When an employee wants access to AI to analyze financial data, summarize a meeting, write strategy documents, or review an employment contract, HR should lead the way on answering three critical questions: who gets access, what data can they use, and who checks the end product and action?
At a previous company where I served, cost limited how broadly we made some AI tools available. Rather than giving more employees access, we created a divide between colleagues who had the tools they needed and those who did not.
That experience shapes my view of HR's responsibility: give employees equitable access to approved AI and help them build the skills to keep the business competitive. HR should also set clear expectations for how employees use AI in their work.
“HR should also set clear expectations for how employees use AI in their work.”
Nithya Das, Chief Operating Officer, GC AI
HR should work through these five steps with Legal, IT/security, and the teams requesting the tool. Then give employees clear instructions on approved tools, permitted information, and when to ask for help:
-
Define the task at hand and evaluate how AI can be used
-
Pick the AI tool, then, if not already approved, check the vendor, data, and security provisions with your legal team or AI governance committee
-
Define the human in the loop review
-
Record the approval and review date
-
Give employees instructions they can use.
Define the Task
Ask what information goes in, what comes out, and who receives it. Name the tool, account type, feature, and intended users. Include AI features inside existing workplace software and any permission to act in connected systems. Apply the same review process across roles and seniority levels; vary conditions with the data and consequences.
Context matters too. At a previous company, we considered requiring managers to use an AI recorder for every one-to-one meeting. I did not support that policy. I was concerned about candid feedback and direction, and about statements losing their context in a later dispute.
GC AI is an enterprise legal AI platform used by more than 2,100 legal teams, including SKIMS, Lockheed Martin, and TIME. Internally, our policies specify when employees should not use meeting recorders and when they must notify participants. Approval of a recording tool still needs boundaries around where and how people use it.
Check the Data and the Vendor
Our legal, technical, and security teams review AI tools, including Slack agents, to assess their functions, the data they read or store, underlying models, and owners. We have limitations on the types of data that can be used in certain tools and have declined others that do not meet our security or data-protection requirements.
Ask vendors what they retain, who can access it, where they process it, whether they or their model providers use it to train models, and how they separate your organization's data from other customers' data. Review their current subprocessor list, covering companies processing data on their behalf, for roles, locations, and change-notification arrangements. Verify answers against contracts and account settings.
At GC AI, we keep customer data ring-fenced by isolating it from other customers' data and encrypting it in storage and transit. Neither GC AI nor our model providers use it to train models.
Legal and privacy counsel should assess whether the use of personal data is lawful, what people must be told, and what contracts and cross-border transfers require. IT/security should check integrations, retention, permissions, and allowed actions.
Keep personnel files, investigation material, health information, and privileged advice out of workflows unless the relevant approvers have cleared them for that data. Removing names does not necessarily anonymize a document. Counsel should assess confidentiality and privilege before anyone supplies legal advice.
Ali Hartley, chief legal officer at SimplePractice, a practice-management platform serving more than 250,000 health and wellness practitioners, described this distinction in an interview with GC AI. Her company's AI guidelines ask, "What data are you inputting?"
They match tasks and data to permitted tools, with additional vendor requirements for protected health information. HR can apply the same approach: permission to research public information does not automatically extend to work involving employee health records.
Define Human Review
Be specific about what the person checks and when. For an email workflow, an agent could draft and save the message, while a human reviews it and presses Send. Set permissions to reflect that boundary. Our AI agent governance checklist expands on how to document permissions, approval checkpoints, and stop procedures for a workflow.
At GC AI, we expect candidates to use AI for take-home assignments and explain which tools they used and how. We also expect them to stand behind every word. We don't want AI to lower the talent bar. HR should make that accountability equally clear when assessing employees' AI use and performance.
For consequential people decisions, including performance, discipline, and dismissal, adopt a company rule requiring substantive human review before action. Give reviewers the competence, time, underlying evidence, and authority to disagree. If the proposed workload makes that impossible, narrow or pause the use.
