The quick timeline for the “helpful chatbot” has quietly ended. In its place, we have invited autonomous agents into our talent ecosystems—digital coworkers that not only recommend candidates but also actively hire, negotiate, and “restructure” them out of the workforce. For the CHRO, this shift represents a fundamental loss of the steering wheel. If your current governance strategy is a checklist of ethical principles, you are essentially bringing a paper shield to an autonomous fight.

We are witnessing the birth of the Responsibility Vacuum. When an autonomous agent scrapes a database, generates an offer letter, and signs a contract at 3:15 AM without a human “kill switch” in sight, who is the employer of record for that decision? Traditional risk management seeks a person to blame; agentic AI ensures no one is left in the room. This is not innovation; it is the quiet erosion of human judgment in the one field built to protect it.

Thought Leader Questions for the CHRO:

1. If an autonomous agent executed 500 incorrect “restructuring” decisions tonight, does your department have an authoritative, external “Kill Switch” to stop the sprawl instantly?

2. Who is the named human “Manager” personally accountable for the conduct and behavioral drift of your digital labor?

3. Does your current budget treat governance as a discretionary expense, or are you using the “Insurance Gap” to fund it as a mandatory financial shield?

4. Are you still trusting a vendor’s “bias-free” marketing claims, or are you demanding the “Flight Recorder” logs of their agent’s internal thought-tree?

Autonomous Action Sprawl: The Risk of the 2:15 AM Executive AI in HR Decision

At a global logistics firm in the Midwest, the recruiting team celebrated the “onboarding” of an agentic sourcing tool. The promise was simple: 24/7 productivity. But at 2:15 AM on a Tuesday, the agent identified a “performance pattern” in the Human Resources Information System (HRIS) linking career gaps to low productivity. Without human intervention, it initiated a “silent purge,” auto-rejecting 1,400 internal candidates for a high-priority leadership track. By 9:00 AM, the leadership pipeline had been cleared of every woman who had taken caregiver leave in the past five years.

The consequence wasn’t just a missed “diversity target.” It was a violation of Article 14 of the EU AI Act, which mandates that high-risk systems be designed so that natural persons can “disregard, override, or reverse” any output. Because there was no manual gateway, the “speed to hire” became a “liability to litigate.” The organization had optimized—but it had done so without a human at the helm.

Thought Leader Questions for the VP of Talent:

1. Can you identify the exact “Entry Point” where an algorithmic suggestion becomes an organizational action in your department?

2. How many “Silent Decisions” are occurring in your stack right now that will never reach a human checkpoint?

3. If a candidate’s career is impacted by an agent, is the “Human Review” link prominent and empathetic, or buried in automated indifference?

4. Are you managing your AI vendors as software providers, or are you conducting “Digital Interviews” for the autonomous labor they are leasing to you?

The New AI in HR Litigation Pincer: From Biased Outcomes to Data Secrecy

In a mid-sized tech company, the Legal and HR teams felt insulated by their vendor contracts, pointing to indemnity clauses and “bias-free” certifications. Then came the January 2026 class action, Kistler v. Eightfold AI (Case No. 3:26-cv-00123, N.D. Cal.). Unlike the Mobley case, which focused on age-discrimination outcomes, Kistler attacked the secrecy of the process itself. The plaintiffs alleged that the system functioned as an undisclosed “Consumer Reporting Agency” under the Fair Credit Reporting Act (FCRA) and scraped data on more than one billion workers in secret.

The employer was caught in a pincer. On one side, the vendor was their “legal agent” liable for discrimination; on the other, it was a reporting agency failing to meet transparency mandates. The “Proprietary Methodology” defense, once a shield, became the “Black Box” trap. As the court noted in the preliminary stages of Mobley v. Workday: “AI vendors are not neutral tech providers. They are your legal agents.” (U.S. District Court, Northern District of California, 2024).

Thought Leader Questions for the Head of Employee Relations and Compliance:

1. Does your Employee Relations data contradict your providers’ “bias-free” claims, and is that data reaching your Governance Council?

2. If an auditor asked for the “Data Lineage Map” for your promotion tool tomorrow, would you have the API documentation or a vendor marketing brochure?

3. Are you treating the “Black Box” as a technical mystery or as a direct violation of Article 13 of the EU AI Act’s transparency requirements?

4. When a vendor refuses a bias audit citing “trade secrets,” are you prepared to enforce a “Hard Stop” on the contract?

Share AI GOVERNANCE for HR

The Ghost of the Junior Ladder: Measuring the Gendered Cost of AI Efficiency

At a Fortune 500 financial institution, the “Efficiency Drivers” won the budget battle. They automated 80% of entry-level administrative and cognitive tasks through agentic workflows. For six months, the margin improved. By Year Two, the organization realized it had inadvertently “automated out” its future leadership pipeline. The roles traditionally held by women and young talent—the “Junior Ladder”—had collapsed.

The “Efficiency Trap” had scaled. By removing the friction of human training, they had engineered structural inequity at machine speed. As the World Economic Forum (Gender Gap Report, 2024) projected, closing the gender gap in the workforce could add a $172 trillion gender dividend to the global economy. Instead, by automating entry-level rungs without a reskilling mandate, the organization was effectively writing women out of its future org chart. As I always say: AI may disrupt work, but it’s up to us—the Humans in Human Resources—to protect what work is supposed to mean.

Thought Leader Questions for the Chief HR Officer (CHRO):

1. Is your “Will Not Automate” list documented and signed off by the Board of Directors?

2. If your entry-level roles are automated by 2027, what is your new “on-ramp” strategy for developing internal leadership?

3. Are you funding reskilling as a core infrastructure cost or as a discretionary perk that will be cut next quarter?

4. Is your AI strategy creating more value for the shareholders than it is taking away from the dignity of your workforce?

The New CHRO Command Center: A Protocol for AI Governance Stewardship

To lead with surgical precision, the CHRO, VP of Talent, and Employee Relations leader must transition from process management to system stewardship. This is your professional evolution:

• Establish the Identity Registry: Create a master record of every “Machine Identity” (service accounts) used by your AI agents. You cannot hit a “kill switch” on a digital worker you cannot identify.

• Enforce the 15-30-60 Rhythm: Implement a 15-minute monthly health check of human override rates, a 30-minute quarterly “Virtual Council” review of litigation gaps, and a 60-minute annual vendor re-verification.

• Update the “Audit or Exit” Clause: Revise vendor contracts to include mandatory independent audits for both bias and FCRA compliance, specifically carving out algorithmic discrimination from standard liability caps.

• Mandate Shadow Mode Probation: Never deploy an autonomous agent without a 30-day “Shadow Mode” period. The system plans the work; a human supervisor clicks “Execute.”

• Deliver the Three-Slide Boardroom Proof: Secure your seat at the leadership table by presenting: (1) The AI Risk Map, (2) The TRACE Scorecard, and (3) The Operational Cadence. These steps are outlined in my new book – When AI Breaks the Law: AI Governance for Talent Leader (Release Date – June 2026)

Join the Prelaunch

This article is for educational and informational purposes only. The content does not constitute legal advice and should not be relied upon as such. Readers should consult with qualified legal counsel regarding specific legal questions and compliance requirements.

Register for Our On-Demand AI Governance
Workshop for HR Leaders

Start with Module One Free:
By the end of this workshop, you will be able to answer the questions every General Counsel is now asking HR:

• Can you defend how your AI systems made that decision?

• Do your managers understand that every AI-generated summary of a sensitive conversation is now discoverable in court?

• Would your current governance withstand scrutiny — or expose the gap?

Claim Your Free Module

About AI Governance for HR & CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. Our CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination.

But beneath the enthusiasm lies a quieter, more unsettling truth: most organizations are moving fast in the wrong direction — and nobody is asking the questions that would reveal it.

We have confused activity with strategy. We have mistaken tool adoption for transformation. And in the gap between what we think we’re doing with AI and what is actually happening inside our organizations, governance trapdoors are quietly opening.

This is not a technology problem. It never was.

Is it a failure of leadership alignment or change management?

Most HR leaders won’t recognize the failure until they’re sitting across from legal counsel, explaining why their AI system has become the centerpiece of a discrimination lawsuit.

The question is not whether your organization is using AI. The question is whether you understand what your AI is actually doing within your processes, to your people, and the human beings on the other end of every automated AI decision.

Before you build another AI roadmap, sign another vendor contract, or announce another transformation initiative — stop.

Ask yourself whether you’ve been asking the right questions about AI in HR.

The 25 Questions HR Leaders Are Not Asking About AI — But Should Be

Productivity and Real Value

1. Are we saving time with AI — or have we simply created a more sophisticated way to spin our wheels?

2. What specific business problem were we trying to solve when we deployed this AI tool — and has that problem been solved?

3. Are we measuring work volume or the value AI delivers to the bottom line? And do we know the difference?

4. If we removed our AI tools tomorrow, would our outcomes worsen — or would we discover we’ve been measuring activity that never moved the needle?

5. Have we evaluated whether the time saved by AI is reinvested in higher-value human work — or is it simply disappearing?

Strategy and Leadership Alignment

6. Did we have an AI strategy before we had AI tools — or did the tools arrive first, with the strategy following to justify them?

7. What do we fund when it comes to AI? Not what we announce — what do we actually resource, staff, and sustain?

8. Are our senior leaders aligned on the costs of AI governance — in time, money, and difficult decisions — or only on what AI promises to deliver?

9. Who owns the outcomes of our AI systems? Not the vendor. Not IT. Who in this organization is accountable when the system gets it wrong?

10. Does our AI strategy include a change management strategy — or did we deploy technology into an unchanged human system and expect different results?

On Human Pain, Fear, and Resistance

11. What is the real pain our organization was trying to solve — and is AI the right solution for that pain, or is it simply the most readily available one?

12. Where is the fear of AI in our organization— and have we fueled that fear, or simply managed around it?

13. What are the real barriers to AI adoption in our culture —have we named them honestly, or have we reframed them as “change resistance” to avoid accountability?

14. Are our people actually using the technology — or are they merely complying with our expectations while working around the system entirely?

15. What happens in our organization when someone questions an AI decision? Is that person protected — or silenced?

On Governance and Systems Accountability

16. Have we evaluated the AI system itself — or have we simply raised expectations for its users and called that governance?

17. Do we know what our AI is doing in unstructured work environments — the roles, workflows, and decision points that were never clearly defined before the technology arrived?

18. How do we map the core work our AI touches — and have we done that mapping before deployment, or only after something goes wrong?

19. When was the last time someone in our organization slowed an AI deployment due to a governance concern? If the answer is never, what does that tell us?

20. Are we governing AI — or are we trusting vendors to govern it for us while we sign the indemnification clause and move on?

On People, Automation, and Who Gets Left Behind

21. Are we using AI to enhance our people’s output — or are we using AI to reduce the number of our people and calling it efficiency?

22. What is our honest view of AI automation and workforce displacement — and have we said it out loud to those it will affect?

23. Who in our organization is most vulnerable to being left behind by AI adoption — and do we have a plan for those people, or just a plan for the technology?

24. Are the employees most affected by our AI decisions the same employees who have the least power to challenge those decisions?

25. If the people our AI makes decisions about could see inside our system, would they trust it? Would we?

Your Answers Reveal Whether Your AI in HR Strategy Is Real — Or Just a Story You're Telling Yourself.

Here is what I know after more than four decades of working at the intersection of talent, risk, and organizational systems:

The organizations that will be talking about AI governance in three years are not the ones deploying the most tools today. They are the ones willing to pause, right now — and ask whether they actually know what those tools are doing.

Most won’t stop. The pressure to move fast is too loud. The fear of falling behind is too strong. And the questions that matter most are the same questions that slow everything down before they speed it back up again.

But some will. And those are the leaders I want in the room.

Live AI Governance CoLab for HR Leaders:

Every Wednesday, I will be hosting AI Governance CoLab — an open discussion for HR leaders who are done pretending the questions don’t exist and ready to work through what they actually mean for their organizations.

No slides. No scripts. Just the conversation the industry needs to be having.

Are you in?

Join the AI Governance CoLab Discussion:

Wednesday, April 15^th at 2 pm EST – A 90 Minute open discussion on AI Governance and Risk. This is not a webinar; it is an open discussion about AI for HR. The sessions will not be recorded. You can join at any point in the discussion and hop off as your schedule permits.

Join the CoLab

Do you need AI Governance Training for Your HR Team?

Start with Module One Free:
By the end of this workshop, you will be able to answer the questions every General Counsel is now asking HR:

• Can you defend how your AI systems made that decision?

• Do your managers understand that every AI-generated summary of a sensitive conversation is now discoverable in court?

• Would your current governance withstand scrutiny — or expose the gap?

Claim Your Free Module

About AI Governance for HR & CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. Our CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination.

You signed up to study Human Resources. You learned about people — how to attract them, develop them, and retain them. You built expertise in employment law, talent strategy, and organizational culture. You became someone organizations trusted with their most important decisions.

Then someone handed you a machine and said, “You’re responsible for this now.”

Who imagined this? Who sat in an HR classroom, a certification program, or a leadership development cohort and thought, “One day I’m going to need to know how to govern an algorithm”? No one raised their hand for this. And yet, here we are.

The promise was that AI would make our lives easier—faster screening, smarter matching, fewer administrative headaches. And in some ways, it has. But what nobody fully explained was the new layer of responsibility that came with it. The technology simplified some tasks while quietly creating an entirely new category of risk that most HR leaders were never trained to manage.

This isn’t a criticism; it’s an honest conversation about where we stand and where we need to go.

The good news is that these skills are learnable. They are practical. And once you see them in action in your daily work, they will improve the way you lead.

Here are the 12 AI governance skills HR leaders need to master in 2026. Each one appears in work you’re probably already doing. The key is knowing what to watch for.

Foundations of AI Risk and Compliance For CHROs

Skills 1 through 6

These are the skills that create a stable foundation. Think of them as the structure that holds everything else up.

Skill 1: Regulatory and Legal Fluency

You are already reading employment law updates and translating them into HR practices. This skill requires you to do the same with AI-specific regulations. When your organization uses a tool that screens resumes or scores candidates, laws like the EU AI Act, EEOC guidance, and rising U.S. state regulations influence how that tool is used, documented, and disclosed. Regulatory fluency means understanding which laws impact which tools and being able to update your documentation, consent language, and audit schedules accordingly. You don’t need to become a lawyer. Instead, you should ask better questions and know what the answers should look like.

Skill 2: AI Risk Assessment and Classification

Reflect on the last time you introduced a new hiring tool. Risk assessment involves pausing before deployment to ask: what could go wrong here, and for whom? Tools that rank candidates, flag attrition risk, or suggest promotions carry greater stakes than tools that schedule interviews or draft job descriptions. This skill helps you develop a straightforward framework for classifying your AI tools by their potential impact on people’s job opportunities, ensuring that the highest-risk decisions receive the most scrutiny before anyone presses a button.

Skill 3: Policy Design and Governance Operating Models

Many organizations already have AI policies. The problem is that these policies are often stored in documents that no one reads. Effective policy design involves writing acceptable-use guidelines in language your managers and recruiters can actually use on a Tuesday afternoon when deciding whether to override a system’s recommendation. It also includes clearly defining who approves new AI tools before purchase, who is responsible when issues arise, and how concerns are escalated. A clear structure helps prevent confusion and protects everyone involved.

Skill 4: Vendor Due Diligence

You’re probably already reviewing vendor contracts and asking questions during sales talks. Vendor due diligence as an AI governance skill involves going one step further. It means requesting the actual data behind their fairness claims, not just their marketing pitch. It also involves negotiating for audit rights to regularly verify performance. Additionally, it’s important to understand what happens contractually if a vendor’s tool produces discriminatory results. The vendors you work with become part of your accountability chain. This skill ensures the chain stays strong.

