AI Workflows · HR operating model · Updated June 2026

AI Governance for People Teams: How HR Owns the Policy the CEO Just Asked For

Governance is drifting from IT and Legal onto HR's desk, because the highest-risk AI use in any company is a decision about a person. Here is how to own it: the RACI, the review cadence, and a one-pager you can build today.

Why governance landed on HR's desk

For two years, AI governance lived with IT and Legal. IT worried about tools and security, Legal worried about contracts and the EU's rules, and HR was a stakeholder at best. That arrangement is quietly breaking, because the AI uses that carry the most legal and human risk turned out to be the ones HR runs: hiring screens, promotion tools, performance documentation, discipline recommendations. When a regulator or a plaintiff comes looking, they are not asking IT about the data center. They are asking who decided to use an algorithm in hiring and whether anyone checked it for bias.

So the CEO reads an article, hears that other companies are getting sued over AI hiring tools, and asks for "our AI governance policy." That request usually lands on HR, and a lot of People leaders freeze, because governance sounds like a giant framework that belongs to someone with a compliance title. It does not have to. The version of governance HR actually needs is narrow and ownable: the part that covers AI in people decisions, built from three artifacts you can produce this month.

Governance is not a framework you buy. It is three questions you can answer in writing: who owns this, how often do we check it, and could we explain it to an auditor.

The three artifacts that make governance real

Strip governance down to what an auditor or an executive actually wants to see, and it is three documents. Build these and you have moved from "we should do something about AI" to "here is how we govern it."

What HR-owned AI governance looks like

Artifact	What it answers
The RACI	Who is responsible, accountable, consulted, and informed for each AI use in people decisions?
The impact-assessment cadence	How often do we review each high-risk AI use for bias, accuracy, and legality?
The governance one-pager	Could an executive or auditor understand how we govern AI in five minutes?

The RACI is the spine. For every place AI touches a people decision, it names a single accountable owner, the people responsible for running it, the functions consulted (Legal, IT, Security), and who must be kept informed. Most governance failures are really ownership failures: a tool nobody clearly owned, a check nobody was assigned to run. The RACI closes that gap on paper before it becomes a gap in court.

The impact-assessment cadence borrows from the annual-assessment idea now appearing in state AI laws like Colorado's. You set a schedule, quarterly or annual depending on risk, to review each high-risk AI use for bias, accuracy, and continued legality. The cadence is what turns governance from a one-time document into a living practice, and it is exactly what a regulator wants to see when they ask "when did you last check this."

Build it with AI in an afternoon

Each of these three artifacts is a structured document, which is precisely what AI drafts well. Run this with Claude or your sanctioned tool, one artifact at a time.

Step 1: Inventory where AI touches people decisions

Before drafting anything, list every place AI influences a decision about a person: sourcing, screening, interview scoring, promotion, performance documentation, discipline. You cannot govern a use you have not found, and the inventory is the input for all three artifacts. This is human knowledge work; the model cannot find your shadow uses for you.

Step 2: Draft the RACI

Feed the inventory in and ask for the matrix. Example prompt: "You are helping an HR team build an AI governance RACI. Here are the places AI touches people decisions in our company: [paste your inventory]. For each one, draft a RACI row naming a responsible role, a single accountable owner, the functions to consult (suggest Legal, IT, Security where relevant), and who to keep informed. Use generic role titles, not real names. Flag any use where no clear owner is obvious."

Step 3: Build the impact-assessment template and cadence

Example prompt: "Draft an AI impact-assessment template for a single high-risk people-decision use. It should capture: what the tool does, what data it uses, the bias check performed and its result, the legal basis and applicable state notice requirements, the human reviewer of record, and the date of next review. Then propose a review cadence, quarterly for the highest-risk uses and annual for lower-risk ones, and explain the split in two sentences."

Step 4: Write the one-pager

Example prompt: "Using the RACI and the assessment cadence above, write a one-page AI governance summary an executive or auditor can read in five minutes. Cover: our principle (a named human owns every AI-influenced people decision), how we assign ownership, how often we assess, and how we keep records. Plain language, no jargon, one page."

Step 5: A named leader reviews, the cross-functional partners sign on, you publish

The model gave you three solid drafts. Now a human owns them. A named People leader reviews every RACI entry, confirms the legal references with counsel, and walks the one-pager through IT, Legal, and Security so the consulted functions actually agree to their roles. You date it, assign the accountable owner, and set the first assessment on the calendar. Save the prompts as templates so the next review cycle starts from your standard.

Honest usage notes

The artifacts are fast to draft and slow to make real. AI will produce a clean RACI and a tidy one-pager in an afternoon, and that genuinely beats staring at a blank page. The value, though, is in the human work around it: actually finding your shadow AI uses, getting IT and Legal to commit to their consulted roles, and holding the assessment cadence when the calendar gets busy. A beautiful governance document that nobody follows is worse than none, because it creates a paper record you are not living up to.

Governance is also genuinely cross-functional, and HR owning the people-decision slice does not mean HR owns all of AI. Be precise about the boundary: HR is the accountable owner for AI that affects people decisions, and a consulted partner for the rest. Claiming more than that sets you up to own risks you cannot control. For the multistate legal pressure that makes this cadence necessary, our briefing on the AI employment law patchwork shows why a regular assessment is the safe posture, and our employee AI policy guide covers the companion artifact every governance program needs.

What to do this quarter

You do not need a governance team or a new platform to answer the CEO's question. Block an afternoon, inventory where AI touches people decisions, and build the three artifacts with the prompts above. By the end of the day you have a RACI that names owners, an assessment template and cadence, and a one-pager an auditor could read. Then do the slower, more important work: walk it through Legal, IT, and Security, and put the first assessment on the calendar.

That is what owning governance actually looks like for a People team. Not a hundred-page framework, but three clear artifacts and the discipline to keep them alive. The People leaders who win this moment are the ones who stop waiting for someone else to own AI in people decisions and credibly own it themselves, with a human accountable for every call.

Part of TLY's AI Workflows → workflow playbooks for senior professionals.

Own the policy, build the system

Drafting a governance one-pager is the easy part once you have the structure. The harder skill is building a program that actually holds: finding the shadow uses, getting cross-functional buy-in, running the assessments on schedule, and keeping the records that survive an audit. That is what we teach: a practical system for putting AI to work across HR and governing it credibly, without ever handing the accountability to a machine.

Go deeper with The Leveraged HR Professional course Join The Leverage Club for $49 and get the RACI, assessment template, and governance one-pager prompts Not sure where to start? Take the 2-minute course finder

Sources: TLY hands-on use of AI to draft structured governance documents from a use inventory (June 2026); impact-assessment cadence informed by annual-assessment requirements appearing in state AI employment laws, referenced rather than restated as legal advice. Requirements vary by jurisdiction and change quickly; verify legal references against current guidance and counsel before relying on this page.