How to build an AI strategy for HR, from use-case list to 12-month roadmap

Someone, maybe the CEO or the board, has asked you for an AI plan. You run people for a company somewhere between 500 and 5,000 employees, and you don’t have an AI team.

You probably have a list already, from vendors, managers and the recruiter who set up a chatbot nobody approved. What’s missing is a way to turn that list into a plan with dates, owners and numbers.

This guide walks through the method we use at Culturro in our own strategy month. By the end you’ll have a 12-month roadmap and a short list of use cases in build order. You’ll also have a written list of what AI won’t decide in your function, with a name against every number.

What you need before you start

• You. As CHRO or head of people you own the plan, and it can’t be handed to IT.
• An HRIS or people-analytics owner who knows where the data lives and what state it’s in.
• A handful of working sessions of about two hours each, for the two of you.
• One data pull between sessions to show what your systems actually hold. Our HR data readiness guide walks through it system by system.
• An honest read of where you stand today. If the board is asking, start with what to tell the board about HR AI maturity.

A list of ideas isn’t a strategy yet. A strategy says which ideas go first, who owns each one, what AI won’t decide and what gets written down. The rest of this post shows how to get there.

The 12-month HR AI roadmap at a glance

This calendar is an illustrative plan, not a client result. It shows how the year usually lays out when one use case goes first and the next ones follow behind it. Your months will shift with your security review and your data.

Month	Phase	What happens	Owner on your side	Written output
1	Strategy	Every idea goes through four checks and the survivors are sequenced. Guardrails and owners are written down.	CHRO, HRIS or people-analytics owner	Roadmap, business case per use case, guardrails, AI inventory, one-page exec version, go or no-go on building anything
2	Proof	The first use case is set up in a sandbox on synthetic or de-identified data.	Security team approves the data	A working sandbox
3	Proof	Your team uses the first use case for a couple of weeks.	The people who’ll use it, and the owner of its number	Accuracy, failure cases and cost per query on data shaped like yours
4	Proof, then build	The production decision is made and the build is scoped.	CHRO	Written go or no-go on production; build scope
5	Build	The first use case is built inside your environment. The architecture document and data-flow diagram go to the first security review.	Security team, HRIS owner	Security review sign-off
6	Build	You agree how people will use it and which number shows it’s working. The second use case starts its proof.	Owner of the number	Usage plan and agreed measure; second proof under way
7	Build	Onboarding is prepared and the usage and outcome report is set up.	HRIS owner	A report your team can pull without us
8	Build, then release	Code, documentation and runbooks are handed over. The support period starts.	IT, HRIS owner	Production system in your environment; handover pack
9	Release	The people who’ll use it are onboarded.	Line managers of those users	Onboarding done
10	Release, then review	The first usage and outcome numbers come in.	Owner of the number	First usage and outcome report
11	Review	The number is read against the one named in month 1, and the guardrails are checked.	CHRO, owner of the number	Written review
12	Review	You decide what comes next on the roadmap.	CHRO	Go or no-go on the next use case

The year runs several use cases, so it isn’t one long project. A single proof takes a few weeks, and a single build takes anywhere from a few weeks to a couple of months.

How to build an AI strategy for HR, step by step

The first five steps all happen in month 1 and share that one month. The sixth covers months 2 to 12.

Step 1: List every idea, including the AI you already use

Write down every idea on the table and don’t filter yet, because the four checks in step 2 do the filtering for you. That means ideas from you, your team and the vendors, plus ours if you work with us.

Add the AI already in use in HR as well. Count the features that were quietly switched on inside tools you already pay for.

Who: you and your HRIS or people-analytics owner. Written down: an inventory of AI already in use in HR, plus the full idea list.

Step 2: Run each idea through four checks

Every idea gets the same four questions, however good the vendor demo looked.

Check	What you’re asking
Worth	What is it worth if it works?
Cost of being wrong	What does it cost if it gets something wrong?
Data	What data does it need, and do you have it?
Use	Will people actually use it?

We score the answers with our 10X HR-AI Framework. It has three lenses, each scored 1 to 5. Impact asks which number the idea moves and how much of the work it takes on. Trust to earn asks what a wrong answer costs, whether a person decides and how sensitive the data is. Readiness asks where the data lives and whose name is on the number. On trust a low score is good, because it means there’s little to earn.

Tier	Name	Impact	Trust to earn	Readiness
1	Build now	4 or more	2 or less	4 or more
2	Proof first	3 or more	2 or less	3 or more
3	Build with guardrails	4 or more	3 or 4	3 or more
4	Not yet	Everything else	Everything else	Everything else

One rule overrides the table. An idea that would make a decision about a person on its own lands in Not yet, whatever it scores. How to prioritize HR AI use cases scores three real HR ideas end to end, so we won’t retell them here.

Who: you, your HRIS owner and whoever runs the scoring. Written down: a score and a tier for every idea.

Step 3: Sequence the survivors, safest and most provable first

Build now ideas go first, and Proof first ideas follow because they’re safe to try. Build with guardrails ideas can be built well, but they’re usually not your first build. They wait until a quieter win has shown people that HR runs AI carefully. Not yet ideas wait for their one fix and then get scored again.

Your first use case has two jobs. It has to solve a problem, and it has to show your security team, works council and CFO that HR can run AI responsibly. That trust is what pays for the harder ideas later.

The order sets the roadmap because the first use case takes months 2 to 8 in the calendar above, and the next one starts its proof while the first is still being built.

Who: you, with the scores from step 2. Written down: a prioritized, sequenced roadmap for your function.

