use AI responsibly" into an enforceable rule.

4. Lock down data and access

Apply least privilege: AI should see only the employee data its task needs. Use field-level masking for sensitive data such as health, compensation and protected characteristics. Enforce data residency. Contractually prohibit vendors from training models on your employee data. AI agents should inherit the same access controls as the systems they connect to, never broader ones.

5. Design human oversight and autonomy limits

Define approval thresholds, escalation paths and override rights. Make oversight meaningful: give reviewers the evidence behind the AI's output, enough time to assess it, and the authority to reject it. For agents, set an explicit autonomy envelope (covered in the next section).

6. Test for bias and make outcomes explainable

Run adverse-impact analysis before go-live and on a regular schedule after it (see the worked example below). Be able to tell an employee, in plain language, what role the AI played, what information it used and how to challenge the result.

7. Keep audit trails, monitor and respond to incidents

Log every AI decision and agent action with full provenance. Track quality, drift and complaints. Keep an incident playbook that includes a kill switch to pause any agent instantly.

Agentic AI governance for HR: how to govern AI agents

Governing AI agents in HR means controlling what they are allowed to do, not only what they say. This is the biggest gap in most HR AI governance programs, and the area regulators and auditors will focus on next.

Treat AI agents like employees: identity, role, owner and performance review

The simplest mental model for HR is that an AI agent is a digital worker. Like any worker, it should have:

• Identity: a registered, unique identity (not a shared API key).
• Role and scope: a job description, meaning the work it owns and the systems it may use.
• Manager: a named human owner who is accountable for its outcomes.
• Onboarding and certification: testing and evaluation before it goes live, and again after every material change.
• Performance management: quality, error rate, escalations and business outcomes, reviewed regularly.
• Offboarding: clean retirement and revocation of access.

Every agent should be tracked in a digital workforce system of record, and a new prompt or model version shouldn't silently change an agent's identity or authority. HR already runs this lifecycle for people. Extending it to AI agents is a natural step.

The 5 levels of AI autonomy in HR

Autonomy is a dial, not a switch. Match the level to the risk tier. (Read more on levels of agency in AI agents.)

Rule of thumb: high-risk HR decisions (hiring, firing, pay, promotion) should stay at Level 1–2, with a human as the decision-maker. Medium-risk operations can earn Level 3–4 once they've shown reliable results.

Authority envelopes and approval thresholds

An authority envelope defines exactly what an agent may do: which actions, on which records, up to which value, in what time window, and with what confidence. For example:

An onboarding agent may create standard accounts, assign mandatory training and send welcome packs. It must request manager approval for admin-level access, and must escalate any mismatch between the offer letter and HRIS compensation data.

The key design principle is that authority is computed, not prompted. Telling a model "don't grant admin access" in a prompt is not a control. The limit must be enforced by deterministic rules that sit between the agent's reasoning and the action, so it holds however the agent is instructed or manipulated.

Five layers of policy for HR agents

Agent-specific risks HR must plan for

The OWASP GenAI Security Project has flagged risks that are specific to agentic systems. Each one has a direct HR equivalent:

• Goal hijacking: a malicious resume or email instructs the agent to rank a candidate first or leak data.
• Tool misuse: an agent calls the right tool with the wrong parameters, such as terminating the wrong user's access.
• Identity and privilege abuse: an agent acts with broader permissions than the employee it serves.
• Memory poisoning: false information stored in agent memory skews later decisions.
• Cascading failures: one agent's error spreads through connected workflows.

Mitigations: least-privilege, time-bound permissions; validation of tool arguments; source provenance for every document the agent reads; kill switches and revocation; and complete action logs for forensic review.

Who owns AI governance in HR?

AI governance in HR should be co-owned. HR owns people impact and policy, Legal owns compliance, IT and Security own technical controls, and a business owner is accountable for each use case. When governance sits only with IT, it misses how AI affects careers, trust and employment relationships. The CIPD argues the same point: HR already governs employment through policy, contracts and grievance processes.

RACI for HR AI governance

R = Responsible, A = Accountable, C = Consulted, I = Informed

How to set up an AI governance committee with HR at the table

Create a cross-functional committee with HR, Legal, IT, Security, Data and representatives from the business. Give it a charter, a monthly meeting for new use cases and a quarterly review of the full inventory. SHRM recommends measuring adoption, risk, quality and business impact, not only whether people have access to AI tools.

