HR AI Policy Template for Australian Businesses

HR AI POLICY

Organisation name: [Your business name]
ABN: [Your ABN]
Policy owner: [Name and role]
Effective date: [Date]
Last reviewed: [Date]
Next review due: [Date, suggest annually or when a new AI tool is adopted]

Section 1: Purpose and scope

This policy governs the use of artificial intelligence (AI) tools in all human resources functions at [Business name], including but not limited to recruitment, candidate screening, performance management, workforce planning, and employee communications. This policy applies to all staff who have HR responsibilities, including managers who make or assist in hiring and performance decisions.

This policy does not replace the general AI Staff Policy [link to or reference your T-01 staff policy]. Both policies apply to HR staff. Where this policy is more specific, this policy governs.

Section 2: Approved AI tools for HR use

The following AI tools are approved for HR use. No AI tool may be used for HR functions unless it appears in this list or has been approved in writing by [policy owner].

Section 3: Prohibited uses

The following uses of AI tools in HR are prohibited without written approval from [policy owner] and legal review:

• Using AI as the sole basis for rejecting a job application without human review of the AI output
• Using AI to assess candidates on subjective traits (personality, culture fit, communication style) without human review and documentation
• Entering health information, disability status, pregnancy status, or other sensitive personal information into any AI tool that is not on the approved list
• Using AI outputs from tools not on the approved list in any hiring or performance decision
• Using AI-generated performance assessments as the sole basis for a formal performance improvement plan or termination without documented human review
• Monitoring employee activity or productivity using AI tools without meeting the notification requirements of the applicable state or territory workplace surveillance law

Section 4: Candidate data handling

4.1 Collection notice. Every job listing must include a privacy notice that tells candidates what personal information is collected, how it will be used (including any AI processing), where it will be stored (including overseas storage), how long it will be retained, and how they can access or correct their information.

4.2 Cross-border disclosure. Candidate data sent to or processed by an overseas AI vendor may constitute a cross-border disclosure under APP 8 of the Privacy Act. Before using any AI recruitment tool with overseas data storage, confirm the vendor meets equivalent privacy standards and document that confirmation.

4.3 Data minimisation. Collect only the information necessary for assessing the candidate's suitability for the role. Do not enter candidate personal information into general-purpose AI tools (such as ChatGPT or Claude) unless that tool is on the approved list and the use is documented.

4.4 Retention and deletion. Candidate data must be retained for [your chosen retention period, e.g., 7 years] from the date of the hiring decision and then deleted from all AI tools and internal systems. Confirm that AI tool vendors delete data upon contract termination or request.

Section 5: Automated decision-making and human oversight

5.1 What counts as automated decision-making. AI-assisted decisions that significantly affect a candidate or employee's rights or interests are automated decisions under Privacy Act APP 1 obligations taking effect December 2026. This includes: AI shortlisting that results in candidates not proceeding to interview; AI performance scoring used in formal performance management; and AI risk scoring used in decisions about employment continuation.

5.2 Internal human review (recommended practice). This organisation reviews all automated assessments that significantly affect candidates or employees using a qualified human before the decision is acted on, as an internal governance standard. Note: this is a business choice adopted as good practice, not a legal requirement under the Privacy Act. The human reviewer must document their independent assessment, not merely approve the AI output without review.

5.3 Review request pathway (optional, recommended practice). Candidates and employees may request a human review of any automated assessment by contacting [designated contact, e.g., [email protected]]. Requests must be acknowledged within [e.g., 2 business days] and a substantive response provided within [e.g., 10 business days]. Offering this pathway is not required by APP 1.7, which is a transparency (disclosure) obligation only, but many organisations choose to offer it to reduce complaint and discrimination risk.

5.4 Privacy policy disclosure. The organisation's privacy policy must disclose the use of automated decision-making in HR functions, including whether automated decision-making is used, the types of decisions made, and the personal information used. APP 1.7 does not require disclosing a human review pathway, since it does not mandate one, but if this organisation offers one as internal policy, it may choose to mention it. The privacy policy must be updated before December 2026 and reviewed whenever a new AI HR tool is adopted.

Section 6: Performance management AI

6.1 Approved uses. AI tools may be used to assist in drafting performance review questions, summarising performance data, or identifying patterns in team-level productivity data for manager review. These are advisory uses. The output informs a manager's assessment but does not determine it.

6.2 Prohibited uses. AI tools must not be used to generate or deliver a final performance rating, a formal performance improvement plan, or a recommendation for termination without documented human review and manager sign-off.

6.3 Employee notification. If AI tools are used to monitor employee productivity or activity (including AI-assisted time tracking, output scoring, or communication monitoring), employees must be notified in accordance with the surveillance laws of their state or territory before monitoring begins. This notification must be documented.

Section 7: Anti-discrimination safeguards

AI hiring tools can produce discriminatory outputs if trained on biased data. To manage this risk:

• Before deploying any new AI recruitment tool, review the vendor's documentation on training data sources and any bias audits conducted
• After each hiring round using AI screening, review the demographics of the shortlisted group and compare against the full applicant pool. Document this review
• If you identify a demographic pattern in AI outputs, do not continue using the tool until the cause is investigated and addressed
• Ensure at least one human reviewer assesses AI-generated shortlists before candidates are rejected
• Record the basis for each hiring decision, including the AI tool used and the human review conducted

Section 8: Training requirements

Before using any AI tool for HR functions, staff must complete training covering: the purpose and limitations of the AI tool, the Privacy Act obligations relevant to that tool, the anti-discrimination safeguards in this policy, and the human review requirements for automated assessments. Training must be documented in the HR system. New HR staff must complete this training within [e.g., 30 days] of commencing in their role.

Section 9: Compliance monitoring

The policy owner is responsible for reviewing compliance with this policy. Reviews will occur annually and whenever a new AI tool is added to the approved list. Non-compliance with this policy must be reported to [policy owner] and may result in disciplinary action. Any suspected breach of candidate or employee personal information must be reported immediately and handled in accordance with the organisation's data breach response plan.

Policy acknowledgement: I have read, understood, and agree to comply with this policy.
Name: _______________ Role: _______________ Signature: _______________ Date: _______________