Quick Hits

• As organizations increasingly integrate generative AI tools into daily operations, particularly in HR, AI audits are increasingly important for mitigating legal, operational, and reputational risks.
• Forming a cross-functional audit team and mapping out AI tools in use are key initial steps in conducting comprehensive AI audits to ensure responsible and compliant AI usage.
• Regular AI audits, including bias assessments and vendor contract reviews, help organizations stay compliant with evolving regulations and maintain transparency and data security in their AI initiatives.

Organizations may want to consider comprehensive AI audits at least annually if not quarterly, with targeted reviews triggered by new AI tool implementations, regulatory changes, or identified compliance issues. In general, organizations will want to observe a few common steps with respect to AI audits.

1. Identifying a Cross-Functional Audit Team

Beginning by forming a cross-functional audit team composed of representatives from compliance, human resources, information technology, legal, and any other department with a significant stake in AI usage allows diverse voices to participate in the audit and reduces the possibility of blind spots or conflicting directives among different departments. Typically, in-house counsel, the head of compliance, or an HR executive spearheads the audit, although the most suitable leader may vary according to the company’s size, industry, and existing AI initiatives. And, depending on the circumstances, privilege considerations may warrant the engagement of outside counsel to lead the audit. The company may wish to conduct the audit with outside counsel under privilege.

2. Conducting AI Use Mapping

Once the audit team is formed, employers may want to map out the AI tools and providers in use throughout the organization. The preparation of this type of inventory should closely mirror the data mapping process completed in connection with the organization’s data privacy program, and not only captures chatbot-style tools or automated decision-making software, but also includes data analytics platforms or software that relies on machine learning in HR contexts. Examples of potentially in-scope AI tools range from automated job screening platforms and candidate matching systems to tools designed for employee engagement surveys, performance assessments, and talent development. Organizations can work with their AI governance leaders to establish a reliable procedure to update this inventory whenever new AI tools are introduced so the AI map remains current and responsive.

3. Identifying the Laws and Regulations Relevant to the Audit

In the absence of a single comprehensive national AI law in the United States, organizations may want to stay abreast of a rapidly evolving patchwork of federal, state, local, and international regulations. Some U.S. states have already implemented AI-related legal frameworks, including provisions drawn from the European Union’s Artificial Intelligence (AI) Act’s focus on high-risk AI systems and the mitigation of algorithmic discrimination. For example, New York City’s Local Law 144 requires bias audits for automated employment decision tools, while Illinois’s House Bill 3773 mandates specific disclosure requirements for AI use in hiring. Others, like Texas, are developing AI laws that are unique to the state and focus on governing a limited set of uses of AI tools while taking steps to encourage the responsible development of AI technologies. And still more states, like Connecticut, are amending their consumer privacy laws to govern AI. While the landscape is complex and ever-shifting, monitoring these varied legal developments so that businesses understand the regulatory frameworks for assessing their use of AI tools, and for which they may want to subsequently adjust their AI processes, is an important compliance step.

Before diving into detailed compliance analysis, businesses may choose to categorize AI tools by risk level based on their potential impact on employment decisions, data sensitivity, and regulatory exposure. High-risk tools—such as those used for hiring, performance evaluation, or disciplinary actions—typically warrant immediate and thorough review. Medium-risk tools like employee engagement platforms may require standard assessment, while lower-risk tools such as basic scheduling assistants may warrant lighter review. However, risk levels are not necessarily topic-specific; the level of cybersecurity risk may depend upon the type of information being processed (i.e., the level of sensitivity) rather than the purpose. For example, a scheduling tool that processes highly sensitive personal information or confidential business data may warrant higher-priority review than an employee engagement platform that handles only aggregate, anonymized data. This prioritization helps allocate audit resources effectively and ensures critical compliance areas receive appropriate attention.

4. Assessing Potential Bias

Even when AI tools are used with the best of intentions, bias can emerge from historical data imbalances, flawed training methods, or other underlying design issues. After completing an AI use inventory, identifying the legal and regulatory requirements applicable to the organization’s use of AI technologies, and assessing compliance with the same, organizations may want to have a qualified reviewer or team of reviewers conduct a detailed bias assessment of each AI tool. Methods to detect and mitigate bias involve both technical reviews and interviews with key stakeholders, and typically include an evaluation of how representative the underlying training data sets are, how the tool’s performance may differ across demographic groups, and whether there is any unintentional adverse impact on protected groups. Whenever possible, organizations may want to use advanced de-biasing techniques, thorough model retraining, and adequate human oversight to correct observed or potential biases.

