HR AI Usage Policy Template

When you need this

Your HRIS shipped AI features this year, which means you have an AI program whether anyone decided to or not. The first time someone asks for your policy, it is usually a diligence list or an employee who wants to know what the assistant can see. This template is the document we put in front of counsel, with an adoption guide that explains each section so you can defend it.

Inside the template

• Scope. Which tools and embedded features the policy covers, which classes of data, and who is bound by it. Written as an allowlist, because a named register of approved tools is enforceable and a line about good judgment is not.
• Guardrails for employee data. Four classes of data, from public to restricted, and which tools each class may touch. Health, leave, immigration and investigation records need a written exception or nothing.
• A named owner and an approval path. Who can approve a new tool, who can suspend one, and how a decision gets written down.
• Audit trail requirements. The six records a regulator or an acquirer asks for, from the AI register to the enablement log, with a retention floor to confirm with counsel.
• A one-page version for the all-hands. Plain words, circulated on its own, because a policy written for lawyers and filed in a wiki is a policy nobody reads.
• A clean copy in Word to adopt under your own name.

How to use it

1. Run the permission audit before you adopt anything. Embedded AI answers with whatever access the person asking already has, so your permission model is your real policy. Test with real accounts, since admin accounts see everything.
2. Inventory what is already switched on. Assistants and agents arrived as product updates, and a well-meaning admin may have enabled them on a slow afternoon.
3. Make the four decisions in the adoption guide: who owns it by name, where confidential people data may be processed, the cadence numbers, and what you tell people about AI use, and where.
4. Open a 30-day amnesty. Anyone using an AI tool with company data discloses it with no consequence. Enforcement starts the day after it ends.
5. Adopt the policy, circulate the one-pager, and put the review date in the document itself.

One thing to get right

The policy language goes through your counsel before anyone signs it. This is practitioner guidance. The template gives counsel something concrete to mark up instead of a blank page.