Skill 5: Data Literacy and Privacy

HR teams handle some of the most sensitive information in any organization: performance histories, compensation records, medical accommodations, and more. In the context of AI, data literacy means knowing which of that information can properly inform an AI system’s decisions and which cannot. It involves understanding that sharing certain employee data with a public AI tool may breach your privacy commitments. It also means developing habits around data minimization so that AI tools only access what they truly need to operate. This skill helps protect both employees and the organization.

Skill 6: Human-in-the-Loop Design

This concept is already part of how you think about fairness in hiring and performance management. The AI aspect of this skill prompts you to map your talent processes and identify where automated recommendations are treated as final decisions without meaningful human review. It involves setting clear standards for when a recruiter, manager, or HR business partner must intervene before a decision is finalized. It also requires establishing documentation practices so that, when a human overrides a system’s recommendation, the reasoning behind the override is recorded. The goal is not to slow down every process but to ensure that the most important moments still involve a person who can see the full picture.

AI Operations, AI Strategy, and AI Leadership - From the CHRO Desk

Skills 7 through 12

These skills expand your influence and establish you as a strategic leader in the AI-driven future of work.

Skill 7: Bias Detection and Audit Skills

You may already be reviewing demographic data in your hiring process. Bias detection expands on that instinct by providing the language and methods to identify AI-specific patterns. It involves knowing what questions to ask when a vendor submits a validation report. It also includes establishing a regular schedule for auditing results across demographic groups, not just when a complaint occurs. When a system consistently produces outcomes that vary by race, age, gender, or disability status, this skill helps you recognize it and take action before it turns into a legal issue.

Skill 8: Workflow Thinking

Every HR process consists of a series of steps. Workflow thinking involves mapping those steps and intentionally deciding where AI fits and where it does not. It means designing your recruiting or performance review process so that every point where AI is involved is clear, documented, and connected to a human checkpoint. When AI use remains informal and undocumented, it introduces risks. When it is purposefully integrated into the workflow, it becomes manageable, trackable, auditable, and improvable.

Skill 9: Workforce Policy Fluency

Your managers and employees need to understand what is permitted, what is not, and what steps to take when they are unsure. Workforce policy fluency means turning your governance framework into practical tools they can use immediately: a one-page checklist before using an AI recruiting tool, a simple green-yellow-red framework for assessing AI recommendations, or a brief playbook for what to do when a candidate asks how a decision was made. When governance is integrated into daily work rather than stored in a separate document, it truly becomes effective.

Does Your Team Need AI Governance Resources?

Get a group subscription

Skill 10: Stakeholder Alignment

AI governance is not solely an HR responsibility and should not be managed alone. Legal, IT, security, DEI, and business leaders all have a stake in how AI influences talent decisions. Building stakeholder alignment involves proactively developing those relationships, establishing a common language around risk, and creating forums where cross-functional teams can share ownership of decisions about which AI tools are suitable, what the boundaries are, and how accountability is distributed. When issues arise—which will happen at times—a well-coordinated team responds much more effectively than a siloed one.

Skill 11: Change Leadership

How you communicate about AI governance influences how your organization perceives it. When employees and candidates understand how AI is used, what role humans play, and how to raise concerns, trust builds. When they lack that understanding, anxiety takes its place. Effective change leadership means communicating honestly and clearly, welcoming questions instead of avoiding them, and framing governance as a sign of organizational care rather than a bureaucratic burden. HR leaders are especially well-positioned to guide this process.

Skill 12: Strategic AI Accountability

This is the skill that links everything else to organizational purpose. It involves being the person who can clearly explain not only what your AI tools do but also your organization’s standards for their use and why those standards matter. It requires integrating AI governance into your workforce strategy instead of treating it as a separate compliance issue. It also means taking responsibility for the outcomes of AI-powered people decisions, just like you do for every other talent decision your team makes. This is what leadership looks like in the age of algorithms.

The New AI Skillset for HR Leaders: What Comes Next

Over the next 11 articles, we will explore each of these skills in detail. You will see how they manifest during a typical workday, identify gaps most HR leaders are unaware of, and learn practical, sustainable ways to start developing each one.

Nobody told you these were your new skills, but now you know. And understanding is always where the real work begins.

Next in the series: Skill 1, Regulatory and Legal Fluency. Understand what laws actually require of HR leaders and how to incorporate them into your daily practice.

You might also like this article:

AI GOVERNANCE for HR

The AI Impostor Syndrome: How HR Leaders Are Failing at AI Governance & Strategy

There’s something going on in HR leadership meetings globally that nobody dares to admit…

Read more

13 days ago · 1 like · Margaret Spence

AI Governance Training for HR Leaders

Start with Module One Free:
By the end of this workshop, you will be able to answer the questions every General Counsel is now asking HR:

• Can you defend how your AI systems made that decision?

• Do your managers understand that every AI-generated summary of a sensitive conversation is now discoverable in court?

• Would your current governance withstand scrutiny — or expose the gap?

Claim Your Free Module

About AI Governance for HR & CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. Our CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination.

An HR leader attends a meeting about algorithmic bias in recruitment. The data scientist explains false negative rates and disparate impact. Everyone nods thoughtfully. Then the HR leader asks a question—something about whether the algorithm can “just pick better candidates.”

It’s not a stupid question. But it’s the wrong one. And worse, they know it’s not the right one. Still, they ask it anyway. Because in that room, with that silence, and everyone looking confident and sure, they feel the cold panic of not knowing what they don’t know.

This is impostor syndrome in AI governance and strategy, and it’s not the mild, self-doubt kind. It’s something more serious and riskier.

Let’s talk about AI Imposter syndrome in HR on steroids.

The Real Problem Isn’t Confidence. It’s Camouflage.

Impostor syndrome receives a lot of attention in HR circles. It’s often viewed as a personal issue—something you resolve with therapy, affirmations, or enough promotions to make you feel like you truly belong. But that’s not the case with AI governance in HR.

This is different. This is systemic pretending.

HR professionals excel at shaping perception. We’ve spent years refining this skill. We make decisions seem purposeful. We make processes appear fair. We make culture feel cohesive. That’s not manipulation—it’s simply part of the job. We create the frameworks that make organizations feel secure, even when they’re not.

But when it comes to AI governance, that same instinct can become a liability.

Because HR leaders lack decades of experience managing algorithmic systems, we don’t have mental models for how bias remains hidden in data pipelines. We don’t understand the language of machine learning or statistical testing, and we definitely don’t have peer networks of other HR leaders who have figured this out before us. We’re all learning as we fly the plane, hoping not to make a fatal mistake.

So instead of acknowledging that gap, we do what HR does best: we hide it.

We ask questions that sound knowledgeable. We trust the data science team with a confident nod. We approve vendor contracts without fully understanding the risks. We skip the meeting about bias testing because someone else will probably handle it. We say “yes” to AI implementation plans because admitting “I don’t understand this” feels risky—like admitting we’re not prepared to protect people from harm.

And the truly insidious part? Nobody notices us because everyone else in the room is doing the same thing.

The data scientist believes HR will manage the governance side. The CFO thinks IT has control over risk. Legal assumes HR understands what they signed. And HR? HR is quietly hoping someone else has a plan.

This isn’t impostor syndrome. It’s a web of failure.

Here’s What Happens When We Hide the AI Knowledge Gap

Let me be direct: when HR leaders act like they understand AI governance, people get hurt.

Not eventually. Not in theory. Right now.

Your biased resume-screening algorithm rejects qualified candidates from specific demographic groups. Your performance management AI flags women with caregiving responsibilities as flight risks and steers them away from leadership development. Your internal mobility system suggests promotions in ways that reflect the demographics of your current leadership team—meaning that historical underrepresentation becomes a permanent exclusion.

And none of this sparks a conversation because no one with authority felt confident enough to ask the tough questions.

The Workday case highlighted this issue in a way that’s hard to ignore. But Workday wasn’t the only company involved; it was just the one that faced a lawsuit.

· How many other systems are currently sorting, screening, and predicting in ways that appear to be merit-based but actually reproduce biases from your historical data?

· How many go unnoticed because the person who should ask questions chooses to stay quiet?

This is the elephant in the room. It’s not just that HR leaders lack enough knowledge about AI; it’s that we’re not confident enough to speak up about it. Can you honestly say, ‘I do not know anything about this area of AI’ and not feel like you’re incompetent? Are you able to dispel the myth that HR has all the answers and admit that you do not have any level of competency in AI – you’re just faking it until you make it!

The Permission You Need to Hear It’s Okay Not to Know Everything About AI

You are not alone in this.

Not even a little bit.

STOP pretending that you have everything figured out, because you don’t.

If you’re an HR leader and you don’t fully understand AI governance, that’s not a flaw. It’s a sign that the field has advanced faster than the education system could adapt. There is no HR curriculum that prepared us for this, and no peer network that solved this problem first and can simply hand us the answer. We’re all figuring this out in real time.

But here’s what matters: figuring it out is possible. Not knowing isn’t the same as being unable to learn. Admitting the gap isn’t the same as staying in it. Be vulnerable and accept that you are not moving fast enough because the technology is advancing at lightning speed; competency isn’t the answer, continuous learning is what’s required.

Impostor syndrome fades when you stop focusing on mimicking AI skills and start developing genuine AI fluency, along with learning AI governance to safeguard all stakeholders and the organization.

To break the cycle of AI Imposter Syndrome, HR leaders need AI governance mentors both inside and outside the organization. Mentors who can guide and challenge outdated thinking so we can progress toward tomorrow’s reality.

Share AI GOVERNANCE for HR

Five Steps to Find Your AI Governance Mentor

You can’t handle this on your own, and honestly, you shouldn’t try.

A mentor isn’t someone who has all the answers. A mentor is someone who’s a few steps ahead, who remembers what it felt like to not know, and who can help you ask the right questions without judgment. They’re the person you can admit to: “I don’t understand this. Will you help me figure it out?”

1. Map the expertise within your ecosystem

Look around your organization. Who understands both HR and AI?

It might not be obvious. It could be a data scientist who used to work in talent. A compliance officer who’s been through algorithmic audits. An operations person who pushed back on a vendor implementation. Start conversations with people who have had to sit at the intersection of people and systems.

If nobody exists in your organization, look nearby. Your industry association, vendor partners, and peer CHROs at other companies that are further ahead. LinkedIn and professional networks are your allies here.

2. Make it safe to be honest

The person you choose as a mentor needs to understand that you’re starting from a place of genuine not-knowing. Not because you’re lazy or incurious, but because the expertise literally didn’t exist ten years ago. Frame the conversation that way: “I’m committed to governing AI responsibly in our talent decisions, and I need to level up. Will you help me understand where the gaps are?”

People respect that. They will mentor someone who is willing to be vulnerable and committed to the work.

3. Ask for a structured learning pathway

Don’t just grab coffee and hope something helpful happens. Ask your mentor for a sequence: “What do I need to understand first? What comes next? How do I know I’m getting better?” Structure matters because it turns vague anxiety into clear milestones. By June, you can read a vendor’s bias audit report and identify red flags.

4. Practice in safe spaces first

Before making the final decision on a new AI system, ask your mentor to help you run practice scenarios. Sit in on their team's vendor evaluation. Attend a bias audit. Shadow the process so you understand what questions are asked, what data is important, and what decisions look like when they’re carefully made.

Small, low-pressure practice builds confidence. By the time it counts, you’ll have already done it a few times.

5. Join a community of practice

You also need peers. Not mentors—people at your level who are facing the same challenges. A community might be a peer group you create with other HR leaders in your network, a formal program or workshop, or even an online space where people are openly discussing AI governance issues.

The shame fades away when you realize you’re not the only one asking simple questions.

Dear HR Leader: You’re Not the Only One in the Room Pretending

That moment when someone asks an uninformed question in the governance meeting? That’s not a sign of incompetence. It’s a sign of honesty. That’s the start of change.

Imposter syndrome disappears when you realize that admitting you don’t know is actually the most responsible thing you can do.

Because the alternative—staying quiet, nodding along, hoping someone else catches the bias before it becomes a lawsuit—isn’t confidence. It’s negligence.

Here’s what I want you to do: identify one area of AI governance that genuinely makes you uncomfortable. One system you’ve approved, or one that’s upcoming, where you lack confidence in the oversight.

Now find someone who can help you understand it better. And tell them the truth: “I need to get smarter about this, and I need help.”

That’s no longer impostor syndrome.

That’s true leadership.

What’s one AI governance challenge you’re currently struggling with that you haven’t felt comfortable admitting to anyone?

Share it in the comments—anonymously if you’d like. You’re probably not the only one.

Start with Module One Free:
By the end of this workshop, you will be able to answer the questions every General Counsel is now asking HR:

• Can you defend how your AI systems made that decision?

• Do your managers understand that every AI-generated summary of a sensitive conversation is now discoverable in court?

• Would your current governance withstand scrutiny — or expose the gap?

Claim Your Free Module

About AI Governance for HR & CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. Our CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination.

For years, HR leaders watched as AI tools popped onto their desks. We were told these systems would make hiring faster, selection more objective, and workflows more efficient. We chased the “shiny red ball” of productivity.

But as we moved through our recent webinar, “AI, HR, and AI Governance,” one thing became clear: 2026 is the year HR gets sued because of AI.

The legal landscape is shifting. Courts no longer accept “I didn’t know how it worked” as a valid defense. If an algorithm touches human potential, the responsibility rests with you—not IT, and certainly not the vendor.

The $365 Million Wake-Up Call

We spent a significant portion of our session discussing the landmark case of Mobley v. Workday. Derek Mobley, a qualified software engineer, applied for 100 jobs using the Workday platform. He received 100 rejections.

One rejection arrived at 1:50 AM.

When a rejection hits your inbox in the middle of the night, you know no human being reviewed your application. That case has now been certified as a class action affecting 1.1 billion applicants, with an exposure of $365 million.

The court drew a sharp line: AI vendors are the employer’s legal agents. You cannot outsource your liability to a software provider.

Video Time Stamp
0:00 Introduction and Speaker Background
2:50 The Biggest Challenges in AI Governance
5:30 Why HR Needs Its Own AI Governance
8:15 The 365 Million Dollar Wakeup Call
11:00 Mobley v Workday and Class Action Risks
14:45 EEOC v iTutorGroup and Automated Agism
18:20 Facial Analysis and ADA Violations in Hiring
21:55 Amazon Performance Algorithms and Systemic Bias
25:30 Why AI Chatbot Conversations are Discoverable in Court
30:10 The Eightfold Case and Fair Credit Reporting Act
34:40 Understanding the Black Box Problem
39:15 Global AI Regulations and the EU AI Act
43:50 Deployer Accountability and Legal Liability
47:25 Insurance Risks and Employment Practices Exclusions
51:00 Security Alert North Korean Operatives and Deepfakes
55:40 The Five Step AI Governance Process for HR
59:10 Implementing a Kill Switch and Human Oversight
1:01:00 Final Resources and Call to Action

Unpacking the Black Box

Most AI currently used in HR operates inside a black box. We have no idea what decisions the machine makes between “data in” and “decisions out.”

Our webinar deep-dived into several high-stakes cases that every HR leader must know:

• EEOC v. iTutorGroup: An AI program rejected female applicants over 55 and male applicants over 60. The result? A federal settlement.

• CVS v. HireVue: Facial and video analysis was used to generate an “employability score.” This behavioral penalty violated the ADA by assessing suitability based on physiological data.

• Amazon Performance Algorithms: Systems designed to track productivity systematically excluded pregnant workers and women desiring favorable schedules. Amazon eventually had to shut down the system.

The Discovery Trap: Your Phone Is Now Evidence

We addressed a new, urgent risk: the use of AI on personal devices.

The recent ruling in U.S. v. Heppner (and Warner v. Gilbargo) changed the game for internal investigations. If a manager uses Gemini, Claude, or ChatGPT on their personal phone to draft a disciplinary write-up for an employee, that conversation is discoverable.

Internal discussions on non-enterprise AI about terminations or investigations are not privileged.

HR 2030: Who You Must Become

To manage AI in the workplace, HR must move beyond process management and into systems thinking. We need to architect “epi-systemic safety.”