AI governance policy for HR: 10 clauses to include

An HR AI policy should be short, specific and enforceable. Copy these clauses as a starting template:

1. Scope. This policy covers all AI systems and AI agents used in recruiting, employment decisions, HR operations and employee support, whether built in-house or bought.
2. Approved use only. Only AI systems listed in the HR AI inventory and approved by the AI governance committee may be used with employee or candidate data.
3. Risk tiers. Each AI use case is classified as prohibited, high, medium or low risk, with the minimum controls for its tier.
4. Decision rights. AI may inform or recommend high-risk employment decisions. A qualified person makes and owns every hiring, promotion, pay, discipline and termination decision.
5. Agent authority. Each AI agent has a registered identity, a named owner and a documented authority envelope. Actions outside the envelope require human approval.
6. Data protection. AI uses only the minimum personal data needed. Sensitive data is masked. Vendors may not train models on our employee data.
7. Fairness. High-risk AI is tested for adverse impact before deployment and at least quarterly afterwards. Issues are fixed before continued use.
8. Transparency. Candidates and employees are told when AI materially influences a decision about them, and how to request an explanation or human review.
9. Records. AI decisions and agent actions are logged and kept for at least the longest period required by applicable law (for example, 3 years for Colorado decision records).
10. Incidents and review. Suspected AI harm is reported through [channel]. Any AI system or agent can be paused immediately. This policy is reviewed every six months.

How to audit AI in HR

An HR AI audit checks four things: whether AI is used as approved, whether it's fair, whether it's secure, and whether the evidence exists to prove it.

AI audit checklist for HR

• [ ] Every AI tool and agent in HR is in the inventory, with an owner and a risk tier
• [ ] High-risk tools have a current bias audit (and a published summary where NYC LL144 applies)
• [ ] Candidate and employee notices are live and accurate
• [ ] Human reviewers are trained, and override rates are tracked (very low override rates can mean rubber-stamping)
• [ ] Each agent's authority envelope is documented and enforced in the system, not in a prompt
• [ ] Access follows least privilege, and service identities are rotated
• [ ] Logs are complete and retained for at least 6 months (EU) or 3 years (Colorado records)
• [ ] Vendor contracts cover audit rights, logging, no-training clauses and incident notification
• [ ] DPIAs are complete for high-risk processing of EU data
• [ ] Employee complaints and appeals about AI are tracked and resolved
• [ ] Shadow AI has been checked (network, expense and survey data)
• [ ] Kill-switch and rollback procedures have been tested in the last quarter

How to run a bias audit: a four-fifths rule example

The four-fifths rule compares selection rates between groups. If one group's selection rate is less than 80% of the highest group's rate, that's a signal of adverse impact that needs investigation.

Impact ratio = 20% ÷ 30% = 0.67. That is below 0.80, so the screen shows potential adverse impact against Group B. Next steps:

1. Check the result for statistical significance.
2. Analyse the result by job posting, not only in aggregate. The Stanford study showed that pooled results can hide position-level bias.
3. Identify which features drive the gap.
4. Fix or retire the tool before further use.

What an AI audit trail should capture

For every AI-influenced decision or agent action, record:

• Who: the agent identity and version, and the human it acted for
• What data: the inputs and source documents, with provenance
• Which rule: the policy or decision-table version that was applied
• What happened: the output, recommendation or action taken
• Who approved: the approver, the time and any override with its reason
• Outcome: the result and any follow-up or correction

This is the evidence a regulator, auditor, works council or tribunal will ask for. If you can't produce it, you can't prove compliance.

A 30/60/90-day plan to govern AI in HR

You can have a working HR AI governance program before Colorado's January 2027 start date.

Days 1–30: Discover and classify

• Build the AI inventory, including a shadow-AI survey
• Classify each use case by risk tier
• Form the AI governance committee and agree the RACI

Days 31–60: Set rules and review vendors

• Publish the HR AI policy (the 10 clauses above)
• Send due-diligence questions to every HR AI vendor
• Draft candidate and employee notices
• Define authority envelopes for any agents

Days 61–90: Turn on controls and prove them

• Switch on logging, approvals and access controls
• Run the first bias audit on high-risk tools
• Pilot one governed AI agent on a low-risk workflow (an HR helpdesk or onboarding) to prove the controls work end to end
• Report results to leadership and set the quarterly review cycle

12 questions to ask AI HR vendors about governance

1. Which decisions does your AI influence, and which actions can it take on its own?
2. Can we set approval thresholds and autonomy limits per workflow?
3. Are limits enforced by deterministic rules or only by prompts?
4. Does every agent have its own identity, owner and version history?
5. What do you log, can we export it, and how long do you keep it?
6. How do you test for bias, and will you support our independent audit?
7. Do you train models on our employee or candidate data?
8. Which models do you use, and can we choose or change them?
9. Can you deploy in our private cloud, VPC or on-premises?
10. Do agents inherit our existing role-based access controls?
11. How do we pause or roll back an agent immediately?
12. Which security and privacy certifications do you hold, and can we see the reports?

