What Belongs in an AI Hiring Policy, and Who Has to Sign Off?

What Are the Eight Sections?

Scope, permitted candidate AI use by job family, the tools you run on candidates, the human decision points, candidate notice, the accommodation path, records and retention, and review and change control. Each one names an owner in the same line it states the rule, because a clause with no owner is a sentence rather than a control. Write them in that order, because the later sections depend on decisions the earlier ones make.

1. Scope. Which requisitions, which states and countries, and which stages of the process the policy reaches. Owner: the talent leader. A policy that says "all hiring" and means "the four engineering reqs where someone piloted a tool" fails at the first question anyone asks it. 2. Permitted candidate AI use, by job family. What a candidate may use, what they must be able to do unaided, and what they have to disclose. Owner: the hiring manager for the family, ratified by the talent leader. 3. What you run on candidates. A dated inventory: each tool, what it produces, which stage it sits in, and whether it substantially assists or replaces a human decision. Owner: talent operations, with security. 4. Where a person decides. For every stage, the named role who makes the call and the record the call rests on. Owner: the hiring manager. This is the section that determines whether most of the automated-decision rules reach you at all. 5. What candidates are told, and when. The notice text, where it is published, and how far ahead of use. Owner: employment counsel. 6. The alternative path. How a candidate requests an accommodation or a different process, who answers, within how long, and the written statement that asking costs them nothing. Owner: HR, with counsel. 7. Records and retention. What is captured, where it lives, who can read it, how long it is kept, and how a legal hold gets triggered. Owner: privacy or security, with counsel. 8. Review and change control. What forces a re-approval, the annual pass over impact figures, and the person who signs the new version. Owner: the accountable executive.

Sections two and four carry the weight. Everything else is procedure that a competent lawyer can draft in an afternoon; those two encode judgments only the people who run the process can make, and they are the two that most templates leave blank.

How Do You Write the Permitted-Use Clause by Job Family?

One rule per job family, written as a sentence about the work rather than about the tool. "Candidates may use AI where the role uses AI" resolves to three different rules for a marketer, a data analyst and an engineer, and a policy that cannot make that distinction is unenforceable in all three, because nobody grading the work knows what they were supposed to be grading.

Every family-level clause answers the same three questions. Is an assistant permitted, and at which steps. What must the candidate be able to do without one. What has to be disclosed, and in what form. Written out for three families, the same three questions produce visibly different rules:

• Marketing. Assistants permitted at every step, including first drafts. Any figure in the deliverable carries the source the candidate actually opened. Disclosure: the sources, not the prompts.
• Data and analytics. Assistants permitted for code and for interpretation. The candidate must be able to reproduce the headline number without the assistant and say what would change it. Disclosure: the transformation steps.
• Software engineering. Assistants permitted for the whole change if the candidate wants. The candidate owns the tests and the failure modes, and can explain any line they shipped. Disclosure: what was accepted unchanged.

Silence is the worst clause of all. An unwritten rule reads as a ban to careful candidates and as permission to everyone else, which converts your process into a test of how much benefit of the doubt someone is willing to take. That asymmetry falls hardest on the candidates who read your careers page most carefully. The choice of what to allow on a specific exercise is its own decision, and whether to allow AI on a take-home is where most teams start. The policy's job is to make sure the answer exists in writing before a candidate has to guess it.

Who Signs Off, and on What?

Four signatures, each on a different part. Employment counsel signs the notice, consent and records language. Security or privacy signs what is captured, where it lives and when it is deleted. The talent leader who runs the process signs the permitted-use rules and the decision points. One named executive signs the whole document and owns it at review. Procurement adds a fifth gate: no new tool without that executive's approval.

The reason to write the names down is that governance frameworks treat it as the first control rather than a formality. The NIST AI Risk Management Framework's govern function asks that roles, responsibilities and lines of communication for managing AI risks be documented and clear throughout the organization, that legal and regulatory requirements involving AI be understood and documented, that policies define and differentiate the roles for human oversight of AI systems, and that third-party risks be addressed by policy ⁵. Four of its own subcategories are about who, not what.