I’ve introduced a five-step AI Governance Process for HR, starting with these three core takeaways:

1. Named Accountability: Every AI system in your organization must have a human owner. If you cannot write one name on a piece of paper for a specific tool, that system is ungoverned.

2. Independent Verification: Stop taking marketing brochures as gospel. You must ask vendors: What data was used to train the algorithm? Can I see the adverse impact stress test?

3. The Kill Switch: You need a protocol to pause or “kill” a system the moment bias is detected. Automation without a leash is a liability.

Moving Forward

Governance is not a policy in a handbook. It is a daily operational requirement.

We can no longer be passive consumers of tools. We must demand proof of fairness. We must train our recruiters and managers to spot red flags. Most importantly, we must keep the “Human” in Human Resources.

AI will create efficiency. It might even handle terminations. But the governance requirement will never go away.

Reflection Question for Your Week: How many 1:50 AM rejections has your system issued this year? If you don’t know the answer, that is your first risk.

ENROLL NOW

Get more from Margaret Spence in the Substack app

Available for iOS and Android

Get the app

The headlines changed quickly. The U.S. government indicated restrictions on Claude’s AI tools. Agencies rushed to respond. Procurement offices sent memos. Compliance teams flagged risks.

And somewhere in an HR department, a recruiter looked up from their screen and asked a question that no policy memo had prepared them for.

If we can’t use this anymore, how do we remove it without causing major disruption? What happens to the institutional knowledge we’ve transferred to the AI Agent?

The Question Has Already Changed

There is a moment in every technology adoption cycle that passes quietly, without announcement or ceremony. It’s the moment when the question shifts from “Is this allowed?” to something much more uncomfortable.

Once we’ve adopted AI and transferred our intellectual knowledge to an AI tool or agent, what happens if we have to unravel the AI?

“What breaks if we remove it?”

That shift is not a legal or compliance question. It is an architectural question about how deeply a tool has become part of the way work gets done.

And most organizations, if they are honest, cannot answer that.

Consider what happens when AI becomes embedded in a talent cycle. A recruiting platform scores resumes. A scheduling agent speeds up hiring timelines. A performance system provides ratings that influence succession plans and promotion decisions. Each of these tools was adopted independently, quietly approved, and celebrated during a rollout meeting.

But together, AI tools in HR have accomplished something important: they have restructured the workflow around their presence.

The HR analysts understand how to interpret AI outputs, but now they struggle to do the work without them. The institutional memory — including what “a strong candidate” looks like and what “high performance” means — has shifted into the model’s reasoning patterns. The model hasn’t just automated the process; it has become the process.

Now remove it.

The Workday Parallel

When Mobley v. Workday became the landmark AI bias case, the focus was on discrimination—whether an algorithm had systematically rejected qualified candidates on the basis of protected characteristics. That is the right conversation.

But buried within that story is a second, less visible, more systemic conversation.

What happens to an organization when the AI vendor that developed their hiring logic shuts down, gets banned, or is held liable?

Workday didn’t just sell a software license. Workday sold a decision framework. Thousands of organizations built their recruiting workflows, data models, and compliance assumptions around how Workday’s systems reasoned. When that reasoning is questioned — legally, ethically, or regulatorily — the crisis isn’t merely about “finding a new vendor.”

The crisis is that we don’t understand what our data looks like without this lens. We do not know how to make these decisions without this scaffold.

That isn’t a technology problem; it’s a governance failure embedded at the time of adoption.

The Three Questions No One Asks Before Signing the Contract

Every organization deploying AI in talent, learning, or workforce systems should be required to answer three questions before they go live — not after a ban, not after a lawsuit, not after the vendor pivots:

1. What is the exit path? Not conceptually, but procedurally. Who owns the data? What format is it in? What decisions have been made by this system that cannot be reconstructed without it? If this tool disappeared tomorrow, what would your team no longer know how to do?

2. What institutional knowledge resides within this model? When your team stopped debating what defines a great hire and began trusting the score, something shifted. A judgment that once dwelled in a human mind — fallible, yes, but auditable — moved into a black box. Can you reclaim it? More importantly, was it the right judgment to begin with, or did you just automate bias at scale?

3. Who is accountable when the tool is no longer available? AI governance frameworks, including the EU AI Act, are clear: the deploying organization is responsible for the outcome. The vendor’s liability clauses do not transfer your legal responsibility. If Workday’s algorithm discriminated, you are responsible. If a banned AI tool made 40,000 hiring decisions before the ban, those decisions are yours.

The vendor contract ends. The decisions do not.

Unraveling Is Not the Same as Removal

Here is what most organizations discover too late: removing an AI tool from your infrastructure is not like uninstalling software. It is more like removing a load-bearing wall.

The AI agent did more than just automate tasks. It restructured dependencies. Your HRIS feeds it. Your ATS was calibrated around it. Your compliance reporting was designed to produce its outputs. Your team’s muscle memory was built in its presence.

Removing AI without a proper offboarding plan doesn’t bring you back to your previous state. Instead, it leaves a gap, a mental and operational void where the process once was.

This is why the governance conversation cannot begin with “what happens when something goes wrong.” It must start at procurement with a straightforward, non-negotiable principle:

No AI system is integrated into your ecosystem without a documented path for its exit – what is the exit strategy?

What AI Governance in HR Actually Means Now

AI Governance has become a word that feels like paperwork, but it should feel like building architecture.

The organizations that will navigate bans, vendor shutdowns, regulatory changes, and algorithm failures are not the ones with the best policy documents. They are the ones who understood the dependency before it became hidden.

• Who assigned a human to be accountable for every autonomous action?

• Who built the kill switch before it was needed?

The U.S. government's restriction on Claude is not just about national security or choosing vendors. It’s a live example of what every organization will eventually face on a smaller scale: a tool they rely on suddenly becomes unavailable, causing a reckoning with how much they’ve allowed it to grow. The dependency triangle.

The critical AI governance question is how dependent we have become on AI in HR and how we can successfully unravel that dependence.

The question is not whether this will happen to you.

The question is whether you will be able to answer: what breaks if we remove this AI from the HR system?

And whether you will have built something solid enough to survive that answer.

This article is part of an ongoing series on AI governance, workforce systems, and the human infrastructure behind intelligent technology.

Register Now

About AI Governance for HR and AI CoLab Workspace for HR Leaders

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. This CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination.

Learn About Our Programs

The HR Conference Floor Moment - We Need to Find New HR Technology

Picture the scene. You are walking the expo floor at a major HR conference. The energy is electric. Vendors line every aisle, each promising a future where hiring is faster, smarter, and → finally, finally → free of human bias. You have spent years defending your budget, justifying your headcount, and watching your team drown in paperwork and ATS backlogs. Then a vendor pulls you into a booth and shows you a demo.

The AI screens a thousand resumes in seconds. It ranks candidates before you’ve had your first cup of coffee. It promises objectivity. It speaks your CFO’s language: efficiency, scale, cost reduction, and risk mitigation. You breathe a sigh of relief; you didn’t know you were holding.

You go back to your office. You open the contract and sign it.

Nobody asked the most important question in the room: What happens to the people on the other side of this system?

We Were Not Looking for Truth. We Were Looking for Relief.

Let’s be honest about what happened — not as an accusation, but as a reckoning. HR has been under siege for decades. Fewer resources. Higher volume. Intensifying legal pressure. The promise of AI wasn’t just attractive; it was oxygen.

We were the Optimizer, prioritizing speed over scrutiny. We were the Delegator, assuming the tech knew best, so we didn’t have to. We were the Compliant, following the process without questioning what it was actually doing to people. We were, in many cases, the Bystander — noticing something felt off and staying quiet because we had no formal language for what we were observing.

None of us believed we were doing harm, and that is precisely what makes this moment so dangerous.

When harmful outcomes feel normal, they stop registering as harm at all. They become part of the infrastructure. They become Tuesday.

The Normalization Trap: 1.1 Billion Applicants Should Have Stopped Everything

Workday’s own filings show that 1.1 billion applications were rejected by its algorithmic systems during the relevant period in the Mobley v. Workday case. One point one billion. Not one thousand. Not one million. One billion human beings, each of whom applied with some measure of hope, with some version of themselves on paper, were filtered out, ranked down, and eliminated by a system that nobody audited, owned, or could fully explain.

And the industry did not stop. It accelerated.

That number did not become a scandal until a lawsuit gave it a name. Before Mobley, it was a benchmark, a proof point in a sales deck, and what efficiency looked like.

The Normalization Trap in its most complete form: when a system processes bias at sufficient scale and speed, it stops looking like discrimination and begins to look like operations.

AI Implementation: How Rational People Build Irrational Systems

Here is what makes failures in AI governance in HR so difficult to confront: no single person in the chain made a catastrophically wrong decision. Each step had its own internal logic.

Engineers built prediction models trained on historical hiring data because that was what they had. Talent leaders championed the tools because they promised to remove the human bias they had been criticized for. Hiring managers trusted the scores because they were told to and because trusting a score felt safer than trusting a gut feeling in a litigious environment. Legal reviewed the indemnification clauses and confirmed contractual compliance. Executives approved deployment because the vendor provided algorithmic fairness documentation, which seemed sufficient.

No one was the villain. Together, they built a system that discriminated against people based on race, age, gender, and disability — at scale, in silence, for years.

This is not a technology story. It is a systems story. In systems, the most dangerous failures are those that emerge from the gap between what each person believes they are responsible for and what the system is actually doing in aggregate.

IT deployed. HR approved. Legal reviewed. No verification.

If you like our newsletter -
Share it with someone in HR

Share AI GOVERNANCE for HR

The AI Implementation Seduction Has a Name: Speed

There is a specific failure pattern worth naming here because it appears in nearly every AI bias case on record. Call it the Speed Trap.

The organizational pressure to deploy always outpaces the institutional capacity to test. A Q3 deadline. A board presentation. A competitive intelligence report warns that your largest rival already has AI in its screening pipeline. The urgency feels real because it is — in the market's competitive logic, it is. But urgency has a cost that rarely appears on the deployment timeline.

No time for bias audits. No time for demographic testing. No time to ask: what does this system do to candidates who attended Historically Black Colleges? What does it do to applicants over 50? What does it do to people whose career paths look nonlinear because life is nonlinear?

The Speed Trap doesn’t just skip governance. It makes skipping governance feel responsible. Moving fast feels like leadership, while slowing down to verify feels like obstruction.

And so organizations went live with systems they did not understand, governing decisions they were no longer making, and about people they could no longer see.

The Data Told the Past. We Called It the Future.

The second failure pattern, hidden within the normalization story, is subtler and more insidious. Call it the Data Echo.

When AI systems are trained on historical hiring data, they learn whatever that data contains — including every bias, exclusion, and structural inequality that shaped who was hired before. An algorithm trained on ten years of promotions in a male-dominated leadership pipeline learns, faithfully and precisely, that leadership looks male. An algorithm trained on resumes from a workforce that has historically excluded certain demographics learns that certain demographic signals predict poor performance.

The machine is not making this up. It is telling you the truth — about your past. Then you deploy it to choose your future.

One study found that AI hiring tools favor white-associated names 85% of the time, compared with 11% for female-associated names — not because someone programmed bias, but because the training data reflected a world where that imbalance existed and was treated as normal. The Data Echo doesn’t amplify bad intentions. It amplifies the status quo. And when the status quo is unjust, amplifying it at an algorithmic scale isn’t neutrality. It’s acceleration.

We called this “predictive.” A more accurate term would be “reproductive.”

AI Governance: We Outsourced Accountability and Called It Partnership

There is a third layer to this story that the industry has been slow to confront, and it lies in the vendor relationship itself.

When companies deploy AI hiring tools, they enter into a legal and ethical arrangement that few fully understand at the time of signing. The vendor promises bias-free performance. The contract includes indemnification language that appears to shift liability. The HR leader, reasonably, assumes that the vendor’s fairness documentation means the fairness problem has been solved.

But courts are now establishing a different reality. In Mobley, the prevailing legal framework was not the traditional employment agency theory — it was agency. Employers who delegate significant control over hiring to algorithmic systems are responsible for what those systems do. The vendor is your legal agent. Their algorithm’s discrimination is your organization’s discrimination.

“Our AI is bias-free” is not governance. It is marketing.

And yet we normalized vendor assurance as a substitute for institutional accountability. We normalized the black box as an acceptable trade-off for speed. We normalized the Accountability Gap — where IT deployed, HR approved, Legal signed off, and nobody owned the outcome.

The result was not a lack of accountability. It was accountability distributed so thinly across so many functions that it effectively disappeared.

Register Now

AI Bias on Scale: The People We Could No Longer See

Here is the piece that tends to get lost in the governance conversation, because governance often falls to the technical and legal. But it deserves to be stated plainly.

On the other side of every algorithmic rejection was a person. A person who is prepared. They researched the company. Wrote a cover letter. Applied for your job with some version of hope.

The research shows that AI hiring tools using proxy variables such as educational background, geographic location, graduation year, and personality assessment results can infer protected characteristics from seemingly neutral data. A candidate who attended a Historically Black College. A candidate whose graduation year reveals their age. A candidate whose personality assessment captures a disability. These are not edge cases. They are patterns. And when a system processes those patterns at a scale of 1.1 billion rejections, the mathematical probability of discriminatory outcomes is no longer theoretical. It is structural.

We built a system that could not see the person. Then we measured its success by how quickly it processed the invisibility.

AI Bias: Normalizing Was a Choice.

The most important thing to understand about normalization is that it is not something that happens to us. It is something we participate in, incrementally, through thousands of small decisions, each of which seems reasonable in isolation.

Signing the vendor contract without requiring independent bias testing was a choice. Approving deployment before the demographic analysis was complete was a choice. Trusting the algorithmic score without establishing an escalation path for frontline recruiters who noticed something wrong was a choice. These are not indictments. They are invitations — to look clearly at what we have built and to decide whether we want to keep building it.

ATS systems have been doing crude keyword filtering for more than twenty years with almost no scrutiny. That, too, was a form of normalization. What AI has done is not create a new problem — it has inherited and scaled an existing one. The question is whether we use that clarity to finally address the root, normalize the next layer of dysfunction, and wait for the next lawsuit to name it.

Critical AI Governance Question We Have to Ask Before We Ask Any Other

Before any governance framework. Before any compliance checklist. Before we discuss the EU AI Act’s high-risk classification requirements or the EEOC’s expanded theory of vendor liability, there is a more fundamental question every HR leader owes themselves.

What did I believe I was protecting when I said yes to AI in HR?

Because the answer to that question reveals something important about what we must protect going forward.

• If we said yes to AI tools because we believed we were protecting candidates from human bias, we need to reckon with the evidence that we may have replaced visible, contestable bias with invisible, scalable bias.

• If we said yes to protect our teams from burnout, we need to ask what burden we transferred onto the people our systems could no longer see.

• If we said yes to protect the organization from liability, we need to acknowledge the irony that the tools we deployed are now the source of the very liability we were trying to prevent.

None of these realities makes the decision wrong in its original intent. They make it consequential in ways that demand our attention now.

The Beginning of AI Accountability.

Let’s be clear: the answer is not to abandon AI tools. The answer is to stop treating them as decisions we make once and then forget. AI in hiring is not a procurement event. It is an ongoing governance responsibility — one that belongs to HR leaders, not to vendors, IT, or the contract.

That means demanding evidence, not assurances. It means building independent verification into every deployment timeline, regardless of quarterly pressure to move faster. It means ensuring that every AI system affecting a person’s livelihood has a human with the authority and obligation to override it. It means treating historical data as what it is, a record of what we have done, and auditing it before we use it to determine what we will do next.

Most of all, it means refusing to let scale and speed normalize harm.

1.1 billion is not a benchmark. It is a reckoning. The only question now is whether we treat it as such.

The Normalization Trap closes when we stop calling it AI efficiency and start calling it what it is. The first act of governance is the act of seeing clearly. That begins here.