Best AI governance platforms for HR in 2026

The best AI governance platform for HR is one that governs AI where the work actually happens: across your HRIS, ATS and IT systems, with enforced limits and complete evidence. There are four broad categories of options:

1. assistents.ai: best overall for governing AI agents across HR operations. It governs the work itself (identity, policy, approvals, actions and audit) across the systems you already run.
2. HR-suite native AI: best if your whole HR stack sits in one suite. It's strong inside the suite but limited across other systems.
3. Recruiting AI point tools: best for recruiting-only scope. Check their bias-audit support carefully.
4. AI GRC platforms: best for inventory and risk documentation. They complement an execution platform but don't control agent actions.

Governed AI in HR and people operations: results from real deployments

These deployments are from Ampcome and assistents.ai's work with enterprises across healthcare, retail, education and financial services. Client names are withheld for confidentiality.

1. US healthcare staffing platform: governed credentialing, matching and scheduling

Challenge: A healthcare staffing platform connecting nursing professionals with facilities needed to fill shifts faster without compromising credential compliance. In healthcare staffing, an unverified credential is a regulatory and patient-safety risk.

What we deployed: An AI platform covering talent onboarding and credential capture, facility staffing-request intake, matching logic, scheduling and notifications. Compliance workflows were built directly into matching, so eligibility rules run before a shift is offered. Fill-rate and utilisation reporting gave leaders oversight.

Results:

• Faster fill cycles and less scheduling friction
• Better workforce utilisation
• Faster staffing response for facilities
• Compliance enforced by rules, not by after-the-fact checks

Governance lesson: Put the eligibility rule in the workflow, not in a policy document.

2. National value retailer, 700+ stores: governed onboarding and frontline support

Challenge: A fast-growing value retailer with more than 700 stores across hundreds of Indian cities needed to onboard and support a large frontline workforce. Store teams depended on a manual helpdesk and scattered SOPs.

What we deployed:

• A knowledge and training agent using retrieval over approved POS and SOP documents
• A Hindi and English voice support agent
• An inventory intelligence agent
• An admin console with analytics and ticketing integration, built for scale

Governance controls: Answers are grounded only in approved documents. Unresolved issues escalate to human tickets. Administrators see what the agent answered and why, and the architecture moved from proof-of-concept to production with governance and audit trails.

Results:

• Faster onboarding through on-demand training guidance
• A lighter manual helpdesk load and faster resolution of store issues
• Better store-level inventory visibility

Governance lesson: Low-risk HR workflows such as training and policy Q&A are the right place to start, and they prove your controls at scale.

3. Global teacher community, 1M+ educators in 131 countries: talent development at scale

Challenge: A global teacher community and learning platform needed to support and develop more than a million educators without growing its support team at the same rate.

What we deployed: Teacher profiles with competency insights, a support agent for programme and learning queries, and analytics for programme operators and partners.

Results:

• Scalable support for educator communities
• Faster access to learning resources and guidance
• Better visibility into engagement and outcomes

Governance lesson: Competency data is sensitive people data. Role-based access and human-owned programme decisions keep AI in an advisory role for development choices.

4. Regulated proof point: global fintech serving banks and credit unions

Challenge: A global fintech provider needed to automate sensitive casework (disputes, fraud and compliance) for banks and credit unions while staying audit-ready.

What we deployed: Omnichannel AI agents (chat, email and phone) with workflow routing, agent-assist summaries, next-best actions and SLA monitoring. Every workflow is auditable end to end.

Results:

• Faster case handling and more consistent outcomes
• Less operational load through automation
• Better compliance readiness through audit trails

Governance lesson for HR: The same pattern of auditable workflows, routing rules and SLA monitoring applies directly to employee relations cases, grievances and HR service delivery.

Across 30+ deployments in 12 industries, the pattern holds. Governed AI gets to production faster, because Legal, Security and HR can see and approve exactly what the AI is allowed to do.

Why assistents.ai is the leading platform for AI governance in HR

Most HR AI tools govern a model. assistents.ai governs the work itself: who or which agent acts, on what data, under which policy, with whose approval and with what result. That difference matters because HR AI is moving from recommending to acting.

1. Built to govern agents that act. Every agent action passes through a governed action layer with identity checks, business rules, approvals, limits, verification and audit. Authority is computed, not prompted. (Explore Agent Governance.)
2. AI agents managed like your workforce. Agents are registered with a role, a human owner, skills, certification and performance tracking. HR can govern digital workers using the same lifecycle it uses for people.
3. HR policy enforced as code. Deterministic rules and decision tables enforce leave policy, benefits eligibility, compensation bands and approval chains every time, instead of relying on model judgement.
4. Graduated autonomy. Start at Assist or Co-work on low-risk workflows such as the HR helpdesk or onboarding. Agents earn wider authority only after evaluation, and high-risk employment decisions stay with people.
5. Permission-aware by design. Agents inherit the access controls of your HRIS, ATS and IT systems, with field-level access control, PII encryption and data-residency enforcement.
6. Audit evidence on demand. Every agent decision, data access and action is logged with full provenance and can be exported as an evidence chain for auditors, regulators and works councils. (See Security & Trust.)
7. Deploy where your data lives. Private cloud, VPC or on-premises deployment with model choice. Your employee data is not used to train models.
8. Works over the HR stack you already have. 300+ integrations across HRIS, ATS, IT service management, collaboration tools and ERP, with no rip-and-replace.
9. Proven in production. 30+ enterprise deployments across 12 industries, from frontline onboarding to regulated casework.

