AI governance in HR: where should human judgment take over?

There is a point in almost every conversation about artificial intelligence in HR when the subject changes. At first, the discussion is usually about what the technology can do. Can it summarize a policy? Prepare a first draft? Find information faster? Help someone work through a large volume of documents? For HR teams already dealing with heavy administrative workloads, the attraction is obvious. 

Then someone asks a different question: what information should the AI be allowed to see? That is where a conversation about productivity becomes a conversation about responsibility. 

HR works with some of the most sensitive information in an organization. Compensation, performance, absences, recruitment records, workplace incidents, health information and employee relations can all be part of the HR environment. Putting an AI interface in front of that information does not make it less sensitive. In some cases, it increases the need for control. 

The question facing organizations is therefore no longer simply whether AI belongs in HR. It is where it belongs, what it should be allowed to do and who remains accountable when it contributes to a decision. 

Which HR uses of AI need stronger governance? 

There are many legitimate uses for AI in HR. An assistant can help prepare a first version of an employee communication. It can summarize a lengthy document before a meeting, make information easier to find or help an HR professional work through a large amount of material more efficiently. These uses can save time without fundamentally changing who is responsible for the work. 

The picture becomes more complicated when AI starts influencing decisions about people. Using AI to improve the wording of an internal email is not the same as using a system to assess which applicants should move forward in a recruitment process. One supports a task. The other can affect someone’s livelihood or career prospects. Those uses should not be governed in the same way. 

Canada’s privacy commissioners draw a similar line. In a 2023 joint resolution on workplace privacy, they recommended that employers use AI only for fair and appropriate purposes, and only to the extent reasonably necessary. They also cautioned against using AI to make significant decisions about an employee’s performance, candidacy or employment prospects without a human in the loop, and recommended privacy impact assessments and, where relevant, algorithmic impact assessments. 

That points to a useful principle for HR leaders: governance should follow consequence. The greater the potential impact on a person, the stronger the oversight should be. 

In practice, a simple AI governance framework can rely on three tiers of use:

How to identify and find shadow AI in HR 

Many organizations instinctively begin with a policy, but an inventory may be more useful. AI often enters the workplace gradually rather than through one formal implementation. It can appear inside recruitment software, productivity tools, service platforms and applications employees already use. Some teams may also adopt general-purpose assistants on their own because they make every day work easier. As a result, an organization may already have more AI in use than its leadership realizes. Much of it is shadow AI: tools that employees adopt without IT or HR approval. 

The gap between use and oversight is already visible. According to NexaRH’S 1st Barometer of AI in HR in Canada, 67% of HR professionals use AI on an individual basis, but only 33% say their organization has AI governance in place. 

Understanding the uses already in place makes it possible to separate them according to purpose and risk. Drafting, summarizing and searching for information belong in one category. Candidate screening, performance assessment and recommendations that could influence an employment decision belong in another. 

That distinction turns governance into something practical. The organization no longer has to answer the broad and unhelpful question of whether it supports AI. It can decide which uses are appropriate, under which conditions and with what safeguards. 

The same exercise should examine the information that flows through those tools. HR AI cannot be governed separately from HR data. If access to an employee record is tightly controlled inside the organization’s HR environment, it makes little sense to relax those standards simply because an AI application has a convenient interface. Teams need to understand where information is processed, whether it is retained, who can access it and whether it is genuinely required for the task being performed. 

This is also where a common assumption deserves to be challenged: more data does not necessarily create better AI. Sometimes it simply creates more exposure. A well-governed use of AI should rely on the relevant context required for a task, not on unrestricted access to everything the organization happens to know. 

A practical starting point takes four steps: 

1. List every AI tool in use, including features built into existing software and assistants teams have adopted on their own. 
2. Classify each use by purpose and by its potential impact on people, using the three tiers above. 
3. Map the data each tool can access, where it is processed and whether it is retained. 
4. Set the rules for each tier: who can use the tool, with which data, who reviews the output and what is recorded.

Human in the loop: why oversight must mean more than clicking “approve” 

“Human in the loop” has become one of the standard phrases of responsible AI. The principle is important, but the phrase itself can be misleading. 

If a manager receives an AI-generated recommendation and accepts it almost every time, a human may technically be part of the workflow. That does not necessarily mean meaningful judgment is being exercised. 

Real oversight requires the reviewer to have enough information, authority and understanding to challenge the result. That person should be able to consult the underlying information, consider circumstances the AI may not understand and reach a different conclusion where appropriate. 