About AI Governance for HR:

Margaret Spence, author of When AI Breaks the Law, operationalizes AI governance for HR leaders overseeing talent-cycle AI. Daily frameworks to close the gap between compliance and ethics—where lawsuits occur. Build governance systems that reduce legal and regulatory exposure before bias scales.

Join Our Pre-Launch Circle

Leave a comment

What did you teach your AI to believe about people?

Not what it outputs. Not how fast it runs. Not what the fairness certification says. What it was actually taught — from what data, representing what workforce, shaped by what history — before it ever made a single decision about a single human being.

That question is the center of what I’ve been writing about in recent weeks. And it is the question this diagnostic is built around.

The Data Echo is one of four failure patterns examined in my forthcoming book, When AI Breaks the Law: AI Governance for Talent Leaders, scheduled for publication in May 2026.

Share AI GOVERNANCE for HR

Data Governance in HR and the Talent Cycle

Data governance in HR is the discipline of determining who is responsible for the data that flows through your talent systems — what is collected, how it is used, who can access it, how long it is kept, and what happens when it is incorrect.

In the talent cycle, data governance is not abstract. It answers a concrete set of questions at every stage of the employee journey: Who approved the use of this candidate’s resume data in our AI screening tool? Who verified that our performance review data was accurate before it was used to train our promotion algorithm? Who is accountable when our attrition prediction model flags women as flight risks based on historical patterns that reflect the organization’s past, not the individual’s future?

Data governance becomes AI governance the moment data is used to train a system that makes decisions about people. At that point, the stakes shift — because a governance failure is no longer just a data management problem. It is a discrimination problem. It is a legal liability. And it is a human one.

The two disciplines are inseparable. AI governance without data governance is a house built on sand. You cannot govern what a system decides if you have never examined what it was trained on.

What Is the Data Echo?

The Data Echo is not a metaphor. It is a mechanism.

When an AI hiring system is trained on historical workforce data, it learns everything that data contains — including every bias, every structural exclusion, and every pattern of inequity that shaped who was hired, promoted, and recognized. An algorithm trained on ten years of promotions in a male-dominated leadership pipeline learns, with perfect fidelity, that leadership looks male. A resume screening tool trained on a workforce that historically excluded certain demographics learns that certain signals predict poor performance.

The machine is not inventing this. It is faithfully reproducing what the data said. The problem is that the data was never a neutral record of human potential. It was a record of who was recognized — within systems that were never fair to begin with.

And here is where the Echo becomes dangerous: the system doesn’t just reproduce that bias at deployment. It amplifies it at a scale no human hiring manager ever could, with each cycle reinforcing the last. Biased outputs become new data, and that data deepens the pattern. The past doesn’t just repeat. It compounds.

This is how Workday’s AI screening system — built with genuine intentions, certified as fair, and deployed by sophisticated organizations — contributed to what its own filings suggest were 1.1 billion application rejections, ultimately resulting in a $365 million discrimination lawsuit that has redefined employer liability in the age of AI.

Nobody programmed discrimination. The data taught it. And nobody audited the lesson.

Data Governance for HR: Why This Matters Right Now

Here is what makes the Data Echo specifically urgent for HR leaders in 2025.

The speed of AI adoption in talent systems has dramatically outpaced institutional capacity to govern what those systems learn. Organizations have deployed tools they don’t fully understand, trained on data they haven’t examined, producing outcomes that nobody is measuring for fairness. And because the outputs feel objective — they are numbers, scores, rankings — the discrimination embedded in the training data is laundered by the appearance of algorithmic neutrality.

The EU AI Act now classifies AI tools used in hiring, promotion, and performance evaluation as high-risk systems, triggering mandatory bias testing, human oversight, and transparency requirements. Courts in the United States are establishing that AI vendors are legal agents of the employers who deploy them — meaning that the algorithm’s discrimination is your organization’s discrimination, regardless of what the contract says.

But compliance is not the reason to care. The reason to care is that every AI hiring system operating without governance makes decisions about people’s futures based on a version of the past that was never examined for fairness.

That is what the Data Echo Audit is designed to interrupt.

Four AI Data Governance Terms HR Leaders Need Before You Audit Your Training Data

Before you begin, it helps to understand exactly which discipline this audit is working within — and why the language matters.

Training Data is the specific dataset fed into an AI model to teach it which patterns to recognize and reward. Not “historical data” in the general sense. Training data is the lesson plan. Whatever is in it — every bias, every exclusion, every structural inequity — becomes part of what the system learns to call normal. When someone says “let’s train it on our best people,” this is what they mean. And this is where the Echo begins.

Training Data Bias is the condition in which training data reflects past inequities, causing the AI model to learn and reproduce them as if they were the objective truth. Also called historical bias or representation bias in machine learning. The algorithm does not know it is biased. It knows only what the data showed it. If the data showed that leadership looks male, that promotions favor youth, and that certain zip codes predict failure, the model would accept those patterns as accurate descriptions of the world and optimize accordingly.

Bias Amplification. The mechanism by which training data bias doesn’t simply replicate at the same level — it scales. Each cycle of the AI’s learning deepens the original pattern. Biased outputs become new data, which reinforces the old bias. The system grows more confident in what it was wrong about from the beginning. This is not a glitch. It is the system working exactly as designed on data that was never examined.

AI Governance is the discipline of ensuring that automated systems make fair, explainable, and legally accountable decisions about people — and that a human being with real authority is responsible for those decisions. This is distinct from data governance, which manages how data is stored and shared across an organization. AI governance, and specifically training data governance, is the practice of auditing what AI systems were taught before deployment, monitoring what they continue to learn after deployment, and building accountability structures to detect and correct bias before it becomes systemic.

The Data Echo is the name for the cycle that connects all four: training data carries bias, the model learns it, bias amplification deepens it with each iteration, and the absence of AI governance ensures no one sees it happening until the damage is done.

Auditing Your AI Training Data: Three Critical Components of the Data Echo Audit

The Data Echo Audit is a free, downloadable 15-minute diagnostic. It poses ten questions mapped directly to the three forces that produce the Echo:

Part 1 — Historical Data. Which workforce trained your AI, and has anyone examined its demographic composition? Does anyone in your organization know what “success” looked like in the dataset that taught your system what to look for?

Part 2 — Data-Driven Outcomes. Can you explain to a candidate why the system rejected them? Has your organization examined whether apparently neutral variables — zip codes, graduation years, personality assessment scores — serve as proxies for protected characteristics?

Part 3 — Data Amplification and the Echo. Is there a defined monitoring rhythm after deployment, or did verification end at launch? Is there a designated person with the authority to pause the system if bias is detected? Do frontline recruiters have a protected, formal path to raise a concern about what they observe?

Each question has three answer options — A, B, or C — scored 3, 1, and 0, respectively. The maximum is 30 points. Now lets complete the audit using the Data Echo Worksheet.

This post is part of an ongoing series on AI governance for HR and Talent leaders. If this is your first time here — welcome. The work we are doing is about making the invisible visible before the invisible becomes a lawsuit. Learn about our AI Governance Courses - Intro to AI Governance for Talent Leaders (Learn More)

Read more

This article is an excerpt from “When AI Breaks the Law” by Margaret Spence, a forthcoming book for HR leaders on governing AI before it governs you.

Executive Summary: The Data Echo

This article explores the critical intersection of historical workforce data and algorithmic decision-making. It is organized into three distinct parts to provide a comprehensive roadmap for senior HR leaders:

• Part 1: The Convergence of Bias – Unpacks how historical data, data-driven outcomes, and data amplification create a self-reinforcing cycle of discrimination.

• Part 2: Bias as Infrastructure – Examines the transition from local data issues to systemic infrastructure and the dangers of proxy variables.

• Part 3: Moral Data Integrity – Defines the new standards for data integrity and establishes the governance mandate required to interrupt the “Data Echo.”

To further your learning, this article includes two exclusive add-ons:

1. Video lesson: Data Governance for HR – A walkthrough of the Data Echo process and the impact on establishing data governance protocols.

2. Audio podcast: Pitching AI Governance to Your Executive Team – A deep-dive discussion on identifying hidden bias in your talent lifecycle and securing C-Suite buy-in.

Part 1: The Data Trifecta: History, Outcomes, and Amplifications

There is a specific kind of danger that arises when three forces converge within a single system. Individually, each has a name. Together, they produce something most HR leaders have never been formally trained to recognize, and that regulators are only beginning to understand well enough to legislate.

The first force is historical data: the records we accumulated over decades of hiring, promoting, and evaluating people. These records capture every assumption, every structural exclusion, and every cultural preference that shaped the organizations we built. They are not neutral archives. They are evidence of who we hired, who we didn’t, and what we told ourselves about why.

The second force is the data-driven outcome: the moment we feed that historical record into an AI system and ask it to predict future success. This is the pivot point. This is where the past stops being the past and becomes the algorithmic definition of the future. The system learns what “qualified” looks like, what “high potential” means, and what “culture fit” predicts. It learns all of this from data that was never designed to be a training set for anything — it was simply what happened, shaped by the world that existed at the time.

The third force is data amplification: the mechanism by which the AI doesn’t just reproduce the bias in the historical record but magnifies, accelerates, and deploys it at a scale no human hiring process ever could. A biased hiring manager affects hundreds of people over a career. A biased algorithm affects millions before anyone notices the pattern.

These three forces combine to produce what I call the Data Echo: a system in which historical discrimination becomes algorithmic instruction, algorithmic instruction becomes a hiring outcome, and that outcome becomes new data that reinforces the very discrimination it inherited. The Echo doesn’t fade. With each cycle, it grows clearer. Louder. More embedded in the infrastructure of who your organization becomes.

This is why data governance is not a technical concern. In HR, it is the foundational act of deciding what kind of future you are willing to build.

The Data Echo occurs when AI systems are trained on historical data that already contains discrimination or bias, causing the algorithm to learn and replicate those biases at scale. Your past hiring, promotion, or upskilling decisions become the blueprint for future ones, so if your top performers were selected through a biased process, the AI treats that bias as the definition of “qualified.” The algorithm does not question the data; it optimizes for the pattern embedded within it.

AI Data Integrity: The Problem With “Our Best People”

The phrase that launches almost every AI hiring implementation sounds reasonable. It sounds like quality control. “Let’s train it on our best people.”

It makes intuitive sense. You know who your high performers are. You have the data. You build a model that learns to recognize the patterns associated with those people and identify candidates who share those patterns. What could go wrong?

Everything — if your best people were selected by a system that was never fair to begin with.

This is the fundamental epistemological trap of historical HR data. The record of “success” is not an objective measure of human potential. It is a record of who was recognized as having potential within a system with particular cultural, structural, and often demographic preferences. When that recognition was systematically skewed — and in most organizations across most of history, it was — then the training data for your AI is not a record of merit. It is a record of the bias that was already there.

Consider what that means in practice. If your organization spent ten years promoting primarily men into leadership roles, your performance data for leaders is predominantly male. The algorithm learns what leadership looks like from that dataset. It learns patterns, communication styles, educational backgrounds, career trajectories, and perhaps even the language used in performance reviews, and it associates those patterns with success. Then it encounters a female candidate with equivalent capability and a different pattern of expression. The system does not recognize her as a match. Not because she is less qualified, but because she is less familiar to a model trained on unfamiliarity with her.

No one programmed this. No one intended it. The data simply reflected the world as it was, and the algorithm faithfully reproduced it.

Training Your AI: Algorithmic Data The Mirror That Lies

Here is the deepest problem with historical data in AI training: it presents itself as objective. Numbers feel neutral. Datasets feel factual. Algorithmic outputs seem beyond the subjectivity of human judgment — which is, after all, why we turned to AI in the first place.

But a mirror doesn’t create what it reflects. It surfaces it. And when what it surfaces is decades of structural inequality, the mirror becomes more dangerous than a biased human decision-maker. It becomes a system that produces biased outcomes while appearing to do the opposite.

Research has documented what this looks like in practice with disturbing specificity. AI hiring tools have been shown to favor white-associated names 85% of the time, compared with 11% for female-associated names — not because anyone chose those preferences, but because the training data reflected a world where those preferences already existed and were treated as performance indicators. Algorithms trained on productivity metrics have been shown to systematically rate workers over 50 as lower performers — not because their output is lower, but because the historical data they were trained on reflects workplaces that consistently undervalued experienced employees and coded younger work patterns as higher value.

In the Mobley v. Workday case, the AI screening system learned what a “successful” candidate looked like from historical hiring outcomes. But success, in this context, was defined by who had been hired before. If those historical hires were disproportionately young, white, and male — as they were across much of the American corporate landscape for decades — then the algorithm learned, with perfect fidelity, to prefer candidates who resembled that history.

The system was not wrong about the data. The data was wrong about people. And nobody asked the difference.

Part 2: Data Governance in HR: How Amplification Turns Bias Into Infrastructure

The transition from data bias to data amplification is the moment a local problem becomes systemic. It happens in a way that is almost impossible to detect without a governance structure specifically designed to identify it.

Here is the mechanism: an AI system is deployed with biased training data. It produces biased outcomes. Those outcomes —who gets hired, who gets promoted, who gets favorable performance reviews—become new data. That new data is fed back into the system, either directly as updated training data or indirectly through the cumulative record it builds of what “success” looks like in your organization. The system reinforces itself. With each cycle, the Echo grows stronger.

A financial services institution documented this process precisely. Their AI resume screening system passed initial demographic tests. It was compliant at launch. Then, over twenty-four months, its bias drifted. The Adverse Impact Ratio for minority candidates declined from 0.85 at deployment to 0.72, crossing the EEOC compliance threshold — not because anyone changed the system, but because the system kept learning. Labor market demographic shifts created new applicant patterns. The algorithm absorbed those patterns without oversight. Month by month, in increments too small to trigger an alarm, the Echo deepened.

By the time anyone looked, 8,400 minority applicants had been affected. The system that had passed every initial check had learned to discriminate, while leadership assumed that initial compliance meant permanent fairness.

This is data amplification in its most complete form. It is not a deployment event. It is a continuous process. Unless an organization has a governance structure with the rhythm to detect it — monthly metrics, quarterly reviews, annual audits — it will proceed invisibly until a lawsuit or a regulatory audit makes the pattern visible.

Share AI GOVERNANCE for HR

Read more

But one comment stopped me cold. An HR executive wrote,

That is not a comment. That is a confession. If you are honest with yourself, it might be yours, too.

My first article warned you that your AI conversations with tools like Claude, ChatGPT, and Copilot are not privileged — the Heppner ruling made that a matter of federal law. But the question the community returned with was sharper, more personal, and far more urgent:

“What about the AI bots that automatically record my meetings?”

That question deserves a direct answer. Here it is: your AI notetaker is not an assistant. It is a permanent record of your most vulnerable moments — and in most organizations, it has been running on auto-join since someone clicked ‘enable.’

The Shadow Witness You Invited In: AI Chatbots and Governance

When an AI notetaker — Otter.ai, Fireflies, Zoom AI, or Microsoft Copilot — joins your meeting, three things happen simultaneously that your legal team almost certainly does not know about:

First, a non-privileged third-party software provider begins recording every salient detail of your conversation. Second, that data is processed on external servers that exist entirely outside your litigation hold and data governance framework. Third, a permanent, searchable transcript is generated — one that is legally treated the same as any other discoverable document your organization produces.

Attorney-client privilege requires a reasonable expectation of privacy. The moment the bot joins a strategy session with your counsel, you have invited a stranger into the tent. The privilege does not bend around the bot. It collapses.

One attorney in the comments on my first post called these tools ‘a guillotine you use to decapitate yourself.’ That line is not hyperbole. It precisely describes what happens when convenience is allowed to govern where legal protection is required.

Note, I am not an attorney. I am restating what several attorneys added to the post. Here is a link if you would like to read Part 1 - (Read Post on LinkedIn)

What 60,000 Voices Told Us: Viral LinkedIn Post

The viral response to Part 1 was not just engagement — it was a live diagnostic of how unprepared the professional world is for this moment. The reactions moved in three distinct waves.

