Scoped use-case brief
A defined task, intended users, expected benefit, excluded uses and accountable owner.
07HR Service and Analytics
HR AI Framework
Choose useful HR applications for AI, test them against real work and keep accountable people in control.
A clear permitted scope
Testing against representative work
Accountable human oversight
HRAIFHuman-Governed AI Lifecycle
Start with your situation
When this framework helps.
- An HR team is considering AI for drafting or finding approved information.
- A convincing demonstration has not been tested against routine work and exceptions.
- Existing AI use lacks clear ownership, scope or review arrangements.
The decisions it supports
- Is AI appropriate for this task compared with simpler alternatives?
- What information, errors and people impacts must the service control?
- Who can authorise, monitor, change or stop its use?
The framework at a glance
Human-Governed AI Lifecycle
Consider where AI can support HR work, with clear purpose and human judgement.
Explore the complete model
The approach
Start with the work and its consequences
Select worthwhile applications, establish boundaries, test performance and keep people, evidence and oversight at the centre of delivery.
AI can assist with drafting, finding approved information and summarising material. Its usefulness depends on the task, information available, quality of review and consequences of an error. A plausible answer can still be wrong, disclose information inappropriately or steer a person towards an unfair conclusion.
The HR AI Framework helps organisations decide where assistance is worthwhile and where the risk, uncertainty or lack of control makes a use case unsuitable. It connects business value with people impact, data safeguards, testing, clear authority and ongoing review.
The framework excludes autonomous hiring, dismissal, promotion, pay, disciplinary and other consequential people decisions. A named, competent person must retain substantive decision authority. Human review requires time, relevant evidence and the ability to reject an output; a routine approval click is insufficient.
What you can take forward
Useful work. Clear next steps.
Testing and authorisation record
Representative questions, exceptions and acceptance criteria used to judge readiness for a controlled pilot.
Operating and review controls
Human support, information access, monitoring and stop criteria that remain active after launch.
HRAIF · In practice
Six stages of the Human-Governed AI Lifecycle
Frame
Describe the work, intended users, expected benefit and people affected. Compare AI with simpler process changes and existing tools. Establish a baseline for time, quality and user experience. Specify the mistakes that would matter and what evidence would demonstrate a useful improvement.
Bound
Document permitted inputs, outputs, users, integrations and actions. Assess sensitivity and potential harm. Define excluded uses and the human review required. Check vendor arrangements, access, retention, model-training settings and information flows before any real employee or applicant data is introduced.
Test
Evaluate a defined version on representative, authorised test cases. Include ordinary tasks, difficult exceptions, misleading inputs and scenarios that should trigger refusal or escalation. Test against source evidence and an agreed human-reviewed baseline. Record failures as well as successes and examine uneven performance across relevant groups and languages.
Authorise
An accountable owner reviews the purpose, residual risks, test results and operating arrangements with appropriate HR, privacy, security, procurement and legal specialists. Approval specifies the scope, conditions, review date and stopping rules. A vendor demonstration or positive trial response does not constitute organisational approval.
Operate
Limit access to trained users, keep meaningful human review and provide a clear route to assistance. Maintain approved knowledge sources and monitor actual performance. Keep proportionate records of versions, material decisions, incidents and corrective action, without retaining unnecessary personal content.
Review
Reassess benefit, harm, reliability and user experience. Re-test after material changes to models, data, prompts, integrations or purpose. Continue, narrow, pause or retire the use case according to the evidence. Maintain a workable non-AI alternative and a tested way to disable the service safely.
HRAIF · In practice
Four use categories with different controls
These are HR Delivery's practical review categories, not statutory risk classifications. A category is determined by actual use and consequences, rather than a supplier's product label.
Assisted general work
Drafting generic communications or workshop structures using public, synthetic or otherwise approved non-personal information. A person checks accuracy, tone, intellectual-property concerns and suitability before use or publication.
Controlled internal support
Retrieval from approved internal guidance or summarisation of authorised, appropriately scoped material. Controls include source permissions, current references, secure access, clear limitations and escalation when the answer is uncertain or outside scope.
Restricted specialist support
Work involving sensitive employment material or meaningful influence over a person's treatment requires heightened review before any pilot. Boundaries, necessity, permitted processing and qualified oversight must be explicit. This category is not permission to score or rank people or to outsource professional judgement.
Excluded uses
Autonomous consequential people decisions, covert monitoring, emotion or personality inference from appearance or voice, and systems that cannot provide required controls are outside this framework's supported deployment scope. A legitimate business objective does not make every proposed method acceptable.
HRAIF · In practice
Test the service rather than the demonstration
A test plan needs task-specific acceptance criteria agreed before evaluation. For an HR policy assistant, these might cover correct reference selection, complete answers, appropriate uncertainty, accurate escalation and prevention of access to documents the user cannot otherwise read. Test obsolete policies, conflicting versions and questions spanning jurisdictions.
