Requirements · AI risk and governance

Requirements for using AI in decisions about people

Last updated 25 October 2026 · 2 sources listed · Reading time about 3 minutes

Short answer

Tools that influence decisions about people face the strictest expectations. Typical requirements include a defined lawful purpose, documented impact assessment, testing for discriminatory effects, transparency to affected people, meaningful human oversight with authority to override, routes to contest outcomes, record keeping, and vendor evidence. Laws differ by jurisdiction, so obtain legal advice and consult regulator guidance before use.

Who this is for: An HR, compliance or product leader considering AI tools that screen candidates, assess employees or influence eligibility decisions.

What to evaluate

Lawful purpose and basis
Processing personal data about people requires a justified purpose under applicable law.
How to check: Document purpose and legal basis with privacy counsel and avoid uses beyond that purpose.
Impact assessment
Structured assessment surfaces risks before deployment.
How to check: Complete and record an assessment covering affected groups, data, errors and mitigations.
Bias and accuracy testing
Systems can disadvantage groups through proxies in the data.
How to check: Test outcomes across relevant groups using appropriate data and legal guidance, and repeat on a schedule.
Transparency to individuals
People often have rights to know when automated tools are used and how decisions are made.
How to check: Prepare plain notices and confirm requirements in your jurisdiction.
Meaningful human oversight
A rubber-stamp review is not oversight.
How to check: Ensure reviewers have time, information and authority to disagree, and measure override rates.
Contestability and records
People need a way to challenge outcomes and you need evidence of how decisions were made.
How to check: Provide an appeal route and retain records within privacy limits.
Vendor evidence
Vendors' claims about fairness need substantiation.
How to check: Request validation studies, documentation of data and contractual commitments, and test them independently.

Comparison

Uses and typical oversight expectations
Use	Sensitivity	Typical expectation
Scheduling interviews	Low	Standard privacy practice
Summarising applications for a human reviewer	Moderate	Transparency, review of summaries for omissions, testing
Ranking or rejecting candidates	High	Impact assessment, bias testing, human authority, notices, legal review
Monitoring or scoring employee performance	High	Proportionality assessment, consultation where required, contest route
Eligibility decisions for services or credit	High	Sector regulation, explanation duties, appeal rights

Decision worksheet

Rate up to three options against this guide’s own criteria. It runs in your browser and saves only on this device. It is a thinking aid, not a recommendation.

1. Have you checked each criterion?

Lawful purpose and basis — Document purpose and legal basis with privacy counsel and avoid uses beyond that purpose.
Impact assessment — Complete and record an assessment covering affected groups, data, errors and mitigations.
Bias and accuracy testing — Test outcomes across relevant groups using appropriate data and legal guidance, and repeat on a schedule.
Transparency to individuals — Prepare plain notices and confirm requirements in your jurisdiction.
Meaningful human oversight — Ensure reviewers have time, information and authority to disagree, and measure override rates.
Contestability and records — Provide an appeal route and retain records within privacy limits.
Vendor evidence — Request validation studies, documentation of data and contractual commitments, and test them independently.

0 of 7 criteria checked.

2. Compare options (0 = fails or unknown, 3 = meets it well)

Criterion	Option 1 name	Option 2 name	Option 3 name
Lawful purpose and basis	Lawful purpose and basis score for Option A	Lawful purpose and basis score for Option B	Lawful purpose and basis score for Option C
Impact assessment	Impact assessment score for Option A	Impact assessment score for Option B	Impact assessment score for Option C
Bias and accuracy testing	Bias and accuracy testing score for Option A	Bias and accuracy testing score for Option B	Bias and accuracy testing score for Option C
Transparency to individuals	Transparency to individuals score for Option A	Transparency to individuals score for Option B	Transparency to individuals score for Option C
Meaningful human oversight	Meaningful human oversight score for Option A	Meaningful human oversight score for Option B	Meaningful human oversight score for Option C
Contestability and records	Contestability and records score for Option A	Contestability and records score for Option B	Contestability and records score for Option C
Vendor evidence	Vendor evidence score for Option A	Vendor evidence score for Option B	Vendor evidence score for Option C
Total (max 21)	0	0	0

Questions to ask before you commit

Which laws and regulators govern this use in each place we operate?
What is our documented purpose and legal basis?
Has an impact assessment been completed and by whom?
How will we test for discriminatory effects and how often?
What will we tell affected individuals and when?
Who reviews outputs, with what authority and information?
How can a person contest an outcome and who handles it?
What evidence does the vendor provide and what do our tests show?