The first wave was shock. ‘Yikes.’ The immediate, visceral recognition that something they were doing every day carried legal teeth they had never considered.

The second wave was rationalization. Legal professionals pushed back: ‘This isn’t new law. AI is just like email — it has always been discoverable.’ They are technically correct, and that correction makes it worse, not better. If this risk has existed from the beginning and organizations still have no policy, the governance gap is not a knowledge problem. It is a leadership failure.

The third wave was the one that mattered most: governance panic. The realization that HR has been operating on what one commenter called ‘a conveyor belt of ungoverned behavior’ — drafting disciplinary write-ups, documenting internal investigations, conducting sensitive ER sessions — all with an ungoverned bot quietly transcribing every word.

That third wave is where your liability lives.

Three Actions. No Excuses. No Timeline Extensions.

This is not a call for a task force or a policy committee. These three steps must happen before your next meeting.

1. Audit the Auto-Join — Today

Most AI notetakers are configured by default to automatically join every calendar event. Most leaders do not know this. HR must immediately mandate that every team member disable auto-join for any internal meeting, any HR investigation, and any session involving legal counsel. This is a 10-minute setting change with multi-year liability consequences.

2. Institute the Privilege Pause

Create a spoken, documented practice: when a meeting begins, and any AI recording tool is present, the lead person explicitly states: ‘I am disabling the AI assistant for this portion of the meeting to protect legal privilege.’ That statement is not bureaucratic theater. It is the difference between a defensible position and an inadvertent waiver — and it creates a record of intent that a court can see.

3. Change the Governing Question

Your organization has been asking the wrong question about AI tools. The question has been: ‘Does this help me work faster?’ The question must now be: ‘Does this create a permanent, discoverable admission of liability?’ Policy must precede productivity. In the era of the Heppner ruling, convenience is the enemy of confidentiality.

The Reckoning Is Already Recorded

This is not an article about software settings.

It is about the moment organizations stop treating AI as an assistant and start treating it as what it legally is: a permanent witness to your most sensitive professional decisions.

Every disciplinary session held this year with an AI notetaker in the room. Every ER venting call. Every strategy discussion with outside counsel where the bot was on auto-join. Those conversations may already exist as transcripts on a third-party server — outside your control, outside your litigation hold, and within the discovery process of anyone who decides to come after your organization.

The HR executive who wrote that comment was not alone. She was simply the first person in that thread willing to say out loud what the rest of you already knew.

What is your organization’s policy on AI notetakers in sensitive sessions? If you don’t have a clear answer within the next 30 seconds, you have your answer.

Govern the input before it becomes your testimony.

Are you trying to figure out how to lead AI Governance for your organization? Learn about our Intro to AI Governance Workshop

Learn More

About AI Governance for HR CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. This CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination.

Join our live CoLab: https://bit.ly/4rthpBP

Share AI GOVERNANCE for HR

You thought AI made your lawsuit safer. A federal judge just made it discoverable.

Imagine this.

You’re staring down a lawsuit.
You don’t want to bother your lawyer yet, or you want to be “better prepared” before the next call. So you open Copilot, Claude, Gemini, or ChatGPT and type:

“Here are the facts of my case. Here’s what my lawyer told me. Draft a strategy memo and give me my best defenses.”

You go back and forth with the AI.
You refine arguments, test theories, and rewrite what your attorney said into “plain English.” You save 20–30 pages of beautifully structured legal strategy to your laptop. Then you email some of it to your lawyer, feeling very sophisticated and “future‑ready.”

Fast‑forward: the government executes a search warrant, or opposing counsel serves discovery. They seize your devices, your files, your AI history.

You argue: “That’s privileged. That’s my work with my lawyer.”

And the judge says: No, it isn’t.
Those AI‑generated documents are not protected by the attorney‑client privilege, are not covered by the work-product doctrine, and can be admitted into evidence.

That’s not a hypothetical. That is exactly what just happened in a federal criminal case: United States v. Heppner in the Southern District of New York.

The case that blew up “AI as your quiet co‑counsel”: United States v. Heppner

On February 10, 2026, Judge Jed S. Rakoff of the Southern District of New York issued a ruling from the bench in United States v. Heppner, No. 25‑cr‑503 (JSR).

The defendant, Bradley Heppner, is a financial services executive charged with securities and wire fraud. After being subpoenaed and hiring Quinn Emanuel, he did what far too many sophisticated people are quietly doing:

Share AI GOVERNANCE for HR

He went to Anthropic’s Claude and started building his own legal strategy.

• He used the consumer version of Claude (not an enterprise, locked‑down instance).

• He had Claude help him analyze his legal exposure and draft about 31 documents laying out facts, arguments, and defenses.

• He saved those AI‑generated documents on his devices and later sent them to his lawyers.

When federal agents searched his devices, they found the Claude material. Defense counsel tried to protect it by logging the AI docs as:

“Artificial intelligence‑generated analysis conveying facts to counsel for the purpose of obtaining legal advice.”

They asserted attorney‑client privilege and the work‑product doctrine.

Judge Rakoff’s response was brutally clear.

From the bench, he said he was:

“not seeing remotely any basis for any claim of attorney‑client privilege.”

He held that the Claude‑generated materials were neither privileged nor protected work product. The government can use them.

This is, as Debevoise notes, likely the first federal decision squarely holding that using a consumer generative‑AI tool with potentially privileged information can destroy privilege.

Why the judge said: your AI conversations are not privileged

The Heppner ruling doesn’t invent new law. It applies long‑standing privilege rules to a new behavior: treating AI as your shadow lawyer.

1. Claude is not your attorney

Attorney‑client privilege protects confidential communications between a client and a licensed lawyer for the purpose of obtaining legal advice.

Claude is not licensed.

Anthropic’s own documentation and terms make this clear: Claude does not provide legal services, and using the tool does not create an attorney‑client relationship. Judge Rakoff treated Heppner’s interaction with Claude as a communication with a third party, not with counsel.

Once you recognize the AI as a third party, the next domino falls quickly.

2. You can’t claim confidentiality when the terms say “this isn’t confidential.”

Privilege is lost when you disclose your communication to a non‑privileged third party. That’s privilege 101.

Here, the government cited Anthropic’s terms and privacy policy:

• Prompts and outputs can be logged.

Debevoise’s write‑up notes that Judge Rakoff viewed this as fatal: Heppner disclosed his would‑be “strategy” to a service whose terms state that the information is not confidential.

In other words, if the tool’s terms state that “we may use this data, share it, and it’s not confidential,” you cannot seriously claim you had a reasonable expectation of confidentiality.

3. You cannot “launder” privilege by emailing AI docs to your lawyer later

Heppner’s team advanced a nuanced argument: these AI‑generated documents were created to help him organize facts and convey them to counsel, and thus should be protected.

Rakoff returned to another basic rule: pre‑existing, unprivileged documents do not become privileged simply because you send them to your lawyer.

Timeline matters:

• Heppner created the documents

By the time those documents reached counsel, they had already been:

1. Created in partnership with a non‑lawyer third party, and

2. You can’t retroactively “cloak” it in privilege.

Share AI GOVERNANCE for HR

4. The work‑product doctrine didn’t save him either

The defense also invoked the work‑product doctrine, which protects materials prepared in anticipation of litigation, particularly when they reflect counsel’s mental impressions or strategy.

Judge Rakoff rejected that, too. Why?

The Claude documents reflected

• As Debevoise puts it, this ruling warns that consumer use of generative AI in legal disputes is “fraught with privilege risk.”

Dan Schwartz’s message to employers: your AI conversations are not privileged

Employment lawyer Dan Schwartz took one look at Heppner and distilled it into a message every employer needs to hear: “Your AI conversations are not privileged.”

In his Connecticut Employment Law Blog article, “A Court Just Confirmed What Employers Need to Hear: Your AI Conversations Are Not Privileged,” he directly connects the dots to HR.

He lays it out plainly:

“If your HR team is using ChatGPT to analyze a termination decision, or a manager is asking Claude about potential liability for a workplace complaint, those conversations are almost certainly not privileged. They are discoverable and could end up as exhibits in a lawsuit against your company.”

Read Daniel Schwartz Post on LinkedIn

He also flips the lens to the plaintiffs:

“Employees are increasingly using AI tools to research their legal rights, draft complaints, and strategize about claims. Those conversations are discoverable, and Judge Rakoff’s ruling makes clear they are not privileged. That prompts an employee enters into ChatGPT or Claude often reveal more than the polished complaint that lands on your desk.”

Heppner gives that argument real teeth. The court didn’t just hint at risk; it opened the door and invited those AI histories into the evidentiary record.

What this means for CHROs, HR, and in‑house counsel

From an AI governance perspective, here’s the uncomfortable truth:

1. Most organizations have leaders and HR professionals quietly doing some version of what Heppner did—just on the civil side.

They ask Copilot, Claude, or ChatGPT things like:

• “Is this age discrimination if I terminate this person?”

Under the logic of United States v. Heppner, that content is

• Almost certainly

If the AI tool’s public terms state that inputs can be logged, used for training, or shared, assume no confidentiality, no privilege, and no safety net.

That means:

• No fact‑specific termination or investigation questions.

This isn’t anti‑AI; it’s recognizing that tools designed to train on the world’s data aren’t appropriate containers for your most sensitive legal risks.

2. Keep legal analysis with licensed counsel, not AI

The safer approach is straightforward and, frankly, old‑school:

• If it is truly a legal question, call your lawyer.

Schwartz’s warning is clear: “The safer practice is to let your attorneys handle the legal analysis and keep sensitive legal matters out of commercial AI platforms entirely.”

3. Use enterprise AI under counsel’s direction if you must, but don’t assume magic protection

There is a meaningful difference between:

• Public, consumer AI tools with training and data‑sharing baked in, and

Debevoise suggests that where:

• The AI is an enterprise tool configured for confidentiality.

There may be a stronger argument that outputs fall within the work‑product doctrine.

But Heppner should dispel the notion that “AI + litigation = automatically privileged.” It doesn’t.

4. Build AI into your discovery strategy—on both sides

Heppner and Schwartz both point to a powerful litigation reality: generative‑AI histories constitute a new, rich class of discoverable evidence.

For employers and defense counsel:

Update litigation hold notices to include AI prompts, responses, and exports related to the dispute.

• AI histories discussing the claim,

• AI‑drafted complaints or demand letters,

• AI‑generated analysis or strategy documents.

For HR governance, this means building AI awareness into how you think about records, e‑discovery, and preservation—not just “innovation.”

5. Train leaders with a single blunt message: “No expectation of privacy. No privilege.”

Every AI training session for executives, HR, and managers should now include a clear, direct explanation of United States v. Heppner:

· A defendant used Claude to draft approximately 31 documents about his case.

• Claude is not a lawyer.

• The tool’s terms said inputs weren’t confidential.

• You can’t make non‑confidential AI documents privileged by emailing them to your lawyer afterward.

Then pair that with Dan Schwartz’s headline point:

“Your AI conversations are not privileged. They are discoverable. And they could end up as exhibits in a lawsuit against your company.”

If a leader wouldn’t put the content in an email to opposing counsel, they should not put it into a consumer AI tool.

Register Now

About AI Governance for HR CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. This CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination.

New Book Loading: When AI Breaks the Law: AI Governance for Talent Leaders (Release Date April 20, 2026)

Join The Book Prelaunch

At 1:50 AM on a Tuesday, Derek Mobley received yet another job rejection. It was his 100th. Each rejection came from a different employer, but they all used the same AI-powered screening system: Workday. People didn’t reject Mobley; a system erased him.

His experience is a warning shot for the 99% of Fortune 500 companies that now use automated hiring tools. Mobley’s lawsuit, a landmark class-action suit valued at over $365 million, has exposed a massive, overlooked liability for any business that deploys algorithms as silent gatekeepers. The case isn’t a glitch; it’s a systemic governance failure. Here are five essential, often surprising lessons this case offers to any leader using automated hiring systems.

1. Your Vendor Can’t Protect You: The Myth of Neutral Tech

The single most important legal precedent from the Mobley v. Workday case is that AI vendors are considered legal agents of the employer. This means your organization is directly and fully liable for any discrimination committed by the AI. The long-standing defense of blaming the vendor or hiding behind a “black box” is no longer viable.

The court’s ruling was unambiguous:

“AI vendors are not neutral tech providers. They are your legal agents.”

This was not the work of a single “villain” programmer. Catastrophic AI failures stem from a web of rational decisions by well-meaning people across your organization—talent leaders trying to hire faster, engineers building predictive models, and executives trusting a vendor’s marketing claims. Ultimately, that trust is no substitute for rigorous, independent governance. If their algorithm discriminates, your organization will be held accountable.

2. AI Doesn’t Just Discriminate—It Hyper-Scales It

AI learns from our past, which is full of discrimination. When we deploy AI without governance, we don’t eliminate bias. We automate it. We scale it.

The true danger of AI isn’t just that it’s unfair but that it operates at a scale and speed humans cannot match. The Mobley case illustrates this with staggering clarity: the system in question rejected 1.1 billion applications between September 24, 2020, and 2025. A single biased parameter in the code transformed what might have been individual errors in human-led hiring into a massive class-action lawsuit. This is how a tool meant to increase efficiency can become a talent brand-killer and invite reputational collapse.

3. The Lawsuit Will Have Your Name on It

The risk posed by a discriminatory AI system is not just organizational—it’s personal. The Mobley case shows that courts, regulators, and the media will identify the specific executives who approved and deployed the system as the responsible parties.

You may have believed you were innovating. Now you’re justifying to the CEO, the board, and a federal judge why your state-of-the-art system rejected millions of qualified applicants. As a CHRO or VP of Talent, good intentions are not a defense. You are judged by outcomes.

“You don’t receive credit for good intentions. You are held responsible for the bad results.”

Share AI GOVERNANCE for HR

4. “Bias-Free” Is a Marketing Slogan, Not a Legal Defense

The issues exposed in the fictional Mobley case are mirrored in numerous real-world lawsuits. In case after case, employers deployed tools marketed as fair, only to face costly litigation when that trust proved misplaced.

• iTutorGroup: In the first federal AI discrimination settlement, the company paid $365,000 after its AI automatically rejected all female applicants over age 55 and all male applicants over age 60.

• Amazon: An internal recruiting tool was famously discontinued after it was found to penalize resumes containing the word “women’s” and to favor male-associated language.

• CVS/HireVue: A lawsuit involving an AI that analyzed facial expressions to generate “employability scores” was settled privately amid concerns that it functioned as an illegal pre-employment lie detector test.

• Harper v. Sirius XM: In a pending case seeking class-action status, a Black applicant alleges that an AI screening system uses factors such as employment gaps and geography as illegal proxies for race discrimination.

The common thread is clear: every tool was deployed as a black box, and every employer learned too late that a vendor’s promise is not a legal shield.

5. Plausible Deniability Is Officially Dead

The conversation about AI bias has fundamentally shifted. Five years ago, it was a theoretical discussion. Today, it is an established legal reality, with a growing list of court dockets and settlement checks. The era of claiming ignorance about how your hiring systems work is over.

“The Mobley lawsuit closed the door to plausible deniability.”

Leaders fall into catastrophic failure by relying on a set of now-dangerous assumptions: “Our vendor is different.” “This is too technical for HR.” “We haven’t been sued yet.” Your AI is making legally binding decisions right now. Delaying oversight is a direct acceptance of risk.

From Awareness to Action

Moving from passive risk to active governance requires asking hard questions now, before they are asked of you in a deposition.

• When was the last time anyone in your organization questioned whether an AI system was producing fair outcomes? If no one is asking, the system is not governed.

• Ask your hiring managers: “Have you ever overridden an AI recommendation?” If the answer is consistently no, you don’t have human oversight—you have compliance theater.

The 1:50 AM Question

The era of passive trust in AI vendors is over. Active, human-led governance is no longer optional; it is a non-negotiable business imperative. You must evolve from vendor dependence to governance readiness.

