AI Governance in HR: Who Decides, Who Signs Off, and What the Board Sees

Ask who approved each AI tool your HR team uses. The vendor contract and the go-live date are easy to find. The name of the person who said yes is harder, and so is the rule for who may change that yes.

That gap is what AI governance in HR is for. This guide covers who decides what and how sign-off gets heavier as a decision nears a person. It also covers what the board sees each quarter and what happens when a system gets something wrong about someone.

HR AI maturity: what to tell the board covers the spoken answer in the board meeting. This post covers the structure behind it.

Who decides about the tool, and who decides with it

There are two kinds of decision in HR AI, and it pays to keep them apart.

The first kind is about the tool. Someone approves a new use, decides what data an agent may read or switches it off. The second kind is made with the tool. A recruiter decides who moves to interview, perhaps from a list the AI ranked or summarized. The AI did the sorting, but a person made the call.

Governance names who holds each decision about the tool, so the second kind stays with a person.

Here are the decision rights we’d write down first. The role column is yours to fill, and names matter more than titles.

Decision right	What it covers	Who holds it (fill in)
Approve a new use	A new agent, or an old agent doing a new job
Change what an agent may see	New data fields, new systems, a wider group of people
Change what an agent may do	From drafting to sending, from ranking to filtering
Pause or switch off a use	Stop it today, without a meeting
Answer an employee or candidate	Explain what the system did and who decided
Report to the board	Prepare and sign the quarterly page

“Pause” should sit with someone who can act the same day. If pausing needs a committee, nobody will pause. “Answer an employee” needs a named person too, because “the system” is not an answer.

Where a person decides: the human-decides line

AI can inform and surface in the systems we build. It can also rank, summarize or draft. A person makes every call about a person, and we build the system so it can’t do otherwise. We don’t build systems that decide hiring or pay on their own. The same goes for promotion, discipline and termination. That’s a design fact, not a policy line someone can waive later. Anything a works council or regulator would treat as high-risk gets the human-decides design in writing during the strategy step.

Past that line, where the controls sit and who signs off are your call. We recommend, and we put the recommendation in writing.

The HR Agent Map applies that rule to 122 agents across 12 HR functions. Each agent carries a verdict and a sensitivity label of low, medium or high. It also has the kind of human gate it needs and a list of guardrails. Our guide to AI agents in HR covers the agents that carry the “human-decides” verdict, and AI in HR gives the verdict counts.

Here’s one of them from the governance side. The Application Screening Support Agent carries the human-decides verdict, a high sensitivity label and an “approves” gate. The recruiter sees every application and decides who advances. The HR Agent Map marks it high because candidate ranking is regulated under NYC Local Law 144 and the EU AI Act’s high-risk rules, and because a decline is a decision about a person.

Three things follow for governance:

• A use like this needs sign-off at the top of your ladder. The recruiting team can’t approve it alone.
• Every summary and every ordering the agent produces goes in the log.
• The guardrails cover candidate notice, a bias audit, EU high-risk duties and works council consultation.

The law side of that agent is in our post on NYC Local Law 144.

Sign-off that gets heavier as the decision nears a person

A chatbot that answers leave-policy questions shouldn’t need the same approval as a tool that orders candidates. A RACI chart has no way to say so.

We use the labels from the HR Agent Map as the levels. Sensitivity says how close the output sits to a decision about a person. It labels 39 of its 122 agents high, 56 medium and 27 low. The gate kind says where the person sits. They approve or review the output before it goes out, or they set the rules the agent works within and can override it.

The two labels don’t line up neatly. A person approves on 30 of the 39 high agents and reviews on the other 9. None of them runs on rules alone. Setting the rules is the most common gate only among low agents, at 13 of 27. Medium agents are the mixed middle: 25 approve, 17 set rules and 13 review.

So the ladder below follows sensitivity, and each example shows its gate. The approver, evidence and review columns are our judgement. No regulator names this ladder. Treat it as a starting draft to argue with.

Sensitivity	Example agent and its gate	Who approves the use	Evidence they see before yes	Review cadence
Low	HR Policy Question Answering Agent: HR sets the sources and hand-off rules	HR AI owner	Source documents, a sample of answers, the hand-off rules	Every six months
Medium	Exit & Lifecycle Survey Synthesis Agent: the Head of People decides what is shared	HR AI owner plus the data owner	Sample outputs checked by a person, the data access list, proof that comments are de-identified before anyone reads them	Quarterly
High	Application Screening Support Agent: the recruiter decides who advances	Executive owner, after legal and security sign-off	Bias audit plan, notice text, log design, works council position where one exists, pause procedure	Quarterly, plus after any incident

Security review is the gate for every level, and nothing goes live until it passes. We’ve sat on the vendor side of those questions with our own product, inside other people’s companies. So on our builds the architecture document and data-flow diagram reach your security team before the first review. A written list of what AI will not decide goes with them. The system runs through your identity and your devices, and we hold no production credentials after handover.

If you score uses with the 10X Framework, the trust lens can help you place a use. It scores trust to earn from 1 to 5, where higher means more trust to earn. The framework’s tiers rank build order. They aren’t sign-off levels. How to prioritize HR AI use cases shows the scoring at work.

The trade-off: a heavy ladder slows low-risk work, and that’s how pilots stall. We’ve written about that in why HR AI pilots stall. Keep the bottom rung light on purpose.

