Real pages from the kit files. Example tools and details are illustrative.
AI in HR Policy and Risk Checklist
Put one written policy behind every AI tool that touches hiring or HR, and a risk check in front of it. Inventory the tools you use, score each one Low, Medium, or High from five plain questions, adopt a policy your team can follow, and keep the notices, testing, and reviews on a tracker, with the kit marking where to bring in counsel.
One-time purchase, no subscription. Instant download.
Built by expert HR practitioners and leaders
- A Field Guide to AI in HR: where AI shows up across hiring and HR, the five risks that create liability, the federal spine and the four-fifths rule, the state, local, and EU layer, and the six governance moves a small team can run
- An adoptable AI policy: a seven-section policy in Word with fill-in fields and owner notes, covering allowed and not-allowed uses, human review of consequential decisions, notice, bias testing, data, records, and vendors
- A scored risk check for every tool: five plain factors, decision stakes, human control, data used, jurisdiction, and vendor testing, give each tool a score out of ten and a level of Low, Medium, or High, before you approve it and again when it changes
- A register and a governance tracker: one list of every AI tool in use with an owner, a status, and a risk level, and a tracker for the notices, bias testing, audits, and reviews that recur, ten standing actions included
- Vendor due diligence and a decision record: the questionnaire to send before you sign, covering the data, the bias testing, the audit, and the overrides, and a one-page record of who approved each tool and why
The kit structures the inventory, the scoring, and the record. It does not approve a tool for you, and it routes the legal calls to qualified counsel.
A policy, checklists, and a risk workbook, and general business information, not legal or tax advice. The rules for AI in hiring and HR are new, vary by state and city, and change quickly, so confirm the current requirements everywhere your people work, and bring in qualified counsel before an AI tool factors into a hire, pay, discipline, or a termination, or where a specific AI law reaches you.
Not the right fit? Take the 60-second match.
Last reviewed June 2026
Buying for clients or multiple entities? The White-Label tier is in the license.
Four files that put a policy behind your AI tools and a check in front of them
Read the Field Guide first for the lay of the land. Adopt the policy so the rules are written down, list your tools on the register, score each one through the risk check, and keep the recurring work on the tracker. Built to be used together.
Start Here
A one-page map that sets the order: read the Field Guide, adopt the policy, list your tools on the register, score each one, track the recurring work, and confirm the rules everywhere you hire. It also carries the habit behind the kit, treat each tool the way you would treat a new manager.
The Field Guide (14 pages)
The plain-language map in twelve sections: you own what the tool decides, what counts as AI in HR and everywhere it shows up, the five risks, the federal spine and the four-fifths rule, the state and local layer, the EU AI Act and who it reaches, six governance moves, the risk check, vendor due diligence, notice and human oversight, and the review cadence and when to get help.
The Policy and Checklists
A seven-section policy written to be adopted, with shaded fill-in fields and owner notes, covering principles, allowed and approval-first and not-allowed uses, human review, notice, testing and audits, data and records, and vendors. Plus three working checklists: a per-tool AI risk assessment, a vendor AI due diligence questionnaire, and an AI decision record.
The AI Risk Workbook
The working system: an AI Tool Register for every tool in use, a Risk Assessment that scores each one from five factors, a Governance Tracker with ten standing actions for the notices, testing, audits, and reviews, and a plain-language Definitions tab. It works in Excel or Google Sheets, with a worked example through the tools.
The method in the order the system runs
Name the tools, score the risk, write the policy down, vet the vendors, and keep it alive on a cadence. The kit structures each step; you make the calls, and counsel covers the close ones.
Read the landscape, then name every tool
Read the Field Guide once for the lay of the land: the risks, the federal spine, and the state, local, and EU layer. Then list every AI tool that touches an HR decision on the register, including the AI features quietly added to tools you already had. You cannot govern what you have not named, and a tool that is not on the list has not been vetted.
Score each tool from five plain questions
Run each tool through the Risk Assessment: the stakes of the decision it touches, how much a person is really in control, the data it uses, whether your people sit in a regulated location, and what the vendor can show for its testing. Each factor adds zero, one, or two points toward a score out of ten and a level of Low, Medium, or High, and a tool that decides alone with no override is High no matter what else.
Adopt the policy and name an owner
Open the Word file, fill in the shaded fields, and act on the owner notes. Set the uses that are allowed with normal review, the ones that need written approval first, and the ones that are not allowed, and name a real person to own the policy and the tool list. Have it reviewed before you adopt it, then put the version and date on the record.