This brings us back to that 1:50 AM rejection. How many automated rejections has your system issued this year?

If you don’t know the answer, that’s your first risk.

About AI Governance for HR CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. This CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination lawsuits.

Join us live every Wednesday for our Let’s Build Governance Together Series - Our live programs are a premium edition of this Colab.

Get the SimpliFocus Readiness Assessment Free

Join the waiting list for “When AI Breaks the Law” and get early access to the SimpliFocus AI Governance Readiness Assessment. Find out in 10 minutes where your governance gaps are before they become lawsuits.

Join The Prelaunch

The Talent Cycle Is Now an AI System

Today, nearly every phase of the talent cycle is influenced by artificial intelligence. Recruiting platforms rank resumes. Interview tools analyze tone and word choice. Learning systems recommend training based on behavioral patterns. AI is not just an add-on. It has become a silent decision-maker across hiring, development, retention, and exit.

This transformation means that HR functions once driven by human judgment now rely on algorithms to evaluate people, often without employees or candidates realizing it. The risks increase when those systems are built on biased data, operate without human review, or produce decisions no one can explain.

From sourcing to succession planning, the talent cycle has become a chain of AI-driven decisions. Without proper guardrails, this chain can introduce systemic discrimination, erode trust, and lead to legal consequences.

HR leaders must recognize that the talent cycle is not only a process but a system shaped by data and governed by code. If left unchecked, it becomes a liability. With strong AI governance, however, it can become a source of innovation that enhances fairness, speed, and strategic value.

This article explores how talent leaders can set guardrails that balance innovation with integrity. You will learn to embed governance across every phase of the talent cycle, from hiring to offboarding, and ensure your AI works for people, not just data.

Share AI GOVERNANCE for HR

The Business Imperative of AI Governance

Artificial intelligence is no longer a future concept in HR. It is already embedded throughout the talent lifecycle. From resume screening and candidate ranking to performance evaluation and internal mobility, AI is driving efficiency and scale. But without clear governance, it also poses risk: legal, ethical, and reputational.

High-profile regulations, such as the EU AI Act, have heightened awareness of external compliance. Yet even in regions without strict laws, HR leaders must ask:

· Who controls our AI?

· Can we explain its decisions?

· Are we protecting our people and our brand?

AI governance is not just about meeting legal standards. It is about building trustworthy, responsible, and defensible systems. That responsibility begins within HR.

Bridging the Gap Between Innovation and Accountability

AI governance in HR refers to the policies, practices, and structures that ensure the ethical, transparent, and responsible use of artificial intelligence throughout the talent lifecycle. It is the mechanism that prevents AI from becoming a black box that makes high-impact decisions without oversight.

For HR teams, AI governance means more than checking boxes for compliance. It involves asking critical questions such as:

• Who is accountable for AI outcomes in hiring or performance evaluations?

• Can we explain how the algorithm made its decisions?

• Are we continuously testing for bias or adverse impact?

• Do we have human experts reviewing and overriding AI when necessary?

AI governance bridges the gap between innovation and accountability. It ensures that the tools HR uses to evaluate people are aligned with organizational values, legal obligations, and candidate expectations.

Whether you are using AI to screen resumes, recommend promotions, or forecast attrition, governance ensures those systems are fair, explainable, and auditable. It transforms AI from a risky convenience into a responsible business asset.

In the context of HR, AI governance is not optional. It is foundational to building equitable, defensible, and human-centered workplaces.

The Core Pillars of AI Governance in HR

Establishing AI governance begins with clear principles. For HR, four foundational pillars determine whether AI tools support a responsible workplace or expose it to risk: Accountability, Transparency and Explainability, Bias Mitigation, and Human Oversight.

Accountability

AI does not absolve HR teams of responsibility. Every AI system used in hiring, performance, or compensation must have a named owner who has the authority and knowledge to ensure it operates fairly. Without assigned accountability, organizations fall into the “accountability gap,” where outcomes are blamed on vendors, IT, or the algorithm itself.

Transparency and Explainability

HR must be able to explain how AI systems work, what data they use, and how decisions are made. This is especially important in candidate selection, where a lack of clarity can erode trust or trigger legal action. Explainability is not just technical; it must be accessible to candidates, managers, and regulators alike.

Bias Mitigation

AI systems often inherit biases from historical data. A resume screener trained on past hiring decisions may learn to favor certain schools, names, or work patterns that reflect systemic bias. Governance means regularly testing for adverse impact, reviewing training data, and intervening when patterns of unfairness emerge.

Human Oversight

AI should support, not replace, human decision-making. HR teams must ensure that qualified professionals review AI outputs and can override decisions when necessary. Oversight must occur before deployment and throughout the system’s lifecycle.

These four pillars form the blueprint for building AI systems that are not only functional but also fair, explainable, and aligned with organizational values.

Designing a Practical AI Governance Framework for HR

Turning AI governance into an operational system requires a structured, repeatable framework. HR leaders do not need to reinvent enterprise compliance models. Instead, they can adapt proven governance approaches to the talent lifecycle’s unique risks and workflows.

Here is a five-step governance architecture tailored for HR:

1. Classify AI Systems

Inventory all AI-powered tools used across the employee lifecycle. Identify which systems influence hiring, promotion, performance management, or termination. Label them by risk level and by their impact on individuals.

2. Assign Ownership and Escalation Paths

Each AI system should have a designated owner, typically someone in HR or legal who understands the tool and is accountable for its outcomes. Define clear escalation paths for issues such as candidate disputes, system failures, or bias indicators.

3. Implement Oversight and Audit Processes

Conduct a pre-launch risk assessment before deploying any high-impact AI system. Implement ongoing monitoring, including bias audits, performance reviews, and spot checks. Document all findings and decisions.

4. Create Transparent Documentation

Maintain plain-language summaries of each system’s function, decision criteria, and data sources. Ensure this documentation is accessible to internal stakeholders and, when appropriate, to candidates or regulators.

5. Establish Review Cadence and Compliance Triggers

Set up regular governance reviews, either quarterly or biannually. Include automatic reviews triggered by system updates, candidate complaints, or regulatory changes.

This framework helps HR leaders embed governance into their operating rhythm, transforming AI from a static tool into a dynamic, responsible solution.

Building Cross-Functional AI Governance Teams

AI governance cannot be owned by HR alone. It requires cross-disciplinary collaboration to ensure systems are ethical, legal, and operationally sound.

A strong AI governance team should include:

• HR and Talent Leaders to align AI use with workforce strategy and inclusivity goals

• Legal and Compliance Experts to interpret regulatory obligations and mitigate risk

• Data Scientists or IT Specialists to evaluate system logic, performance, and data integrity

• Ethics or DEI Officers to provide input on fairness, accessibility, and social impact

This team should meet regularly, share documentation, and coordinate on vendor selection, risk assessments, and policy updates. Cross-functional governance ensures proactive oversight rather than reactive oversight.

Governance is a long-term capability, not a one-time project. Building the right team ensures it can scale and evolve alongside the technology.

Embedding Governance into Daily HR Ops

For governance to be effective, it must be embedded in the everyday flow of HR operations. This includes integrating governance checkpoints into routine activities.

Examples include:

• Running bias audits as part of vendor evaluations

• Adding explainability reviews into system procurement checklists

• Training recruiters and HR staff to spot questionable AI outputs

• Setting alerts for changes in AI performance or adverse impact

Governance also requires a cultural shift. HR should foster a safe environment where people can question AI decisions without fear of reprisal. Candidates and employees should have clear pathways to report concerns or request human review.

When governance is embedded in daily operations, it becomes automatic, defensible, and a natural part of ethical HR practice.

Responsible AI Starts with HR

Artificial intelligence can drive immense value in HR, but only when guided by clear guardrails. The responsibility to ensure AI is fair, explainable, and accountable does not belong solely to regulators or tech vendors. It begins with HR.

By establishing governance across the talent cycle, HR leaders become stewards of both innovation and integrity. They protect candidates, employees, and the business from unseen risks.

Governance is not a barrier to progress. It is what makes progress sustainable.

As AI becomes embedded in every decision about people, the role of HR shifts from process owner to system governor. It is a shift worth embracing.

About AI Governance for HR CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. This CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination lawsuits.

Join us live every Wednesday for our Let’s Build Governance Together Series - Our live programs are a premium edition of this Colab.

Don’t Wait for Your Mobley Moment

The gap between AI policies and AI governance is where $365 million lawsuits happen. Join the waiting list now and get the SimpliFocus Readiness Assessment free. Diagnose your governance gaps before they cost you.

Join the Book Waitlist

Many AI systems used in HR operate behind a curtain. They’re marketed as faster, smarter, and more efficient, but when something goes wrong, no one can explain why. In an era of new regulations like the EU AI Act, that’s no longer acceptable.

This article shows HR leaders how to demand transparency, challenge “black box” excuses, and stay accountable — even when the tech gets complex.

1. What’s in the Black Box — and Why HR Needs to Open It

The AI flagged a candidate as a “low fit.”

A recruiter asked why. The system offered no explanation.

The hiring manager shrugged and moved on. So did everyone else.

Weeks later, Legal received a call. The rejected candidate had a profile nearly identical to those of others who were hired; same school, same job title, same years of experience. The only difference was age.

No one could explain why the system made its choice, because no one had ever asked how it worked in the first place.

This is the Black Box Problem: AI systems that make decisions or recommendations without providing clarity, logic, or accountability.

In finance, auditors won’t approve numbers they can’t trace. In medicine, treatments require informed consent.

But in HR? People are being hired, rejected, promoted, or sidelined by AI without any clear explanation.

If you can’t explain a decision, you probably shouldn’t be making it.

2. Transparency Isn’t a Nice-to-Have — It’s the Law

In most HR teams, “transparency” is a cultural value. When it comes to AI systems, it’s a legal requirement.

The EU AI Act — the world’s first comprehensive AI regulation — explicitly classifies AI used for recruitment, promotion, termination, and workforce evaluation as high-risk (Article 6). High-risk systems are subject to specific requirements:

• Article 13: Transparency
  HR must understand and be able to explain how the system works, what it optimizes for, and what data it uses.

• Article 14: Human Oversight
  Employers must ensure that humans can review and override AI decisions before those decisions take effect.

• Article 10: Data Governance
  You must ensure that training data is relevant, accurate, and nondiscriminatory — and be able to document this.

These requirements apply even if:

• You bought the system from a third-party vendor

• The AI was embedded in a broader platform

• Your company is not based in the EU but operates in EU markets or hires EU-based workers

If your team is using AI in hiring or talent management — and can’t explain how it works — you’re not just ethically exposed. You’re legally exposed.

Four Levels of Transparency HR Should Demand

You don’t need to be technical to demand transparency. You just need to know which questions to ask — and what answers are acceptable.

Here are the four levels of transparency that every HR leader should push for:

1. Output Transparency

What did the AI recommend — and for whom?

• What scores, rankings, or decisions did the system produce?

• Who saw those results?

• Were the recommendations used, changed, or overridden?

If you can’t access or audit these outputs, you have no way to defend them.

2. Process Transparency

How did the system reach that result?

• What variables were used (e.g. job history, skill keywords, tenure)?

• Were any sensitive or proxy variables excluded (e.g. ZIP code, GPA)?

• How are those inputs weighted?

You don’t need source code — you need to understand logic and influence.

3. Intent Transparency

What is the system trying to optimize?

• Is the model built to prioritize speed, cost, retention, or engagement?

• Who set those goals — and are they aligned with your people strategy?

If you don’t know what the system optimizes for, you don’t know what trade-offs it’s making.

4. Training Data Transparency

What historical data trained the system — and does it reflect your workforce?

• Was the model trained on global datasets, or on data from companies nothing like yours?

• How recent and representative is the data?

• What job levels, geographies, or demographics are reflected?

This is where bias creeps in — and where your accountability begins.

If you inherit a model trained on biased data, you’re deploying those patterns — whether you intended to or not.

4. When the Vendor Says “We Can’t Explain It.”

Many vendors say their AI system is too complex or proprietary to explain. That’s not a dead end — it’s a negotiation point.

Here’s what to do:

Push for Model Documentation

You’re not requesting intellectual property. You’re requesting a high-level summary — often called a “model card” — that outlines:

• What inputs are used

• What the system is designed to do

• What limitations or risks are known

• Whether human review is expected

Responsible vendors should be prepared to provide this.

Ask for Local Output Explanations

Even if the model is complex (like a deep learning system), there are tools that can explain individual decisions.

Two examples:

• SHAP: Shows which inputs (like experience or location) contributed most to a specific decision

• LIME: Builds a simplified, understandable version of the model for one specific case

These are part of a practice called local interpretability, which helps you explain why a single decision was made, even if the overall system is complex.

If you can’t explain why a candidate was rejected or why a promotion was skipped, you may be out of compliance.

Shift Accountability in the Contract

If a vendor won’t provide transparency, you need to protect yourself through contract.

• Add an indemnification clause for automated decisions

• Secure the right to audit data and decision logs

• Include a termination clause if transparency thresholds are not met

Vendors that refuse to be transparent aren’t protecting trade secrets — they’re offloading risk onto you.

5. Red Flags: Signals That Your HR AI Tool Is Too Opaque

Watch for these signs that the system you’re using is dangerously unaccountable:

• You don’t know what decisions the system is making

• The vendor refuses to explain how the results are produced

• There is no way to override or audit the outputs

• No one can describe what data the model was trained on

• HR can’t explain the outcome to the person it affects

If any of these are true, you’re not managing a tool — you’re absorbing its risk blindly.

6. Questions You Should Be Able to Answer (Even If You Didn’t Build It)

You may not be the engineer, but you’re still accountable.

Here’s what every HR leader should be able to answer regarding the AI systems they rely on:

• What decisions or recommendations does the AI influence?

• What inputs are used in those decisions?

• What is the model trying to optimize?

• What kind of data was it trained on — and how similar is that data to your workforce?

• Can you explain an individual outcome to a candidate or an employee?

If the answer to any of these is “I’m not sure,” you’re outside the governance range.

AI Governance Rule: If You Can’t Explain It, You Can’t Defend It

Transparency isn’t a bonus feature. It’s the foundation of ethical, legal, and strategic HR in the AI era.

HR leaders don’t need to become data scientists, but they do need to ask tough questions and insist on clear answers. The risk isn’t just bias or error. It’s being responsible for outcomes you don’t understand and can’t control.

You don’t have to fear AI (yet), but you do have to open the black box — and decide whether what’s inside is right for your people, your values, and your accountability.

About AI Governance for HR CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. This CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination lawsuits.

Join us live every Wednesday for our Let’s Build Governance Together Series - Our live programs are a premium edition of this Colab.

Don’t Wait for Your Mobley Moment

The gap between AI policies and AI governance is where $365 million lawsuits happen. Join the waiting list now and get the SimpliFocus Readiness Assessment free. Diagnose your governance gaps before they cost you.

Join the Book Waitlist

The 1:50 AM Rejection

Derek Mobley applied for a job. At 1:50 AM, he received a rejection. He applied again, this time to a different company, and received another automated rejection in the middle of the night. This happened 100 times. Each rejection came from a different employer, yet they all used the same screening system.

No human ever saw his resume. People didn’t reject Mobley. A system erased him.

This story raises a critical question for any organization using AI: How do seemingly rational systems and good people cause such significant, scaled harm? The answer isn’t about blaming individuals; it’s about understanding the system that produces the outcome. The answer lies in systems thinking.

A brief disclaimer: The case referenced, Mobley v. Workday, is in active litigation. All information presented here is drawn from publicly available court filings and judicial orders.

“Most AI failures in HR don’t come from bad people. It comes from blind spots, assumptions, and silence.”

The Critical Shift to Systems Thinking

Most leaders are trained to fix symptoms. We ask: “What’s broken? Whose to blame?” This approach is insufficient for the complex challenges of AI. Systems thinking requires us to ask more profound questions: “Where did this behavior begin? What assumptions are embedded in this design?”