This matters because AI errors do not always look like errors. A result can be well written, logical and convincing while still being based on incomplete information or a flawed assumption. In an HR context, that distinction can have real consequences. The fact that a system sounds confident does not make its conclusion reliable. 

Traceability becomes important for the same reason. If an AI-supported decision is challenged several months later, the organization should be able to understand how the process unfolded. That does not require an elaborate audit trail for every low-risk interaction. But when AI contributes to a consequential HR process, there should be enough visibility to understand which tool was involved, what relevant information it used, what it produced and where human judgment entered the process. Without that visibility, mistakes are more difficult to investigate and more difficult to learn from. 

Why secure HR data and context matter for AI governance

Much of the current discussion about responsible AI focuses on models, algorithms and individual applications. In HR, the environment surrounding the technology can matter just as much. 

An employee record rarely makes sense on its own. Its meaning may depend on the employee’s role, location, business unit, schedule, collective agreement, organizational policy or the permissions of the person accessing it. An AI system may be capable of processing enormous volumes of data without understanding which rule applies to which employee. 

That is one of the reasons fragmented HR environments create a particular challenge for AI. When information, rules and processes are spread across disconnected systems, the context surrounding each AI use has to be recreated. 

A more coherent HR environment provides a stronger starting point. The objective is not to give AI unrestricted access to more information. It is almost the opposite: to make the appropriate information available for a defined purpose, under the right rules and permissions. 

This principle is central to Sigmia’s approach. Its AI is built into the platform itself: it works inside supported HR and payroll screens, documents and workflows, and draws only on the documents and rules that administrators approve. Useful AI depends on structured HR data, clear business rules and controlled processes, with human judgment remaining central to important decisions. 

For organizations managing multiple entities, distributed workforces, payroll requirements and sensitive employee information, that context is not a secondary technical detail. It is what allows AI to work with the organization’s actual reality rather than with an incomplete version of it. 

“AI must operate in a secure and compliant environment. When it is integrated directly into an HRIS, that framework is already in place: sensitive data is protected, AI actions can be verified, and access is controlled.”

Patrice Poirier, Founder, Sigmia, 1st Barometer of AI in HR in Canada, 2026

Clear AI governance makes AI easier to use 

Governance is often portrayed as the part of AI adoption that slows innovation down. In practice, uncertainty can create even more friction. 

When an organization has no agreed boundaries, every proposed use of AI reopens the same discussions. Can this data be used? Does the privacy team need to review the project? Does security need to approve it? Who needs to validate the result? Who owns the final decision? These are necessary questions. They become inefficient when teams have to answer them from scratch every time. 

A mature governance model creates boundaries that people can understand. Low-risk uses can move with fewer obstacles. Higher-risk uses receive more scrutiny. Some applications may be ruled out because their potential value does not justify the consequences if something goes wrong. 

That is a more useful definition of responsible AI adoption in HR. It is not about putting AI into every process, nor about avoiding the technology because the risks feel difficult. It is about knowing where AI belongs, what information and context it should be allowed to use, and where human judgment must remain decisive. 

Five practical principles for AI governance in HR:

• AI governance in HR should follow consequence: the greater the potential impact on a person, the stronger the oversight. 

• Start with an inventory of the AI already in use, then classify each use by purpose and risk. 

• Give AI access only to the data and context a task requires, under existing permissions. 

• Make human review meaningful: reviewers need the information and authority to disagree with the AI. 

• Keep enough traceability to explain any AI-supported decision that affects an employee or a candidate. 

Sources 

• Office of the Privacy Commissioner of Canada (2023). Protecting Employee Privacy in the Modern Workplace 

• Office of the Privacy Commissioner of Canada (2023). Principles for Responsible, Trustworthy and Privacy-Protective Generative AI Technologies 

• Office of the Privacy Commissioner of Canada (2024). Protecting Privacy in the Digital Workplace 

• Office of the Privacy Commissioner of Canada (2025). Privacy in the Workplace 

• NexaRH (2026). 1st Barometer of AI in HR in Canada: AI, work reinvented in accelerated mode. Survey of 336 HR professionals; Sigmia (then SIGMA-RH) was one of the sponsors. 

• AHBL (2025). Ontario job posting rules take effect on January 1, 2026 
• Government of Ontario. Requirements related to publicly advertised job postings.