Step 4: Write down what stays human and who owns each number

This is the step most strategies skip. We answer five questions in writing before anything is built:

1. Which number you already report would you most like to move?
2. Which of those numbers can AI actually help with?
3. In what order?
4. What stays human, no matter what?
5. Whose name goes on each number?

Question 4 is the one we hold firmest: we don’t build systems that decide about people on their own. Hiring and pay stay with a person, and so do promotion, discipline and termination. Your guardrails should say where your own line sits.

We learned this with Risely, our own product. What earns use is narrow scope, reasoning people can see and a person who makes the call. Some of our users stopped using it until we changed how it worked.

Question 5 looks like admin until the renewal meeting, when someone asks what the system actually moved. Settle which number it is, whose it is and when it gets looked at before you build. If you leave that until afterwards, there’s no answer worth having.

Who: you, and every number needs an owner on your side. Written down: the guardrails for your security team and works council, plus a named owner for every number.

Step 5: Write the business case and the roadmap per use case

Close the month with documents that people outside HR will read:

• A prioritized and sequenced roadmap for your function.
• A business case for each use case in the numbers your CFO tracks.
• The guardrails written down for your security team and works council.
• The inventory of AI already in use in HR.
• A one-page version for the exec meeting.

The month ends with a written go or no-go on whether anything is worth building at all. Sometimes the honest answer is “not yet”, and finding that out costs a month instead of a year of building something nobody can defend.

Who: you sign it, and your CFO should recognise the numbers. Written down: the five documents above and the go or no-go.

Step 6: Proof, build, release and review (months 2 to 12)

Each phase ends with something in writing and a decision about what happens next, so nothing rolls forward by default.

Proof (a few weeks per use case). The first use case runs in a sandbox on synthetic data, or on de-identified data your security team approves. The sandbox can sit with us or in your own cloud tenant. Your team uses it for a couple of weeks before the production decision is written against accuracy, the failure cases, cost per query and whether people reached for it. At the end the sandbox is torn down or handed to your team.

Build (a few weeks to a couple of months per use case, scoped after the proof). The system is built inside your environment under your security team’s controls. The architecture document and data-flow diagram come to the first security review. Before anything ships, you agree how people will use it and which number shows it’s working. At handover you get the code, documentation and runbooks, along with onboarding for the people who’ll use it.

Release and review (months 8 to 12). The people who’ll use the system are onboarded, and the usage and outcome report starts to fill with real numbers. You read the number against the one named in month 1 and check that the guardrails held. After that you decide whether the next use case goes ahead.

Where the roadmap goes wrong

No measure before building. SHRM’s 2026 research on AI in HR found that 56% of HR functions don’t formally measure the success of their AI investments. Only 16% use ROI as a metric (SHRM, April 2026). If you pick the number after launch, you’ll pick one that flatters the result.

HR left out of AI leadership. The same research found that 52% of organizations don’t involve HR in AI strategy or vision. Leadership of AI usually sits with IT, legal or a cross-functional team. HR then inherits tools it didn’t choose and can’t explain to employees. Ask for the seat before the plan is written.

Pilots without a definition of working. A pilot with no agreed measure can’t pass or fail, so it drifts. It’s the most common reason we see HR AI pilots stall.

Security review left to the end. Security review is the gate. If the architecture and data flow reach your security team in the last week, they’ll stop the project, and they’d be right to. Bring them the architecture document and the data-flow diagram at the start of the build instead.

Build the strategy yourself or bring in help

You can build this strategy with your own team, and everything above is written so you can. Your team knows the function better than any outsider. The harder part is judging what an idea costs when it’s wrong, or what data it really needs, without having built one before. That’s the trade-off, along with the time it takes.

Here’s what each route asks of you and what you end up holding at the end.

	Your own team	Culturro’s strategy month
What you get	Whatever your team writes using a method like this one	Roadmap, business case per use case, written guardrails, AI inventory, one-page exec version, written go or no-go
Effort on your side	All of it	You, your HRIS or people-analytics owner, a handful of two-hour sessions, one data pull
Length	Depends on your team’s time	About a month
Pricing basis	Staff time	One fixed fee, quoted after the first call
Who owns the result	You	You, whether or not you go further with us

We built the strategy month around the same four checks and five questions you’ve just read. Every idea gets scored the same way, ours included, so a vendor’s favourite and an idea from your own team are judged on equal terms. The line on what stays human is also written down before anything is built.

The roadmap and business case are yours whether or not you go further with us. If your own team will build it, we write the roadmap and the proof so they can, and then we hand over cleanly. Whatever gets built runs on your own systems, inside your environment.

See how the strategy month works, or talk it through with us in 30 minutes. If you also want to weigh up other firms, our guide to HR AI consulting firms sorts them by kind.

What to expect

Timeline. The strategy takes about a month. The calendar above puts the first use case into production in the second half of the year.

Effort. Month 1 needs you and your HRIS or people-analytics owner for a handful of two-hour sessions, plus one data pull. Later phases bring in your security team and the people who’ll use the system.

Cost. Budgeting for AI in HR covers what each phase tends to cost. Our strategy month is one fixed fee, quoted after the first call and scaled to the size and complexity of your function. Each later step is scoped and priced on its own. We don’t work on time and materials, and we hold no production credentials after handover. Your own providers bill you directly for hosting and model usage. A retainer is offered only after we’ve done the strategy together, and a delivered system doesn’t need one to keep running.

Your next step

Pull your idea list together this week, including the AI already in use. Book a 30-minute call and we’ll tell you which ideas survive the four checks. If you’d rather browse first, the HR Agent Map shows what each HR function can hand to an agent and what stays with a person.

Frequently asked questions