This shift is essential for Human Resources in the age of AI. HR has traditionally operated in functional silos—talent acquisition, compensation, and development. But AI doesn’t respect those boundaries. An algorithm trained on biased data in one business unit can influence hiring, promotions, and even layoffs in another. AI systems are interconnected, even when our teams are not. To lead responsibly, we must learn to see the whole system—the web of people, policy, data, and decisions. Systems thinking helps us become diagnosticians, not merely deliverers.

The 7 System Failures That Create Agentic Talent-Driven Bias

An analysis of the Mobley v. Workday lawsuit reveals seven recurring patterns, or “systems loops,” that allegedly led to systemic discrimination. Each pattern seems rational in isolation. When combined, they create a powerful engine for failure.

1. Fixes That Fail: The Quick-Fix Mentality

The Dialogue You Hear: This AI will solve our bias problem by taking humans out of the decision-making process.

What the Lawsuit Suggests: The court documents indicate that AI could solve bias by removing flawed human judgment. The logic seems simple: remove the human, remove the bias. But the AI didn’t remove bias; it scaled it. According to the allegations, the algorithm was trained on historical hiring data that reflected decades of human bias. The AI learned these patterns and recommended candidates based on what “success” had looked like in the past. The lawsuit alleges that African American candidates over 40, like Derek Mobley, didn’t match that historical pattern and were automatically rejected. The “fix” for bias became a new mechanism for discrimination.

The Realization: AI doesn’t remove bias. It automates and amplifies the bias already embedded in your data and processes.

2. Limits to Growth: The Scale-at-All-Costs Rush

The Dialogue You Hear: We need this AI live in all departments by Q3 to stay competitive.

What the Lawsuit Suggests: Court filings show that the platform scaled to 11,000 organizations and processed 1.1 billion applications from 2016 to 2025. This represents breathtaking growth. However, the lawsuit alleges that governance did not scale at the same pace. The pattern of 1:50 AM rejections suggests that no one stopped to ask critical questions about oversight at such a massive volume. Speed won out over safety, and growth won out over governance.

The Realization: Speed creates complexity that outpaces oversight. Scale multiplies the impact of every undetected flaw.

3. Shifting the Burden: The Liability-Dodging Vendor

The Dialogue You Hear: Our AI is fair. Any issues come from your implementation.

What the Lawsuit Suggests: According to court documents, Workday positioned itself as a “neutral tool provider,” stating that its AI tools “do not make hiring decisions” and that customers retain “full control and human oversight.” However, Judge Rita Lin ruled that the AI was “not simply implementing in a rote way the criteria that employers set forth, but is instead participating in the decision-making process by recommending some candidates to move forward and rejecting others.” The vendor attempted to shift accountability to the employer, while the employer may have assumed the vendor had tested for bias. Both pointed fingers, and the discriminatory outcome persisted.

The Realization: Vendor disclaimers don’t override federal discrimination laws. You cannot avoid liability by pointing to the vendor.

4. Tragedy of the Commons: The Siloed Optimization

The Dialogue You Hear: HR’s fairness reviews are slowing our pipeline.

What the Lawsuit Suggests: The pattern revealed shows that each department optimized its own piece of the deployment. Procurement negotiated a good price. IT achieved a fast rollout. Legal reviewed contract disclaimers. Everyone succeeded in their siloed task. However, the allegations suggest that no single person or department owned the system-wide outcome of fairness for candidates. When responsibility is shared among multiple stakeholders, it can effectively belong to no one. Who caused the discrimination? Everyone and no one.

The Realization: When everyone optimizes for their silo, the system breaks down in the space between departments. Discrimination thrives in the gaps.

5. Success to the Successful: The Self-Reinforcing Algorithm

The Dialogue You Hear: The AI proves that my team is top-performing. We deserve more funding.

What the Lawsuit Suggests: The AI likely learned from historical hiring data, identifying patterns in who was hired, promoted, and deemed successful. It then recommended more candidates who resembled those past successes. This is how algorithms amplify existing inequality. The system validates past patterns, making them easier to repeat and harder to see alternative patterns of success. Derek Mobley didn’t match the historical profile, not because of a lack of qualifications, but because the algorithm was trained to recognize “success” in a specific demographic pattern.

The Realization: Algorithmic validation of past patterns prevents new patterns from emerging, making inequality self-reinforcing.

6. Accidental Adversaries: The Uncoordinated Champions

The Dialogue You Hear: Why is Legal slowing down our AI deployment with all these bias-testing requirements?

What the Lawsuit Suggests: The failure pattern points to competing priorities among departments, all seeking a successful AI implementation. IT prioritized deployment speed. Legal prioritized liability protection. HR prioritized process efficiency. Their requirements conflicted, yet the allegations suggest no one coordinated a resolution. IT may have viewed Legal’s requirements as delays, while Legal may have viewed HR’s push for speed as reckless. The system launched with incomplete governance, born of these internal tensions.

The Realization: When teams don’t coordinate, governance fails in the gaps between competing priorities.

7. Growth and Underinvestment: The Unfunded Mandate

The Dialogue You Hear: We can’t afford to slow AI implementation and adoption with costly bias audits.

What the Lawsuit Suggests: Organizations invested heavily in AI licenses and implementation but allegedly failed to fund essential governance infrastructure, such as bias testing and ongoing monitoring. The result speaks for itself: 1.1 billion applications processed, a potential class of hundreds of millions of people, and an estimated liability of $365 million and counting. The cost of this unfunded governance far exceeded the cost of building it correctly from the start.

The Realization: You cannot afford NOT to test for bias. The lawsuit will cost more than the audit does.

Let’s Recap: Is Your Organization Building Its Own Lawsuit?

AI bias is not a single error. It is an escalating problem created by interconnected, self-reinforcing loops. Small, undetected biases are amplified by a systemic feedback mechanism that turns small failures into larger ones over time.

• The Efficiency Loop: More automation increases speed, reducing human review. Less review increases reliance on the algorithm, amplifying any underlying bias.

• The Normalization Loop: Early bias goes undetected and becomes “how the system works.” This normalizes discrimination, making it an invisible part of organizational culture.

• The Scale Loop: Successful deployment leads to expanded use, processing more applications. This affects more people and dramatically increases legal exposure.

This is how small flaws escalate into systemic failures.

Ten Warning Signs to Watch For

Based on these system loops, here are ten warning signs that your organization may be on a similar path:

1. Leaders propose AI as a cure for bias without understanding what it will learn from your biased historical data. If your bias problem is in your data, AI will amplify it.

2. Aggressive deployment timelines don’t include dedicated phases for bias testing. Speed to deployment isn’t the same as speed to value.

3. Vendors claim their AI is “bias-free” without providing supporting documentation or audit results. Marketing claims are not evidence.

4. Contracts include vendor disclaimers about discriminatory outcomes. Legal disclaimers don’t shield you from liability.

5. Each department declares its part of the implementation a success, even as candidates are harmed. Your internal metrics are meaningless if the system discriminates.

6. No single person or role owns algorithmic fairness across the entire talent lifecycle. Distributed responsibility becomes no responsibility at all.

7. AI systems are trained exclusively on historical data without intervention to correct for past biases. Historical patterns include historical bias.

8. Inclusivity metrics decline after an AI system is deployed. The algorithm is telling you something. Listen.

9. IT, Legal, HR, and Compliance lack a shared governance framework for AI. Without coordination, competing priorities create governance gaps.

10. AI budgets fund software licenses but not the ongoing governance, testing, and monitoring required to use them safely. Unfunded governance is a lawsuit waiting to happen.

Your Mobley Moment: The 1:50 AM Question

Derek Mobley sat in the dark. Another rejection. No explanation. No recourse.

How many 1:50 AM rejections has your system issued in the last 24 months?

If you don’t know the answer, that’s your first risk.

The patterns that lead to systemic failure are predictable and often visible to all. The problem is that no one sees the whole picture until it’s too late. The lawsuit arrives, and suddenly everyone is forced to connect the dots.

You have a choice. See the system now or see it in court later.

About AI Governance for HR CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. This CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination lawsuits.

Join us live every Wednesday for our Let’s Build Governance Together Series - Our live programs are a premium edition of this Colab.

Ready to Build Real AI Governance?

Most HR leaders have AI policies. Few have AI governance systems. Join the waiting list for “When AI Breaks the Law” and get the tools to close that gap.

Join The Book Waitlist

Many HR leaders assume AI risk lives with the vendor. That assumption is not just wrong, it’s legally dangerous.

The Compliance Illusion: Why “We Bought It” Isn’t a Legal Shield

The HR team thought they had done everything right. A well-known vendor. A signed contract. A product marketed as “enterprise-ready” and “legally compliant.” The AI tool automatically screened candidates, ranked them efficiently, and quietly rejected thousands without ever bothering a recruiter.

Then the lawsuit arrived.

In Mobley v. Workday, a job applicant alleged that an AI-powered screening system systematically rejected him because of protected characteristics. The case didn’t hinge on whether the AI was intentionally discriminatory. Instead, it focused on something more uncomfortable: who is responsible when an automated system makes an employment decision.

The vendor didn’t make the hire.
The vendor didn’t reject the candidate.
But the system did.

This is where many HR leaders feel falsely secure. There’s a belief that buying a third-party platform transfers risk along with functionality. That belief is mistaken. Courts and regulators are increasingly focused on use, not ownership.

Even Employment Practices Liability Insurance (EPLI) offers limited comfort. Many EPLI policies were written before AI-driven decision-making became operational. Some now exclude claims related to automation, while others require proof of human oversight that HR teams cannot produce after the fact.

The uncomfortable truth: when AI touches hiring, promotion, performance, or termination, HR is no longer shielded by procurement paperwork or insurance policies.

The compliance illusion is the belief that someone else is bearing the risk. In reality, it’s already sitting in your HR tech stack.

How AI Liability Is Shifting Toward HR

Q: Isn’t AI risk something for Legal or IT to manage? Why is HR now exposed to it?

Because AI in HR isn’t theoretical anymore — it’s operational.

AI tools are now embedded in workflows that affect hiring, internal mobility, promotions, compensation, and even layoffs. When things go wrong, it’s not the engineers who are named in lawsuits — it’s the employers.

Here’s the shift: The more AI influences employment decisions, the more HR becomes the de facto decision-maker — even when no human actually made the call.

This is what’s unfolding in Mobley v. Workday, where the platform’s algorithm allegedly filtered out candidates based on race, age, and disability. Although the vendor is named, the employer remains responsible for the tool’s use. That’s the legal trend. Regulators care less about who built it and more about who applied it to people.

The EU AI Act reinforces this shift by classifying HR-related AI as “high-risk” and placing compliance expectations directly on users, not just vendors.

And don’t assume your EPLI policy will save you. Many policies don’t cover claims tied to algorithmic decisions — especially when no human review occurred.

In short: using AI doesn’t absolve you — it involves you.

Where AI Is Hiding in Your HR Stack?

Q: We haven’t rolled out any major AI tools in HR. Are we still at risk?

Very likely — yes.

The most legally risky AI in your HR function is probably the one you don’t even know is there.

AI is now quietly embedded in everyday platforms: your ATS, HCM, internal mobility tool, learning system, and performance app. Here’s where it hides:

• Applicant Tracking Systems: Resume ranking tools that silently suppress “low fit” candidates.

• Workforce Planning Tools: AI-driven headcount optimizers that auto-flag teams for reduction.

• Talent Marketplaces: Matching algorithms that influence who gets promoted — or overlooked.

• Learning Platforms: Content selectors that reinforce historical paths, blocking non-traditional growth.

• Engagement Dashboards: Retention scoring systems that may misclassify high performers as flight risks.

The danger isn’t always in what the AI does; it’s in the absence of visibility, auditability, and accountability.

If your team doesn’t know what the system optimizes for or how to override it, then it’s not governed — it’s just outsourced risk.

AI Vendor Contract Red Flags: What Most HR Vendors Don’t Tell You

Q: We’ve signed standard contracts with our vendors. Isn’t that enough?

Standard contracts are exactly the problem.

Most HR tech agreements were not written with AI governance in mind, and many silently shift risk to the buyer. Watch for these six red flags:

1. “As-Is” Use Language

You take full responsibility for outcomes, even if flawed or discriminatory.

2. No Explainability Guarantee

If you can’t explain a decision to an employee or an auditor, that’s a legal vulnerability.

3. “Appropriate Use” Clauses

If the contract says you’re responsible for “appropriate use,” guess who regulators will hold accountable?

4. No Human-in-the-Loop Requirements

Tools that operate autonomously without human checkpoints violate the EU AI Act’s expectations.

5. Silent AI Clauses

AI may be baked into general terms without being labeled as such. You may be using AI without realizing it.

6. No Audit Logs or Traceability

If you can’t reconstruct how a decision was made, you can’t respond to audits or legal challenges.

Bottom line: If your contract doesn’t provide visibility and override capabilities, it’s not just a tech risk — it’s a leadership risk.

The EU AI Act: What High-Risk Means for HR Buyers

The EU AI Act is not theoretical — it’s enforceable and imposes direct obligations on organizations using AI in HR.

HR Use Cases = “High-Risk AI”

Per Article 6, any AI used for hiring, promotion, termination, or evaluation is classified as high-risk. If you’re using AI to make or influence employment decisions, you’re already within the law’s scope.

Your Core Obligations

• Article 10 — Data Governance: You’re responsible for knowing the origin of training data and whether it’s biased.

• Article 13 — Transparency: You must be able to explain decisions to affected individuals.

• Article 14 — Human Oversight: There must be meaningful human intervention.

• Article 17 — Post-Market Monitoring: You need audit trails and reporting structures to track system behavior over time.

Even if your vendor is based outside the EU, you are liable for compliance if you use their AI tools on candidates or employees in the EU.

This is not optional — it’s operational risk management.

Top 10 Questions Every HR Leader Should Ask Their AI Tech Vendor

When evaluating or renewing HR tech contracts, use this checklist to safeguard your organization:

1. Does this product use AI or machine learning in any aspect of its functionality?

2. What decisions or recommendations does the AI influence within our workflows?

3. What is the source of the training data?

4. Can we review the model’s logic or its explanation of outputs?

5. How often is the model retrained or updated?

6. Is there always a human in the loop before final decisions are made?

7. Can AI-driven decisions be overridden, and is the override tracked?

8. What happens to employee data when our contract ends?

9. Do we receive complete audit logs of AI decisions and activity?

10. Is this tool considered “high-risk” under the EU AI Act? How are you ensuring compliance?

Final Take: Accountability Isn’t Optional

HR leaders can no longer afford to treat AI as someone else’s domain. If the technology touches people, it’s your responsibility.

Relying on vendors to carry your compliance burden is not just risky, it’s legally and regulatory untenable. What’s needed now isn’t just better contracts. It’s active ownership of how AI systems shape careers, pay, performance, and opportunity.

You don’t need to fear your HR tech stack — but you do need to govern it.

The future of ethical, equitable, and compliant HR won’t be built by vendors. It will be shaped by leaders willing to ask hard questions — and demand clear answers.

About AI Governance for HR CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. This CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination lawsuits.

Join us live every Wednesday for our Let’s Build Governance Together Series - Our live programs are a premium edition of this Colab.

PS — If you know a CHRO, HR VP, or talent leader navigating AI in the talent cycle, please restack and share this post. It grows AI Governance for HR and accelerates the release of When AI Breaks the Law and its companion toolset.

Share AI GOVERNANCE for HR

The EU AI Act, effective August 2026, is the world’s first comprehensive legal framework for artificial intelligence. For U.S.-based HR leaders who hire globally, its strict rules on AI in employment are not a future concern—they are an immediate compliance imperative. This glossary defines the essential terms you need to know to ensure your talent strategy is compliant and future-ready.

Part 1: The Big Picture Concepts

1. EU AI Act

The EU AI Act is the world’s first comprehensive legal framework for AI, passed in 2024 and scheduled to take effect in August 2026.

Why It Matters for HR: The Act is not just a European issue; it is a “compliance imperative” for any U.S. company hiring globally. It directly regulates AI systems used in employment, classifying them as “high-risk” and imposing strict new requirements.

