Policy required document Information security
Artificial Intelligence Use Policy
An AI use policy says which AI tools employees may use, for what, with what data, and how the company uses automated tools in decisions about people. It is two policies in one document because the two risks arrived together.
The first is data: staff pasting customer records, source code or the draft acquisition memo into a public chatbot, which is a confidentiality breach, sometimes a privacy law breach, and in the case of a trade secret, arguably a failure of the reasonable efforts that keep it one.
The second is decisions: hiring, promotion and monitoring tools that screen people, which the discrimination laws already reach and which specific statutes now regulate.
New York City's Local Law 144 prohibits using an automated employment decision tool unless it has had a bias audit within the past year, a summary of the audit is public, and candidates are notified in advance; enforcement began July 5, 2023.
Colorado's Artificial Intelligence Act requires deployers of high-risk systems in employment decisions to use reasonable care against algorithmic discrimination, with a risk management program, impact assessments, notice to the person, and an explanation and appeal on an adverse decision, from June 30, 2026 after a 2025 delay.
Illinois amended its Human Rights Act, effective January 1, 2026, to make discriminatory use of AI in employment decisions a civil rights violation and to require notice to employees when AI is used.
No federal statute names the document. The EEOC's position is that Title VII, the ADA and the ADEA apply to a tool's decisions exactly as they apply to a manager's, so the employer owns the disparate impact.
The policy is where the company lists the tools it uses on people, the audit and notice each one carries, and the human who reviews the output, and where it tells staff which tools are approved for company data and which are not. The claim volume today is low; the statutes above take effect within the year, and the policy is a page.
Obligation ledger
Who requires it, and what each one says.
| Source | Applies when | What it requires | Status |
|---|---|---|---|
| New York City Local Law 144 of 2021, automated employment decision tools NYC Admin. Code 20-870 to 20-874; 6 RCNY 5-300 | Employers and employment agencies using an automated employment decision tool for candidates or employees in New York City | No use of the tool unless it has had an independent bias audit within one year, a summary of the results is publicly available, and candidates and employees are notified at least ten business days before use, with the job qualifications the tool assesses and a way to request an alternative process. Enforced by the Department of Consumer and Worker Protection since July 5, 2023, with civil penalties per violation per day. Legally required. | Mandatory |
| Colorado Artificial Intelligence Act, as amended SB 24-205, effective date extended by SB 25B-004 to June 30, 2026 | Deployers of high-risk artificial intelligence systems that make or substantially factor into consequential decisions, including employment decisions, in Colorado | Reasonable care to protect against algorithmic discrimination, with a rebuttable presumption for deployers that implement a risk management program, complete impact assessments, notify the person that a high-risk system is used, and on an adverse decision provide the reasons, an opportunity to correct data, and an opportunity to appeal to human review; a public statement of the systems used; notice to the Attorney General of discovered discrimination. Legally required from June 30, 2026. | Mandatory |
| Illinois Human Rights Act, artificial intelligence in employment 775 ILCS 5/2-102(L), added by Public Act 103-0804, effective January 1, 2026 | Every Illinois employer | A civil rights violation to use artificial intelligence that has the effect of subjecting employees to discrimination on a protected basis in recruitment, hiring, promotion, discipline, discharge or other terms of employment, or to use zip codes as a proxy for protected classes; employers must notify employees when AI is used for those purposes. Legally required. | Mandatory |
| Title VII, disparate impact 42 U.S.C. 2000e-2(k) | Employers with 15 or more employees | An employment practice that causes a disparate impact on a protected basis is unlawful unless job related and consistent with business necessity; the EEOC has stated that this applies to selection procedures run by algorithmic tools, and that the employer is responsible for a vendor's tool. Legally required. | Mandatory |
Required sections
- Approved tools: which AI services staff may use for work, under which accounts, and the rule that company data goes only into tools the company has contracted with
- Prohibited inputs: customer personal data, health data, confidential and trade secret information, source code, credentials, and anything under legal hold, into any tool not approved for it
- Output rules: that AI output is checked by a person before it is relied on, sent to a customer, or used in a decision, and that the person remains responsible
- Disclosure: when the company tells customers or the public that content is AI-generated, and any contractual or regulatory disclosure duty
- Automated tools in decisions about people: the inventory of tools used in hiring, promotion, pay, monitoring and discipline; the bias audit and its public summary where required; the candidate notice and alternative process; human review of every adverse decision
- The state and city schedule: New York City, Colorado, Illinois, and others as they take effect
- Records: prompts and outputs where a regulation or a contract requires them; audit reports; notices given
- Security: account controls, data retention settings in the tools, and vendor terms that prohibit training on company data
- Reporting a concern about a tool's output or a data leak, and no retaliation
- Review cycle and the owner of the tool inventory
What the examiner asks for
What changed
Change log.
Frameworks
Where this document is required.
Need a hand implementing it?
Find a Consultant for Artificial Intelligence Use Policy
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Manage This Document in AllyMatter
Route it for approval, keep every version, and record a named acknowledgment from everyone who has to read it.
Questions
What people ask.
We only use a resume screening feature built into our applicant tracking system. Does that count?
If it scores, ranks or screens candidates and substantially assists the decision, it is an automated employment decision tool under Local Law 144 and a high-risk system under Colorado's Act, whoever built it. The vendor's assurance is not your audit; the law puts the duty on the employer using the tool.
What is the single most important rule for staff?
Do not put anything into a public AI tool that you could not post on the internet. Customer data, code, contracts and internal plans go only into tools the company has contracted with under terms that prohibit training on the data. That one sentence prevents most of the incidents.
Do we need a bias audit if we are not in New York City?
Not by that name, but Title VII disparate impact applies everywhere, and Colorado requires impact assessments from June 30, 2026. Testing a selection tool for adverse impact before and during use is the same exercise, and the documented result is the defense.
Who owns this policy?
Two owners: IT or security for the tool list and data rules, and HR or legal for the decision tools. The inventory of tools used on people is the part most companies do not have, and it is the part the statutes ask about first.
Sources
NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools (Local Law 144)Colorado General Assembly, SB 25B-004, extending the effective date of SB 24-205 to June 30, 2026Colorado General Assembly, SB 24-205, consumer protections for artificial intelligenceIllinois Public Act 103-0804, amending the Human Rights Act (Illinois General Assembly)42 U.S.C. 2000e-2, Title VII unlawful employment practices, disparate impact (Cornell LII)