Build an AI Governance Gap Analysis from Your Existing Policy Docs

The task

You're the HR lead (or the de facto one) who's been handed the AI question: "Do our policies cover this?" Recruiters are using notetakers in interviews, hiring managers are pasting resumes into ChatGPT, and someone just asked whether the ATS vendor's new "agentic sourcing" feature is okay. You need a defensible gap analysis against your current handbook, candidate privacy notice, and anti-discrimination policy — fast — before legal, the CPO, or a candidate complaint forces the issue.

Before AI

The manual version: pull every relevant policy (handbook, acceptable use, data privacy, EEO, vendor management), read each one with a highlighter, cross-reference against an AI risk framework like NIST AI RMF or the EU AI Act Annex III, build a spreadsheet of "covered / partially covered / missing," then write recommendations. For a mid-size employer that's a solid day of focused reading plus another half-day writing it up. Most HR teams don't have the day — which is a big reason AI assistants, meeting notetakers and agentic tools are now active contributors to daily business, and the frameworks haven't caught up. EY's 2026 survey found the same pattern across senior AI executives: implementation is running ahead of oversight.

The workflow

Step 1 — Paste your policy text and get a coverage map

Collect the relevant sections from your handbook, candidate privacy notice, acceptable use policy, and vendor/procurement standards. You don't need the whole handbook — just the parts that touch data, hiring decisions, confidentiality, monitoring, and vendor controls. Paste them in under the sample input block below. The first prompt scores coverage against the HR-specific AI risk categories that actually matter: candidate screening bias, interview recording and notetakers, resume/applicant data in third-party LLMs, agentic sourcing tools, performance and promotion decisions, and employee monitoring.

You are an HR policy analyst building an AI governance gap analysis. Below is a bundle of a company's existing HR-adjacent policies, delimited by "=== POLICY DOC ===" markers. The company wants to know whether these policies adequately govern workplace AI use — especially generative and agentic AI — in HR contexts.

Score the policy bundle against these ten HR-specific AI risk categories. For each category, output:
- Category name
- Coverage rating: COVERED / PARTIAL / MISSING / CONTRADICTED
- Direct quote(s) from the policies that support the rating (or "none found")
- One-sentence explanation

Categories:
1. Generative AI use with candidate PII (resumes, cover letters, references)
2. AI/algorithmic screening and ranking of candidates (adverse-impact testing, four-fifths rule)
3. Interview recording, transcription, and AI notetakers (consent, retention, use)
4. Candidate disclosure — telling applicants when AI is used in the hiring decision
5. Agentic AI tools taking actions on behalf of recruiters (outreach, scheduling, rejections)
6. AI in performance reviews, promotion, and compensation decisions
7. Employee monitoring and productivity AI (keystroke, sentiment, meeting analytics)
8. Vendor/procurement due diligence for HR tech with embedded AI
9. Bias testing cadence, documentation, and remediation ownership
10. Human-in-the-loop requirements for adverse employment actions

Be literal. If a policy says "all personal data" without naming AI, mark PARTIAL and explain why. Do not infer coverage from general language. Output as a markdown table followed by the direct-quote evidence beneath each row.

=== POLICY BUNDLE STARTS BELOW ===

=== POLICY DOC: Northwind Logistics Employee Handbook — Section 7, Technology Use (rev. March 2025) ===
Employees must use company-provided technology resources responsibly and in compliance with all applicable laws. Confidential information, including personnel records and customer data, may not be shared with any third party without written authorization from the Information Security team. Use of personal cloud services (including file-sharing and messaging applications) for company business is prohibited. Violations may result in disciplinary action up to and including termination.

=== POLICY DOC: Northwind Logistics Candidate Privacy Notice (rev. January 2024) ===
Northwind Logistics collects personal information from job applicants including name, contact details, employment history, education, and references. We use this information to evaluate your application and to communicate with you about opportunities. We retain applicant data for 24 months after the final hiring decision. We do not sell applicant data. Applicants in California, Colorado, and the EU have additional rights described in Appendix A.

=== POLICY DOC: Northwind Logistics Equal Employment Opportunity Policy (rev. June 2024) ===
Northwind Logistics is an equal opportunity employer. We do not discriminate on the basis of race, color, religion, sex, national origin, age, disability, genetic information, veteran status, or any other protected characteristic. All employment decisions — including hiring, promotion, compensation, and termination — are based on qualifications, performance, and business need. Complaints of discrimination should be directed to the Chief People Officer.