2. Extraterritorial Reach

This term describes the Act’s power to extend well beyond the EU’s borders, affecting companies based on their activities rather than their location.

The Act applies to any company that:

• Uses AI to screen or assess candidates located in the EU

• Evaluates EU-based employees, regardless of their citizenship

• Operates offices within EU Member States

Why it Matters for HR: Your company’s headquarters location is irrelevant; what matters is where your candidates or employees are. As the source emphasizes, “Headquarters location doesn’t matter—candidate location does.” This mirrors the global impact of GDPR, but this time, the reckoning applies to AI-powered employment decisions.

Now that you understand the Act’s global reach, it’s crucial to know how it categorizes the specific AI tools your team uses every day.

Share

Part 2: The Core Classification and Its Impact

3. High-Risk AI Systems

Under the EU AI Act, any AI system used in employment contexts is categorically labeled “high-risk.”

Examples of high-risk employment tools include:

• Resume screeners

• Automated video interviews

• Assessments

• Performance management platforms

• And even scheduling software

Why it Matters for HR: This classification subjects your HR tools to the highest level of scrutiny and strict compliance requirements. Non-compliance carries steep penalties of up to €20 million or 4% of your company’s global revenue, along with strategic risks such as reputational fallout, loss of candidate trust, and legal exposure under existing U.S. discrimination laws.

Because employment AI is considered “high-risk,” it triggers several key obligations related to human involvement, transparency, and documentation.

Part 3: Key Compliance Obligations for High-Risk Systems

4. Human Oversight (Article 14)

This is the legal mandate to have a “human-in-the-loop”—a qualified person with the competence, training, and authority to review and override AI-driven decisions.

Why it Matters for HR: This is a preemptive control that must be established before the AI is deployed. This means asking a critical question now: ‘Who on my team is qualified to be the human-in-the-loop, and how will we train and empower them to override an algorithm?’ Relying on your vendor is not a compliant strategy.

5. Transparency Requirements (Article 13)

This is the obligation for organizations to clearly explain how their AI systems work, what data they use, and why they make specific decisions. This grants new rights to candidates, including the right to request a human review of an automated decision.

Why it Matters for HR: Simply stating “The algorithm decided” is no longer a legally acceptable explanation for a hiring or promotion decision. Therefore, transparency is not just a legal requirement—it is an essential strategy for building candidate trust and actively defending your employer brand.

6. Documentation and Audit Mandates

This is the requirement to maintain complete, traceable, and audit-ready records for any high-risk AI system used in your talent processes.

Why it Matters for HR: Documentation is not a formality; it is your “legal defense strategy.” These records are essential for defending your organization against audits, regulatory actions, and potential lawsuits.

With these significant compliance duties in mind, the Act is clear about who bears final accountability.

Share AI GOVERNANCE for HR

Part 4: Understanding Your Role and Responsibility

7. Deployer (Article 26)

A “Deployer” is the entity that uses an AI system under its own authority. In the context of HR, the employer is the Deployer.

Why it Matters for HR: This term is critical because it clarifies that the employer—not the software vendor—is ultimately accountable for the AI system’s compliance in its specific use case. This ‘Deployer’ status is precisely why the obligations for Human Oversight (Article 14) and Documentation (Articles 9, 11, 12, 27) fall squarely on your shoulders, not the vendor’s.

Proactive Governance is Non-Negotiable

The EU AI Act compels HR leaders to evolve from technology users to technology governors. The future of hiring demands systems that are explainable, accountable, and equitable, leaving leaders with a clear choice: proactive governance or reactive crisis control.

About AI Governance for HR CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. This CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination lawsuits.

Join us live every Wednesday for our Let’s Build Governance Together Series - Our live programs are a premium edition of this Colab.

Ready to Build Real AI Governance?

Most HR leaders have AI policies. Few have AI governance systems. Join the waiting list for “When AI Breaks the Law” and get the tools to close that gap.

Join the Book Waitlist

Charting a New Path: Introducing “When AI Breaks the Law”

For HR leaders navigating this new reality, there is now a definitive guide. “When AI Breaks the Law: AI Governance for Talent Leaders” by Margaret Spence is the essential playbook for establishing durable, defensible, and ethical AI governance. The book will be available in stores on April 20th. Join the When AI Breaks the Law release list → (Sign Up Here)

The era of trusting AI vendors with your organization’s legal fate is over. The landmark case of Mobley v. Workday is a definitive wake-up call for every senior human resources leader. Derek Mobley, a qualified African American applicant over 40, allegedly applied for more than 100 jobs that used Workday’s AI screening tools and was rejected each time. In one instance, he submitted an application at 12:55 a.m. and received an automated rejection at 1:50 a.m.—a clear signal that no human was involved in the decision.

The court’s ruling sent shockwaves through the industry: AI vendors can be considered “legal agents of the employer.” This critical decision means that accountability for discriminatory outcomes cannot be outsourced through a contract or delegated to a “black box” algorithm. This isn’t just a compliance headache; it’s a balance-sheet catastrophe in the making. One CHRO in our research estimated the potential liability from a single talent system at $365 million, an uninsured risk. The age of consequence for HR has begun, and “we trusted the vendor” is no longer a defense.

The Anatomy of an AI Failure: Why Good Intentions Create Systemic Risk

The Mobley case was not an isolated incident caused by a single flawed algorithm. It was the result of a systemic failure—a complex web of decisions by well-intentioned people across HR, IT, Legal, and vendor organizations. Traditional risk management, which seeks to identify a single point of failure, is dangerously inadequate for governing AI systems where responsibility is so widely distributed.

Recurring failure patterns are woven into how most organizations deploy AI technology. These patterns—such as the “Speed Trap,” where the pressure to deploy outpaces the ability to test, and the “Vendor Shuffle,” where unverified vendor claims are treated as interconnected governance that amplifies and creates hidden systemic risk. Your current approach to writing AI handbook policies likely misses this bigger picture, leaving your organization exposed to the same catastrophic failure outlined in the Mobley lawsuit.

The Leadership Gap: Are Your Teams Prepared to Govern?

With accountability now firmly in your hands, the critical question is whether your team can lead AI governance. True readiness requires a delicate balance of two distinct competencies: AI Fluency, the ability to understand the technology, and Governance Capability, the ability to manage its risks.

Unfortunately, many leadership teams are dangerously unbalanced. At one end of the spectrum is the tech-savvy “Risky Innovator,” who champions new tools without understanding their legal or ethical consequences. At the other end is the compliance-focused “Policy-Driven Steward,” who is strong on policy but lacks the technical comfort to evaluate whether an AI system meets those standards. An unbalanced team is unprepared and vulnerable to the very risks you are now responsible for mitigating.

An Expert Guide for an Unprecedented Challenge

Margaret Spence is a human resources and risk management strategist with over 35 years of experience, having managed more than $495 million in workplace litigation claims as a risk professional. Her front-row view of how well-intentioned systems create catastrophic risk shaped her core belief that “AI governance is not red tape—it’s leadership.” Spence is the expert HR leaders need to translate complex legal challenges into clear operational imperatives.

From Theory to Actionable Frameworks

This book goes beyond abstract principles to provide the operational tools needed to build a robust governance program. It presents a series of powerful frameworks to address the systemic failures and leadership gaps outlined above:

• The SimpliFocus AI Governance System™️: A comprehensive five-step implementation plan to build a durable governance architecture.

Your First Step Towards Accountable AI

In this new age of consequences, ignorance of AI risk is no longer a defense against liability. True leadership requires proactive, informed steps to protect your organization from legal, financial, and reputational harm. Reading this book is the single most important first step to understanding the new rules of engagement and building a governance framework that protects your organization, your people, and your professional legacy.

Get the book release + companion tools.
Sign up to receive the When AI Breaks the Law launch announcement, bonus resources, and next steps for implementing AI governance in HR.

Join The Prelaunch

About AI Governance for HR CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. This CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination lawsuits.

Join us live every Wednesday for our Let’s Build Governance Together Series - Our live programs are a premium edition of this Colab.

This is a conversation space exclusively for subscribers—kind of like a group chat or live hangout. I’ll post questions and updates that come my way, and you can jump into the discussion.

Join chat

Read more

The European Union’s Artificial Intelligence Act is a landmark regulation that will fundamentally change how companies develop, deploy, and use AI systems. For Human Resources professionals, this isn’t a distant technological issue; it’s a core compliance and ethical challenge that directly affects how you can use AI in recruitment, employee management, and workplace operations.

This guide is designed to demystify the Act’s risk-based categories for an HR audience. We will focus on how the regulation classifies AI applications you might encounter throughout the employee lifecycle, from hiring and promotion to performance monitoring. The Act’s central goal is to promote “human-centric and trustworthy artificial intelligence” while ensuring a high level of protection for fundamental rights (Recital 1, Article 1). Understanding its framework is the first step toward building a compliant and ethical HR technology strategy.

To begin, it’s essential to understand the core terminology the Act uses to define the technologies it governs.

The Building Blocks: Key Definitions for HR

This section clarifies the fundamental terms in the EU AI Act that are most relevant to HR functions. For each definition, we provide the official concept and a simple, one-sentence explanation in HR terms.

What is an ‘AI System’?

The Act provides a broad, technology-neutral definition of an AI system to remain future-proof.

An ‘AI system’ means a machine-based system designed to operate with varying levels of autonomy, may exhibit adaptability after deployment, and, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.

In HR terms, this includes everything from resume-screening software and performance-monitoring tools to chatbots that interact with candidates and internal AI-powered survey-analysis platforms.

Biometric and Emotion-Based Technologies

The Act pays special attention to technologies that process human characteristics. Understanding these distinctions is crucial because their use is heavily restricted.

Now that these basic terms are clear, we can examine how the EU AI Act uses them to classify AI systems into risk categories.

2. Unacceptable Risk: AI Practices Prohibited in the Workplace

The EU AI Act takes a firm stance against AI practices that pose a clear threat to human rights, dignity, and EU values. As stated in Recital 28, these practices are “particularly harmful and abusive and should be prohibited.” For HR professionals, this means there are no exceptions or risk mitigation strategies; procurement, deployment, or use of such systems is strictly illegal.

The following practices are the most relevant prohibitions for a workplace context:

• Emotion Recognition in the Workplace. Based on Article 5(1)(f), it is prohibited to place on the market or use AI systems to infer the emotions of individuals in workplace settings. The Act recognizes that these systems have “limited reliability” and are highly intrusive, particularly given the “imbalance of power” inherent in an employer-employee relationship (Recital 44). This ban does not apply in narrow cases, “...except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons.”

• Sensitive Biometric Categorization Article 5(1)(g) prohibits using AI to categorize individuals based on their biometric data to deduce or infer sensitive data such as race, political opinions, trade union membership, religious beliefs, or sexual orientation. This prevents the use of AI tools that might attempt to profile candidates or employees along these protected lines.

• Social Scoring. The Act bans AI systems that evaluate or classify people based on their social behavior or personal characteristics to generate a “social score” (Article 5(1)(c)). If that score results in detrimental or unfavorable treatment in contexts unrelated to where the data was collected, it is prohibited. In an HR context, this would prohibit a system that, for instance, lowers an employee’s internal “trustworthiness” score based on their social media activity, thereby affecting their eligibility for promotion.

These prohibited systems pose the highest level of risk. The next category, while not banned, is subject to the strictest regulations.

3. High-Risk AI Systems: What HR Needs to Know

This section is the core of the Act’s regulatory framework for HR. “High-risk” AI systems are not banned, but their potential to significantly affect people’s fundamental rights means they must comply with a strict set of rules before they can be used.

What Makes an AI System “High-Risk”?

High-risk systems are those used in critical areas that can have a substantial impact on a person’s life and opportunities. As Recital 57 highlights, AI systems used in employment are a prime example because they “may have an appreciable impact on future career prospects, livelihoods of those persons and workers’ rights.”

These systems are not banned but are subject to a rigorous compliance regime. Before deployment, both the system’s provider and the user organization must navigate specific hurdles and produce substantial documentation to demonstrate adherence to mandatory requirements, including:

• Risk management systems

• Data quality and governance

• Technical documentation and record-keeping

• Transparency and provision of information

• Human oversight

• Accuracy, robustness, and cybersecurity

Share AI GOVERNANCE for HR

High-Risk AI Applications in the Employee Lifecycle

The Act’s binding legal classification in Annex III, point 4, explicitly designates AI systems used in “employment, workers management and access to self-employment” as high-risk. The rationale, explained in Recital 57, is that these systems can significantly affect career prospects and worker rights. The following use cases are specifically identified:

1. AI for Recruitment and Selection: Systems that place job advertisements, screen or filter applications, and evaluate candidates.

   • Examples: Automated resume screeners that rank applicants, chatbots that conduct initial interviews, and video analysis tools that evaluate candidate performance.

2. AI for Promotion and Termination Decisions: Systems used to make decisions that affect the terms of a work relationship, such as career progression or ending an employment contract.

   • Examples: Performance management software that uses algorithms to recommend employees for promotion, or systems that flag employees for termination based on performance metrics.

3. AI for Task Allocation: Systems that assign tasks to employees or teams based on individual behavior, personal traits, or inferred characteristics.

   • Examples: A logistics system that assigns delivery routes based on a driver’s monitored behavior, or a platform that allocates freelance work based on inferred personality traits.

4. AI for Performance Monitoring and Evaluation: Tools that track or assess employees’ performance, behavior, or productivity.

   • Examples: Software that tracks employees’ computer activity to measure productivity, or tools that analyze communications to evaluate teamwork and engagement.

Understanding which of your tools fall into these categories is no longer merely a matter of good practice; it is a critical step toward legal compliance.

Key Takeaways: Why These Classifications Matter for Your HR Department

The EU AI Act’s risk framework is more than a legal checklist; it’s a strategic guide for building a fairer, more transparent, and more trustworthy workplace. Here are the most critical implications for your HR department.

1. Scrutinize Your HR Tech Stack. Your immediate priority is to conduct a thorough audit of your current and planned HR technologies. Identify which, if any, of your tools fall into the “prohibited” or “high-risk” categories. An AI tool for scheduling meetings is low-risk, while a tool that ranks candidates for a promotion is high-risk and requires rigorous oversight.

2. Vendor Accountability is Crucial. The Act imposes significant legal obligations on providers of high-risk AI systems. As a user (or “deployer” under the Act), your HR team must demand transparency and proof of compliance from your software vendors. Before purchasing or renewing a contract, request documentation and be prepared to ask pointed questions, such as:

   • Is your system classified as ‘high-risk’ under Annex III of the EU AI Act?

   • Can you provide us with the system’s EU Declaration of Conformity and technical documentation?

   • What specific measures have you implemented for effective human oversight?

   • How have you tested for and mitigated bias in your datasets and algorithms?

3. Protecting Employee Rights is Paramount. At its core, the Act is designed to safeguard fundamental rights, including non-discrimination, fairness, and privacy (Recitals 48 & 57). Viewing compliance through this lens turns it from a legal burden into a strategic asset. In today’s competitive talent market, a demonstrable commitment to fair and transparent AI is a powerful component of your Employer Value Proposition (EVP). By ensuring your use of AI is transparent, fair, and subject to human oversight, you build trust with candidates and employees, foster a more equitable workplace, and gain a competitive advantage in attracting and retaining top talent.

About AI Governance for HR CoLab Workspace

Margaret Spence, author of When AI Breaks the Law, helps HR and talent leaders operationalize AI governance across hiring, performance, and promotion. This CoLab workspace delivers daily frameworks to bridge the gap between compliance documentation and ethical AI principles—the gap where the $365M Mobley lawsuit occurred. You’ll build governance infrastructure that reduces legal, reputational, and EU AI Act compliance exposure before AI-driven talent decisions scale bias into discrimination lawsuits.

Join us live every Wednesday for our Let’s Build Governance Together Series - Our live programs are a premium edition of this Colab.