Typical trade-offs

Using AI only to assist reviewers versus automating screening

Upside: Keeps human judgement central and reduces legal exposure.
Downside: Less efficiency gain.

Fairness testing with demographic data versus not collecting it

Upside: Enables detection of disparities.
Downside: Collecting such data raises privacy and legal questions; seek advice.

Building in-house versus buying a vendor tool

Upside: Control over data and logic.
Downside: Requires skills; vendors carry some assurance burden but you remain accountable.

Common mistakes

Treating vendor fairness claims as proof. Validate on your own population.
Allowing reviewers to approve at speed with no real power to disagree.
Failing to tell candidates or employees about automated tools where required.
Reusing a tool for a purpose it was not assessed for.

Sources and further reading

These pages were reachable when we last checked. They informed definitions and rules referred to above; they do not endorse this guide. Where rules differ by country, check the authority for your location.

U.S. Equal Employment Opportunity Commission — EEOC, retrieved 27 October 2026
EU Artificial Intelligence Act — Future of Life Institute, retrieved 27 October 2026

How to choose · AI risk and governance

How to assess an AI vendor during due diligence

Assess an AI vendor on data handling, security assurance, model and subprocessor transparency, contractual protections, testing and monitoring support, and operational resilience. Request evidence rather than assertions: independent attestations, data flow diagrams, retention terms and incident commitments. Tailor depth to the risk of the use case, and revisit when features or subprocessors change.

Comparison · AI risk and governance

Comparing AI governance frameworks: risk framework, management standard and regulation

These instruments do different jobs. A risk management framework offers guidance on identifying and managing risk; a management system standard describes the organisational processes that can be audited and certified; regulation creates legal duties with penalties and applies by jurisdiction. Most organisations use a framework to design practice, a standard to structure it and legal advice to meet obligations.

Problems & fixes · AI risk and governance

Shadow AI: staff using unapproved tools and what to do about it

Shadow AI arises when approved options are slow, limited or unknown. Prohibition alone seldom works. Combine discovery, a clear policy with examples, an approved alternative that meets real needs, a quick exception route, technical guardrails on sensitive data and training that explains reasons. Treat discovery as information about unmet needs rather than only a disciplinary matter.

Requirements · AI for data and analytics

Data readiness requirements before adopting AI analytics

Readiness means data that is findable, documented, access-controlled, reasonably clean and owned. Before adopting AI tools, inventory sources, classify sensitivity, fix permissions, define key metrics, document tables, set quality checks and agree ownership. Skipping these steps turns every AI feature into a faster way to surface existing mess.

Requirements · Enterprise AI tools

What an enterprise AI deployment needs in place before launch

Minimum conditions include an approved-use policy, a register of tools and use cases with owners, risk tiering, data classification rules, vendor due diligence, access and logging controls, human review expectations for consequential outputs, training, and an incident process. Legal duties differ by jurisdiction and sector, so confirm applicable rules with counsel and regulators.

Requirements · B2B software

Consent and legal requirements for email marketing

Rules differ by jurisdiction. Some regimes, such as the EU and UK, generally require prior consent for marketing to individuals, while others, such as the United States federal law, allow sending if you honour opt-outs, identify yourself and include a physical address. Always keep consent records, include a working unsubscribe, and check the regulator in each place you market. This is general information, not legal advice.

Problems & fixes · AI assistants

What happens to the data you type into an AI assistant

Content you enter may be stored, reviewed by staff, used to improve models or surfaced through sharing features, depending on the product and plan. The risk is rarely a dramatic breach; it is ordinary retention and unintended disclosure. Learn the retention, training and sharing rules for your exact plan, and keep regulated, confidential and credential data out unless the agreement permits it.

All AI risk and governance guides · All Artificial intelligence