AI in HR — Frequently Asked Questions
Where AI fits in people operations — policy questions versus decisions about individuals, the confidentiality trap in HR retrieval, performance reviews, monitoring, and where to start safely.
We have not built an HR system. See AI HR for the boundary we would draw.
The line#
Where does the boundary run?#
Between work that is about policy and work that is about a person.
Policy questions — leave entitlement, expense limits, notice periods — are answered from documents, asked constantly, and consume a large share of a small HR team's week. That is the strongest case for retrieval in any business function.
Anything about a specific individual — performance, discipline, promotion, redundancy selection, pay — is a decision about someone's livelihood, frequently with legal consequence. It needs a human decision, a documented rationale, and a route to challenge.
Why does that boundary matter so much?#
Because most bad outcomes come from a system built for the first case quietly drifting into the second. It starts as a policy assistant, someone asks it something about a colleague, and it answers.
The confidentiality trap#
What is the most common mistake?#
Indexing everything in the HR folder. It is the fastest route to a working demo and to a confidentiality incident, and they arrive in that order.
An HR corpus legitimately contains different documents for different audiences: an employee handbook, a manager's guide, a policy under consultation, an individual's record, a live grievance. A system indexing all of it will eventually tell someone something about a colleague.
How is that prevented?#
Retrieval filtered by the asking person's entitlements, at query time, before ranking. Filtering after generation is too late — the model has already seen the content, and the answer can leak it even when sources are hidden. See RAG.
How serious is a failure here?#
It is a data protection incident, frequently involving special-category information, not an embarrassing bug. Treat and report it as one.
Uses#
What is the safest place to start?#
An onboarding assistant. Policy documents only, permission-filtered, sources shown, an explicit refusal when the answer is not in the corpus, and a visible route to a human.
New starters ask the same forty questions and feel uncomfortable asking repeatedly, so they guess instead. A system that answers at 21:00 on day two is genuinely valuable, and its worst failure is "I do not know, ask HR".
What about performance reviews?#
There is a usable split. Helping a manager find and organise the evidence they already have, and write it clearly, is legitimate and saves real time. Producing the rating itself is not.
Watch for the drift between those two: a tool that summarises evidence tends to acquire a "suggested rating" field, and once that exists most managers accept it. The interface shapes the behaviour more than the policy does.
Can we summarise engagement survey feedback?#
Yes, with care about re-identification. In a team of four, a summary of the free-text responses can identify who wrote one. Set a minimum group size before any aggregation is shown.
What about drafting policies and job descriptions?#
Straightforwardly useful — drafted by a system, reviewed by a person. Job descriptions in particular benefit, because unnecessary requirements measurably narrow the applicant pool.
What not to do#
Sentiment scoring of employees?#
No. Inferring engagement or flight risk from communications is surveillance regardless of the label, and it damages the trust that people operations runs on. The discovery is corrosive and permanent.
Monitoring employees do not know about?#
No. Whatever the local legal position, this is the category where being technically permitted and being wise diverge most sharply.
Answering questions about a named colleague?#
Even where permissions technically allow it, a system that will discuss individuals is one prompt away from a problem. Keep it out of scope explicitly.
Running it#
What should we measure?#
Deflection rate — questions answered without a human — paired with satisfaction, or you optimise for people giving up. Refusal accuracy on questions the corpus cannot answer. Permission correctness, tested continuously with accounts at different levels. Escalation rate, and whether that route is used at all.
Do employees need to be told it is AI?#
Yes, and EU transparency obligations for AI interaction have applied since 2 August 2026. Which rules apply to you is a question for your legal advisers.
There is a workplace-specific reason too. An employee asking about their leave entitlement is one thing; an employee working out whether to raise a grievance is another, and how much they disclose depends on who they believe is listening. Ambiguity there is a trust problem long before it is a compliance one.
What about special-category data?#
Handle it deliberately, and preferably keep it out of the system entirely. Health information, union membership and disciplinary records carry heightened obligations in most data protection regimes. Confirm your position with counsel before indexing anything of that kind.