The committee question

Ask for an AI governance model and you’ll usually get a committee. HR and legal sit at the table, along with IT, compliance and sometimes DEI. That list is sensible, but a list of departments still doesn’t tell anyone who can say no.

We’d split the work in two:

1. A working group that meets on a set rhythm. It runs the medium rung, keeps the inventory and the log, and prepares the board page. HR, legal and IT or security belong here. So does whoever owns your HR data. Add employee or works council representatives where they exist.
2. One executive owner signs the high rung and the board page. The working group escalates to this person. They can overrule the group, and the reason goes in the log.

Write the escalation route down. A medium use with a new data source goes up a rung. Any incident involving a decision about a person goes straight to the executive owner. A disagreement in the working group goes up, with both views on paper.

At a 500-person company this can be three people and a monthly half hour. What matters is that the roles have names, and that the person who can pause a system knows they can. At 5,000 people the group grows, but the shape stays the same.

HR should push for its seat. HR already governs the employment relationship, and AI that touches hiring, pay or performance sits inside that job. The CIPD made the same case in January 2026.

What the board sees, each quarter

Directors say the AI information they get is weak. PwC surveyed about 600 public company directors in 2026, as Corporate Compliance Insights reported. Some 66% rated the metrics linking AI outcomes to risk and business performance as fair or poor. Only 18% rated them excellent or good. Those are public company boards and it isn’t HR data. It may not describe yours.

Our answer is the same page every quarter. Here’s the one-page layout we’d use for the HR part of that conversation:

Section	What it holds
In use	Number of AI uses in HR, by sensitivity level. What’s new, changed or switched off since last quarter
Decisions AI sits near	Each high-sensitivity use, the decision it informs, and the named person who makes that decision
Sign-offs this quarter	Uses approved, sent back or paused, with the approver’s name
Incidents and questions	Bad outputs, employee or candidate questions, and how each was closed
Measures	One or two numbers per high use, each with an owner and a review date
Law and deadlines	What changed, what’s due, and what you’re doing about it
Asks	What you need from the board, if anything

The working group prepares it. The executive owner signs it. It goes out quarterly on the same date each time, so a missing page is itself a signal.

The measures row is where most pages go soft. Before the first page goes out, settle which number it is, whose it is and when it gets looked at. If those weren’t settled beforehand, there’s no answer worth having.

The register behind this page lives in the board maturity post.

The day an HR AI system gets it wrong

Plan for two kinds of failure before go-live: a summary that misstates what an employee wrote in a grievance, and a screening order that pushes a qualified candidate to the bottom. Here’s the path we’d write down for both:

1. The person who spots it tells the HR AI owner the same day. Anyone can raise it.
2. The owner decides within hours whether to pause. The default for a high-sensitivity use is to pause first and investigate second, with no meeting needed.
3. A named person checks the decision itself. If a person decided using the bad output, someone looks at that decision again with the right information.
4. A named person answers the employee or candidate. They explain what happened, what was checked and who made the final call.
5. The executive owner hears within a set number of days. You pick the number. Write it down.
6. The board sees it on the next quarterly page, or sooner through the route your board uses for other serious risks.
7. The use restarts only after sign-off at its rung. If the fix changed what the agent sees or does, it goes back through approval as a change.

Each incident gets a log entry. It records the date, the use and what went wrong. It names who was affected and who paused it, who answered the person, and who signed the restart.

A bad output about a person spends trust fast. We learned on our own users that people quietly route around a system they don’t trust. Some of them stopped until we changed how it worked. A planned pause costs less than that.

Where the law sets the pace

Keep what the law requires apart from what anyone recommends, us included.

Item	Status	Date
EU AI Omnibus	In force	27 July 2026
EU AI Act rules for high-risk systems in Annex III, where employment uses sit	Apply	From 2 December 2027
NYC Local Law 144 and US state rules	See our NYC Local Law 144 post	As listed there
SHRM’s call for transparency, human oversight and appeal rights for high-risk workplace AI	A policy position, not law	March 2026

The EU dates come from the European Commission’s AI Omnibus notice. The SHRM position is in its March 2026 statement, which asks for those rights where a use is reasonably likely to materially affect employment.

The decision rights, the sign-off ladder and the board page in this guide are our judgement. No regulator requires them in this form. We’d still build them now. December 2027 is close enough that a use you approve this year will likely still be running then.

How to start in the first month

You can have the bones of this in place in about a month. That’s how long our strategy step takes. It needs the CHRO and an HRIS or people analytics owner. It runs on a handful of working sessions of about two hours each and one data pull.

You should have these by the end of the month:

• An inventory of the AI already in use in HR
• A written list of what AI will not decide in your function
• The guardrails written down for your security team and works council
• A named person on your side for every number you plan to report
• The decision rights table above with names in every row
• A sign-off ladder that uses the HR Agent Map sensitivity levels and your own approvers
• A one-page version for the exec meeting, which becomes the first board page
• A prioritized and sequenced roadmap for what to build next

Our strategy step produces six of these. The decision rights table and the sign-off ladder are the two you fill in alongside it. The roadmap and business case are yours whether or not you go further. How to build an AI strategy for HR covers the rest of that month.

Book a 30-minute call to work it through with us. Bring the systems you already run. We’ll mark where the human-decides line falls in them, using the HR Agent Map as the reference. We’ll also show what you’d need to build on top of what you have.

Frequently asked questions