5. Maintaining Transparency and Proper Documentation

Organizations that utilize internally developed generative AI tools may want to remain mindful of the need for transparency about how AI tools are developed, trained, and implemented. This is vital from both a compliance and policy perspective. In practice, this means documenting the data sources used to train the tools, capturing the parameters of AI models, and recording any interventions made to address bias or improve accuracy. Similarly, if an organization is relying on AI technologies sourced from third-party vendors, its vendor diligence process will likely include obtaining these types of documents from the vendors, which the organization may wish to retain as it would documentation of proprietary AI tools. This internal documentation offers clarity to relevant stakeholders, supports audit activity, and serves as a valuable—and often statutorily required—resource if external regulators inquire into the organization’s AI use.

6. Reviewing Vendor Contracts

Organizations that employ third-party AI solutions may want to carefully examine vendor contracts. Key factors to look for include provisions that address key issues such as liability for bias claims, indemnification in case of regulatory violations, and adherence to privacy and data security standards. Involving in-house counsel or external legal experts in this contract review process often helps ensure that the interests of the company are adequately safeguarded.

7. Updating Internal AI Use and Governance Policies

Organizations may wish to implement or refine an internal AI use policy that applies organizationwide. Such policies typically identify company-approved AI tools, outline acceptable uses, and include cybersecurity and data privacy considerations, compliance obligations, oversight procedures, and ethical guidelines. Likewise, organizations may want to revisit their AI governance policies as part of the audit process, with a focus on clearly delineated ownership of AI governance and oversight at the company, standards for the implementation, monitoring, and security of AI technologies, and clear statements on responsible AI development and harm mitigation. Promoting consistent knowledge of these governance principles contributes to a shared culture of accountability in AI use.

8. Assessing and Implementing AI Use Training

Organizations may wish to confirm that employees who handle or rely upon AI tools are granted role-appropriate training before they engage with these technologies. Training modules might emphasize data ethics, privacy risks and considerations, and responsible use. Individuals more deeply involved in AI processes, such as HR decision-makers or IT developers, may require advanced instruction on bias recognition (such as testing for disparate impact), appropriate use cases and procedures for reporting concerns or errors, and maintaining compliance with applicable laws, such as notice, appeal, and documentation requirements.

9. Ensuring Data Privacy and Security

Given the often-sensitive data processed by AI-driven systems, organizations may want to institute strong data protections at every stage of the AI lifecycle. This includes restricting access to sensitive personal information, encrypting data where appropriate, and preventing the inadvertent disclosure of both proprietary business information and individual personal information. Auditors may also want to confirm that vendors and partners adhere to equivalent or stronger standards in safeguarding the organization’s data.

10. Providing Disclosures and Notifications

Finally, organizations may wish to ensure that relevant stakeholders, whether employees or applicants, receive appropriate disclosures regarding AI usage. When AI plays a material role in screening candidates, making HR decisions, or influencing employment outcomes, disclosing that fact can help build trust and forestall allegations of hidden unfairness. Organizations may also want to confirm, where applicable, that employees are given meaningful information about how automated tools may affect their employment, performance evaluations, or other aspects of their workplace experience, as well as instruction on how they may exercise their data subject rights (if any) with respect to their personal information that is processed using AI.

11. Establishing Ongoing Monitoring and Metrics

Beyond the initial audit, continuous monitoring of processes and outcomes is crucial to track AI performance and compliance. Key performance indicators typically include bias metrics across demographic groups, accuracy rates, user satisfaction scores, and compliance incident reports. Feedback mechanisms for employees to report AI-related concerns, supported by clear procedures for investigating and addressing any issues raised in these reports, can be an important quality control tool.

By following this comprehensive framework for auditing AI tools, organizations can significantly reduce the risk of legal pitfalls, preserve data security and integrity, and enhance confidence in their AI-driven initiatives. With thoughtful preparation and cross-functional collaboration, HR teams and in-house counsel can shape a compliant, fair, and forward-thinking AI environment.