For generative tools, test fabricated references and confident errors. Where tools can take actions, check that permissions are narrow, source documents cannot authorise actions, and human approval is required for consequential steps. Enforce access and action permissions independently of the model; instructions in retrieved material are information to assess, not authority to act. Evaluate how the entire workflow behaves when a component fails. OWASP guidance on excessive agency.
Bias testing uses relevant, lawfully obtained evidence and defined outcomes. Examine group and language differences in errors, access, escalation and burden, including intersections where data supports safe interpretation. Investigate gaps and re-test changes. Small samples and unobserved groups limit conclusions; passing a test does not establish universal fairness.
HRAIF · In practice
Make oversight a real operating role
Specify who reviews which output, what they check and when they must escalate. Reviewers need the source material and training to challenge the system. They must be able to pause the workflow without pressure to accept an answer merely to meet a speed target.
Tell affected users when AI is materially involved, explain the service's boundaries and offer an accessible route to a human. Where an output affects someone's treatment, retain an understandable account of the human decision and a route to challenge or correct relevant information. These transparency and accountability priorities are consistent with the OECD AI Principles.
Data protection, confidentiality and security requirements apply throughout. Minimise inputs, confirm permitted processing and transfers, separate testing from live records and control logs. Do not assume that a commercial subscription, anonymised-looking text or disabled training setting resolves every privacy risk.
From insight to action
Evidence and outputs for accountable decisions
An engagement can produce a use-case inventory, a prioritised opportunity-and-risk review, control requirements, a pilot test plan and a documented go, revise or stop recommendation. An operating plan assigns service ownership, reviewer responsibilities, incident routes, monitoring and reapproval triggers.
Measure the work needed to reach a usable answer, including human review and corrections. Track accuracy, appropriate escalation, user effort and any differences in service quality alongside time saved. Agree acceptable performance and stop criteria before the pilot. Estimated savings remain assumptions until a controlled comparison shows a useful improvement without unacceptable errors or information exposure.
The review draws on the life-cycle risk perspective in the voluntary NIST AI Risk Management Framework and the generative-AI profile's treatment of issues including unreliable outputs, privacy and harmful bias. HRAIF's stages and use categories are an original consultancy design; using them does not imply NIST endorsement or certification. NIST AI RMF and NIST Generative AI Profile.
HRAIF · In practice
A proportionate consulting approach
We start with discovery across HR workflows and existing AI use, including features already embedded in software. We shortlist useful applications, review readiness and design a bounded pilot. Testing and interpretation inform a deployment recommendation; rollout follows only when the agreed controls and authority are in place.
Training focuses on the actual tasks and failure modes staff will encounter. Monitoring responsibilities and review capacity are resourced before expansion. The framework supports responsible management practice and does not replace jurisdiction-specific legal advice or certify regulatory compliance.
Your questions, answered
Frequently asked questions
Can we start with a small pilot?
Yes. Begin with a bounded, lower-consequence task and approved information. Agree acceptance criteria, oversight and a stopping rule before testing.
Does human review make any use acceptable?
No. Review must be effective, and some uses remain inappropriate because of their purpose, data, evidence or consequences.
Can AI make recruitment or performance decisions?
This framework does not support autonomous consequential people decisions. Any proposed assistance in these contexts requires separate specialist review and substantive human accountability.
How often should we review a tool?
Set a risk-based schedule and event triggers. Material changes, incidents, quality deterioration or new uses should prompt earlier review.
An illustrative application
Test an AI policy-information service before a pilot
Illustrative scenario.
The situation
An HR team proposes a policy assistant after a convincing demonstration. Users work in several jurisdictions, policy versions conflict and some source documents have restricted access. The team has not agreed who maintains the service or checks its answers.
Explore the evidence
Frame the task and compare it with simpler improvements to the policy index. Bound the assistant to approved sources, permitted users and defined topics. Test representative questions, obsolete documents, conflicting versions and requests outside the user’s access. Use no live personal records unless their processing has been explicitly authorised.
Agree the next step
Authorise a pilot only after a competent owner reviews the evidence and controls. Require clear source references, escalation for unresolved ambiguity and effective permission enforcement. Train reviewers to check jurisdiction, version and completeness, with the authority to reject answers and pause the workflow.
Review what changes
Operate with a maintained source owner and a human support route. Review errors, corrections, user burden and usable time saved. Re-test after material model or source changes, and narrow, pause or retire the service when it cannot meet the agreed criteria. Expansion requires review of the new purpose and consequences.
Put the framework to work
Choose a useful next step with clear safeguards
HR Delivery can help you identify a practical opportunity, test it responsibly and decide whether the evidence supports adoption, revision or stopping.