Vet the vendor and keep the record
Send the due diligence questionnaire before you sign: what the tool does, the data it uses and keeps, how it was tested for bias, whether you can get a current audit, and whether a person can override it. A claim in a brochure is not an audit, so ask for the actual evidence and file the answers with the tool entry, and record each approval on the decision record.
Give notice, keep a person on the call, and review on a cadence
Tell candidates and staff when an AI tool is part of a decision, where a law requires it and as a fair default everywhere, and be ready to offer an alternative or a human review. Keep meaningful review on every consequential decision, a named person with a real way to say no. Then re-run the check at least once a year, whenever a tool changes, and on the tracker, confirm the rules for every place you hire.
Every tool named, scored, and on the record
AI in HR goes wrong in patterns: a tool nobody listed, a review that rubber-stamps, no notice, a vendor claim taken on faith, and rules assumed to sit still. The fix is a small system, an inventory, a repeatable risk check, a written policy, notice, and a review date, and this kit gives you all of it, with the moments to stop and get qualified help marked.
The kit tells you when to call a lawyer
Most AI tools can be governed in-house with the register, the risk check, and the policy. Some moments sit near a legal line, and the kit marks them, so you get qualified input before a tool affects a real decision. Advice before you act is far cheaper than defending an outcome after.
Who does what
Governing AI in HR splits the work between you, the kit, and your counsel. Here is the split, stated plainly.
- The kit structures the system; you run it. The register, the risk check, the policy, and the tracker organize the work and keep it consistent. Naming the owner, filling the register, and keeping the cadence are yours to do.
- The workbook scores the risk; you make the call. Five factors give each tool a score and a level. A High result is a prompt to pause and dig in, and a Low result is routine use with normal records, never a clearance to stop watching.
- The kit flags the legal lines; counsel rules on them. An AI tool near a hire, pay, discipline, or an exit, a possible disparate impact, or a specific law that reaches you is a signal to get qualified input. The kit tells you when a matter needs a lawyer; counsel tells you what to do about it.
- The kit gives you the jurisdiction starting point; counsel confirms your locations. The Field Guide maps the federal spine and the most active state, local, and EU rules as of its review date, and they are moving. Current requirements for every place you hire are confirmed with qualified counsel before you rely on them.
- The kit keeps the record, and the record is the point. A named register, a scored check, a written policy, vendor answers on file, and a decision record for each approval are what a defensible AI program looks like on paper.
Who it is built for
Who this kit fits, and where to go if that is not you.
Built for
- An HR generalist, manager, or business owner whose applicant tracker, scheduler, or review tool quietly added AI features, and who wants a policy behind those tools and a check in front of them before something goes wrong.
- An HR team of one, or a small HR function, that needs one consistent way to vet, approve, and track every AI tool across hiring and HR, instead of deciding each one from scratch.
- An operations or people leader who has to answer for how AI is used on candidates and staff, and wants the register, the scores, and the approvals on a record someone can defend.
If you are looking for
- A formal bias audit of your hiring tools, with a selection-rate log built on the four-fifths rule and ready candidate notices. The AI Hiring and HR Governance Kit drills into that audit; this kit sets the policy and the risk check across all of HR.
- EU-specific obligations under the AI Act, because you operate in the EU or use AI on people there. The EU HR AI Risk Checklist is built for that path.
- The broader compliance calendar, deadlines, postings, and document audits beyond AI. The HR Compliance Calendar and Document Audit Kit covers that ground.
Before you buy
What format are the files and can I edit them?
Is this legal advice?
We only use one or two AI features inside tools we already had. Is this overkill?
How is this different from a free AI policy template?
Does it cover the laws in my state?
What is the refund policy?
What happens after I buy?
Can I expense this purchase to my business?
Most customers buy TrueStep HR tools for business use, and a tool you use for work often qualifies as a deductible business expense. Whether it does for you depends on your situation, so confirm with your accountant or tax professional. Your receipt arrives by email at checkout and works as documentation.
The 6 red flags to check before you discipline or fire someone
A five-minute screen that catches the most common and most expensive people-decision mistakes before they happen. Free PDF, sent to your inbox. Unsubscribe anytime.
Put a policy behind your AI tools and a check in front of them
Name every tool, score the risk, adopt the policy, vet the vendors, and keep the notices and reviews on a tracker, in files you keep, with the kit telling you when to bring in counsel.
A policy, checklists, and a risk workbook, not legal or tax advice. Last reviewed June 2026.