A signed document that changes nothing arrives in two forms, and both are worth naming. The first is a policy signed only by legal: the words survive review and the practice never changes, because no one who runs a hiring loop was in the room. The second is a policy signed only by talent: it describes the process accurately and takes on notice and retention duties nobody checked. You need both signatures for the same reason a change needs an author and a reviewer.

When the conversation with counsel starts, bring the tool inventory and the decision-point map rather than the draft. What your legal team will actually ask for is a description of where a human decides and what evidence that decision rests on, and a draft written before you can answer that gets rewritten anyway.

What Does the Law Put in the Policy for You?

Four clauses you do not get to choose. Candidates get told what the technology is and how they will be evaluated, in enough detail to decide whether to request an accommodation ⁴. The accommodation route is written down and costs the candidate nothing ⁴. Impact records and retention are the employer's duty rather than the vendor's ²³. And where New York City's rule reaches, an audit summary is published before use ¹.

The notice section is where most drafts underdeliver, because a link inside a privacy policy is not notice. New York City's rule is specific about the shape: the summary of results of the most recent bias audit is published on the employer's own site before the tool is used, candidates get at least ten business days' notice, that notice carries instructions for requesting an alternative selection process or an accommodation, and the auditor cannot hold a financial interest in the vendor or the employer ¹. Those duties attach to your careers page, not to a vendor's compliance page.

Records are the clause people discover late. The Uniform Guidelines put the documentation obligation on the user of a selection procedure (the employer making the decision), including records disclosing impact by sex and by race and ethnic group, with an adverse impact determination made at least annually for each group constituting at least two percent of the labor force in the relevant labor area or of the applicable workforce ². Retention is separate again: one year from the making of the record or the personnel action, whichever is later, and once a charge is filed, every relevant personnel record until final disposition, expressly including test papers completed by the unsuccessful applicant and by all other candidates for the same position ³. Write the hold procedure into the policy while it is still hypothetical.

Buying the tool does not move any of this. The Justice Department's guidance is direct that an employer must ensure its use of hiring technology does not cause unlawful discrimination on the basis of disability, and that this applies when the employer uses another company's technology ⁴. So the policy names your obligations, and the documents you demand from the vendor are how you meet them. The accommodation clause deserves its own drafting session rather than a sentence: what an accommodation looks like on an AI-open assessment is a procedure, not a statement. See how Olive measures this.

How Do You Keep It From Going Stale?

Tie the review to events rather than to a calendar quarter: a new tool, a changed threshold, a new hiring jurisdiction, a vendor model update. Add one dated annual pass over impact figures, which the Uniform Guidelines already ask for ². Then check the published artifacts yourself, because the gap between a signed policy and a live careers page is where this quietly comes apart.

That gap has been measured. In a survey of Local Law 144 compliance, 155 student investigators recorded 391 employers, of whom 18 posted audit reports and 13 posted transparency notices ⁶. The authors are careful that this counts published artifacts rather than determining which employers were legally covered, so read it as a floor on posting rather than a rate of violation. Even read that conservatively, it is a striking number of large employers with a policy somewhere and nothing on the page a candidate would actually look at.

So make posting a task with a name against it, on a date, in the same tracker as everything else that ships. Version the document, date it, and keep one line per change saying what triggered it. A tool swap, a threshold change and a new state all force a re-read of the notice, and the person who signs the new version is the same executive who signed the first one.

One more habit worth building in: read the policy from the candidate's side once a year. If it does not let you explain a decision to the person it was made about, it will not survive being asked to, which is the practical test behind explaining an AI-assisted rejection to a candidate. And if the whole thing is running ahead of your actual volume, write the smallest version that still defends itself and grow it when the funnel does.

Read the evidence >