What Does HR Have to Build in 90 Days After an AI-First Mandate?

What has to exist by day 90?

Three artifacts, and none of them is a training program. An inventory of every place AI already touches an employment decision. A notice and a retained record for each of those places a statute reaches. And one named person with the authority to switch a use off. Everything else on the mandate's implied list is a choice about pace, not a legal deadline.

The inventory is the piece most companies skip, and it is the one every later question depends on. It is a table rather than a document, and five columns are enough:

• The use, not the tool. "Screening applications for the analyst req" is a use. "Copilot" is not.
• Who runs it, by name, including the hiring manager quietly pasting resumes into a chat window.
• What it produces: a shortlist, a summary, a draft, a number.
• Whether a human decides afterward, and what that human actually sees before deciding.
• Where the affected people are, because the rules attach to their location as well as to yours.

Run the inventory as a survey of managers, not as an IT asset scan. The uses that create exposure are usually unbudgeted: a recruiter's personal subscription, a spreadsheet formula calling a model, a summarizer inside a video interview product nobody classified as a hiring tool.

The NIST AI Risk Management Framework is a usable skeleton for those columns, and NIST states that it is intended for voluntary use ⁴. Bring it to your CEO as the structure you chose, never as the thing the law demanded. Training sits in the same category: worth doing, and not the same thing as checking people can do the work afterward.

Which AI uses does a law already reach?

The ones that touch recruitment, hiring, promotion, discipline, discharge or the terms of employment. Illinois amended its Human Rights Act to cover exactly that list, effective January 1, 2026, and added a duty to notify employees when an employer uses AI for those purposes ¹. New York City requires a bias audit within one year of use, a published summary of the results, and notice before use ².

Two details in the Illinois text are worth reading in the original. It reaches generative AI, not only scoring models. And it bans using zip codes as a proxy for a protected class, which is an instruction to look at your inputs rather than at your intentions ¹.

At the federal level the older machinery still applies. The Uniform Guidelines ask a user of a selection procedure to keep records of impact by race, sex and ethnic group, and treat a selection rate below four-fifths of the highest group's rate as evidence of adverse impact ³. None of that changed because a model produced the shortlist.

The trigger is the use, not the purchase. A manager who pastes forty resumes into a chat window and asks which five to call has run a selection procedure. No contract, no vendor, no audit trail. That is the hardest case to close inside 90 days, because auditing a vendor's tool at least gives you a vendor to ask.

Olive's compliance page names the regimes above and the checks Olive has not performed yet. See how Olive measures this.

Why your 90-day list is not another company's

Because the control follows the use and the jurisdiction, not the memo. A company that already validates models for a regulator adds employment uses to a register that exists, and the 90-day job is a few rows and an owner. A company with no such register is building one, and that is most of the ninety days. Hiring in Illinois and New York City adds two dated duties ¹²; hiring where neither applies leaves federal records expectations ³ and no notice clock.

The practical split is between companies where an employment tool lands inside an existing control process and companies where it lands nowhere. One question tells you which you are: if a model informed a decision about a person last quarter, who could produce the record of it today, and how long would that take? A name and a week means you are adding rows. A shrug means the inventory is the whole project.

Sector matters in a second way. Where AI sits close to the revenue work (engineering, analysis, underwriting, claims), the mandate carries a real question about which roles change and which do not, and that question is separable from the compliance work. In a function where AI mostly drafts copy, the compliance work is small and the interesting problem is quality.

What can wait, and what to push back on

Literacy curricula, a competency framework, headcount modeling and tool consolidation can all wait past day 90, because nothing outside the company is counting them. Push back on three items a mandate hands HR by default: buying and securing tools, judging whether a model is good enough for a given workflow, and setting headcount targets. Those belong to IT and security, to the function using the model, and to finance.

The pushback lands better with the reason attached than as a refusal. HR owns the employment decision and the record of it. HR does not own model performance and cannot own it. The person who can tell whether a summarizer dropped the wrong clause is the one who reads those clauses for a living.

Two items sit on the line and are worth negotiating rather than declining. Hiring for AI skills or training the team you already have is a genuine HR call, and it turns on evidence about the current team that nobody has collected yet. Headcount planning against an assumed productivity gain is a finance model, and HR should read it before it becomes a hiring freeze, because the freeze arrives as an HR announcement whatever its origin.

One item is worth adding rather than deferring: a written rule for what a manager may say to a candidate about a decision AI touched. It costs an afternoon, and it is the first thing anyone asks for when a rejected candidate wants to know why.

Write the 90 days as three dated blocks

Days 1 to 15: the inventory, with one owner's name against each row. Days 16 to 45: notice text, the retained record for each in-scope use, and legal sign-off on both. Days 46 to 90: the first bias audit or adverse-impact check where one is owed ²³, and a written rule for what a manager may do with an AI-produced judgment about a person.

Dating the blocks is not project theater. It converts a mandate into something that can be reported against, and it keeps the genuinely optional parts of the list from being pulled forward by enthusiasm. A CEO who asked for AI-first in 90 days will take "notice text is done, the audit is booked for day 70" over a status update with no dates in it.

Write the result as one page, not a binder. An AI hiring policy needs three paragraphs (what candidates may use, what you evaluate with, what you keep), and a one-page document gets legal review while a twenty-page one waits.

Then keep the inventory alive. Add a row when a use starts, put the next review on a date rather than on someone remembering, and treat any use a manager started without telling you as the normal case rather than the exception.

Read the evidence >