In the UK, the UK GDPR requires a data protection impact assessment before processing likely to result in high risk to individuals' rights and freedoms. The ICO explains the threshold; it is not a requirement for every AI tool.
The automated-decision rules changed in February 2026. Under the amended framework, a decision is solely automated when there is no meaningful human involvement. For solely automated decisions based on personal data with legal or similarly significant effects, safeguards must include information about the decision and opportunities to make representations, obtain human intervention, and contest it.
Tighter restrictions apply when those decisions rely wholly or partly on special-category data, such as health or ethnicity information. Seek UK data-protection advice before approving such a process.
These statutory safeguards differ from the broader company review rule above. The ICO's recruitment examples show why each relevant stage matters: a later human interview cannot provide human involvement for applicants already excluded automatically. This does not make every screening or ranking operation solely automated.
Employers must also account for equality duties, including reasonable adjustments. The Equality Act 2010 covers applicants and employees in England, Scotland, and Wales; Northern Ireland has separate legislation. Check how disabled applicants or employees can obtain an appropriate adjustment when the process disadvantages them.
Record the Approval and Review Date
Record the tool, account, feature, users, data, jurisdictions, configuration, and allowed actions. Include assessment outcomes, conditions, named approvers and output reviewers, and approval and review dates.
I favor Legal and Tech jointly owning AI governance, with security and privacy expertise. Business owners should bring them new tools and uses for approval. HR should own access, skills, expectations, and employee communication.
Use a small, bounded pilot to weigh the benefits against the time and cost of setup, staff training, ongoing maintenance, and output checks. An onboarding assistant could use approved handbook sections to draft an answer about leave. HR should check its sources and the employee's entitlement before the new starter receives it. Test exceptions and questions the handbook cannot answer against verified responses. Narrow or stop the pilot if it invents entitlements or provides unverifiable sources.
Revisit approval when the model, vendor terms, data, permissions, or purpose changes. Name who monitors supplier changes and who can suspend use after a material error or data incident.
Give Employees Instructions They Can Use
At GC AI, employees receive an approved-tool list. We provide data-security training during onboarding. Our employees have a learning and development budget they can use for AI skills, and we have an Academy whereby former attorneys and legal professionals teach AI skills and education for customers and prospects.
A short guide should translate approvals into everyday instructions. For an email workflow using approved public information:
-
Use: Draft the message in the approved tool and company account, using only approved public information.
-
Check: Verify the facts, recipients, and attachments before you press Send.
-
Ask: Bring a new use, data type, or permission request to the named approval owners.
-
Pause: Stop and report an error or accidental disclosure through the company's reporting route.
Clay's AI-writing policy offers a useful example of employee responsibility for ideas, wording, and readers' time. Its writing-quality rules do not establish permission to supply confidential data.
HR can help employees practice judgment using approved tasks and public or synthetic inputs. Discuss why a public announcement, a customer record, and a confidential employee conversation need different treatment. People should be able to make sound decisions within approved boundaries without having to bring every routine task back to HR, Legal, or Security.
Five Questions Before Approving AI Use
-
What task and actions are we approving, and who could an error affect?
-
Is the data use lawful and necessary, and do the vendor's terms and settings support it?
-
Who checks outputs, owns decisions, and handles challenges to consequential decisions?
-
What conditions and sign-offs does the approval record contain?
-
When will we reassess, and who can pause the use?
Keep the answers with named owners and dates.
Help Employees Build Good Judgment
We cannot anticipate every AI scenario in a policy, so HR needs to teach judgment. Test that yourself: ask someone to explain which information they can use, what they must check, and when they need help. If the answer is unclear, improve the instructions or training. Employees' questions should help shape the next decisions about approvals, access, and support.
Author Bio
Nithya Das is Chief Operating Officer of GC AI, an enterprise legal AI platform. She previously held senior legal, operating, and people roles at Diligent, Olo, and AppNexus. She also chairs the Human Capital and Compensation Committee at Teads (Nasdaq: TEAD).