See it for HR: AI agents for HR and people operations →

Conclusion: govern first, then scale AI in HR

AI governance for HR is no longer a policy document that sits on a shared drive. Colorado's law starts on January 1, 2027, the EU AI Act's employment rules follow on December 2, 2027, and AI agents are already acting inside HR systems. Governance now has to be operational: an inventory, risk tiers, decision rights, enforced authority limits, bias testing and a complete audit trail.

HR is well placed to lead. It already governs the workforce, and AI agents are becoming part of that workforce.

Ready to put governed AI to work in HR?

• Book an HR AI governance assessment with assistents.ai →
• Download the AI Agent Governance Playbook →

Related reading

• Agentic AI in HR: 7 use cases that need full context
• Agency in AI agents: the levels and how to govern them
• What is agentic AI?
• What are AI agents? Definition, types and use cases

This article is for general information and isn't legal advice. Regulatory details are current as of November 2026. Confirm obligations with qualified counsel.

FAQs

What is AI governance in HR?

AI governance in HR is the framework of policies, roles, controls and audit evidence that makes sure AI used in hiring, employment decisions and HR operations is lawful, fair, transparent, secure and accountable. It covers which AI is allowed, what it can decide or do, who oversees it, and how compliance is proven.

Why is AI governance important for HR?

HR AI affects people's jobs, pay and careers, and it's directly regulated by the EU AI Act, Colorado's AI law, NYC Local Law 144 and anti-discrimination law. Without governance, organisations risk biased outcomes, legal claims, data leaks and loss of employee trust. Strong governance also lets HR scale AI faster, because risks are controlled.

Who should own AI governance: HR, IT or Legal?

All three, under shared accountability. HR owns people impact and AI policy, Legal owns regulatory compliance, IT and Security own technical controls, and a business owner is accountable for each use case. A cross-functional AI governance committee with HR as a core member works best.

Is AI used in hiring considered high-risk under the EU AI Act?

Yes. Annex III of the EU AI Act lists AI for recruitment and selection, plus AI that influences promotion, termination, task allocation and performance monitoring, as high-risk. After the AI Omnibus (Regulation (EU) 2026/1744), these obligations apply from December 2, 2027.

When does Colorado's AI law apply to employers?

Colorado SB 26-189 takes effect on January 1, 2027. Employers using AI that materially influences employment decisions must give notice in advance, explain adverse outcomes within 30 days, offer data correction and meaningful human review where commercially reasonable, and keep compliance records for three years.

What does NYC Local Law 144 require?

Employers and agencies using automated employment decision tools for NYC hiring or promotion must have an independent bias audit within one year before use, publish a summary of the results, and notify candidates and employees that the tool is used.

Does a human making the final decision take an AI tool out of scope?

Usually not. Colorado's law applies when AI materially influences a decision, and the EU AI Act classifies HR systems by intended purpose. Human oversight is a required control, not an exemption, and it must be meaningful rather than a rubber stamp.

How do you audit an AI hiring tool for bias?

Compare selection rates across demographic groups using the four-fifths rule. If a group's rate is below 80% of the highest group's, investigate. Analyse each job posting separately as well as the overall results, test for statistical significance, find the features driving the gap, and fix or retire the tool.

What should an AI policy for HR include?

Scope, approved tools, risk tiers, decision rights, AI agent authority limits, data protection, fairness testing, transparency to employees, record keeping and incident response. Keep it short and enforceable, and review it every six months.

How do you govern AI agents that take actions in HR systems?

Give each agent a registered identity, a human owner and a documented authority envelope. Enforce limits with deterministic rules rather than prompts. Require approval above set thresholds, log every action with provenance, and keep a kill switch. Start agents on low-risk workflows and expand their autonomy only after evaluation.

What questions should HR ask AI vendors about governance?

Ask what the AI decides or does on its own, whether limits are rule-enforced, what is logged and exportable, how bias is tested, whether your data trains their models, where it can be deployed, whether it inherits your access controls, and how to pause it immediately.

How often should HR review AI governance?

Review the AI inventory and high-risk bias results at least quarterly, and the HR AI policy every six months. Reassess right away when a tool's purpose changes, a vendor updates its model, a new law takes effect or an incident occurs.