=== POLICY DOC: Northwind Logistics Vendor Management Standard (rev. September 2025) ===
All vendors handling company or personnel data must sign a Data Processing Agreement and complete the annual Security Questionnaire. New vendor onboarding requires sign-off from Procurement, InfoSec, and the business owner. Vendors must notify Northwind of any material change in subprocessors within 30 days.

=== POLICY DOC: Northwind Logistics Interview Guidelines (internal recruiter wiki, undated) ===
Recruiters should take structured notes during interviews using the standard scorecard template in Greenhouse. Panel interviews should include at least one trained interviewer. Avoid questions about family status, age, or other protected characteristics. If a candidate asks to record the interview, check with HR Business Partner before agreeing.

Step 2 — Turn the coverage map into a prioritized gap register

Now convert the raw coverage output into something you can actually bring to a cross-functional meeting. This prompt asks for a prioritized gap register with risk ratings and suggested policy language — so you walk in with a draft, not just a problem list.

Using the coverage map you just produced, generate a prioritized AI governance gap register for the HR function. For every row rated PARTIAL, MISSING, or CONTRADICTED, output:

- Gap ID (G1, G2, ...)
- Gap description (one sentence, plain English)
- Risk rating: HIGH / MEDIUM / LOW, using this rubric:
    HIGH = direct exposure to discrimination claims, regulatory penalty (EEOC, state AI hiring laws like NYC Local Law 144, Colorado AI Act, EU AI Act Annex III), or candidate PII leakage to third-party LLMs
    MEDIUM = internal process failure, inconsistent practice, or audit finding risk
    LOW = documentation hygiene, clarity, future-proofing
- Likely owner (HR, Legal, InfoSec, Procurement, or joint)
- Draft policy language (2-4 sentences) the company could insert or amend to close the gap. Write in the voice of an existing employee handbook — declarative, specific, no hedging.
- Dependencies or decisions needed before adopting the language (e.g., "requires decision on whether notetakers are permitted in final-round interviews")

Sort the register by risk rating (HIGH first), then by owner. Output as a markdown table, with the draft language in a separate numbered list beneath keyed to Gap ID so the table stays readable.

Step 3 — Produce a one-page summary for leadership

Executives won't read the register. They'll read one page. This step compresses the output into a leadership brief with the three things a CPO or GC actually needs: what's exposed, what we're asking for, and what it costs to fix.

Produce a one-page executive summary of the AI governance gap analysis for the Chief People Officer and General Counsel. Use this structure, with these exact headings:

**Bottom line (3 sentences max):** What's the overall posture? Are we exposed, partially covered, or in reasonable shape? Name the single biggest risk.

**Top 3 gaps requiring decisions this quarter:** Pull the three highest-risk gaps from the register. For each, one sentence on the exposure and one sentence on the recommended fix.

**What we're asking for:** A bulleted list of specific decisions needed from CPO/GC (e.g., "approve candidate-facing AI disclosure language," "fund annual bias audit for ATS vendor"). No more than six bullets.

**What this does not cover:** Honest scope caveats — jurisdictions, employee populations, or AI use cases that were out of scope for this review. This builds trust; do not skip it.

**Suggested next step:** One concrete meeting or workstream, with a proposed owner and a 2-week or 4-week horizon.

Keep the whole output under 400 words. No marketing language. Write for a skeptical GC.

Gotchas

• Garbage in, garbage out on policy text. If you paste a table of contents or a summary instead of actual policy clauses, the model will hallucinate coverage. Paste the operative language.
• The model will over-credit general confidentiality language. A handbook line that says "don't share confidential info with third parties" is not an AI policy. If Step 1 keeps rating things COVERED on that basis, re-run with the instruction "treat generic confidentiality clauses as PARTIAL at best unless they explicitly name AI, LLMs, or automated decision systems."
• Jurisdiction-specific laws drift fast. The prompt names NYC Local Law 144, Colorado AI Act, and EU AI Act Annex III because they're the most-cited HR-relevant ones, but your actual obligations depend on where candidates and employees sit. Have counsel verify the regulatory callouts before anything leaves the building.
• Bias testing is not a prompt. The output will recommend bias audits — good — but the actual work of disparate-impact testing requires real applicant data, statistical method, and usually a vendor or stats partner. Don't let a tidy policy paragraph substitute for the audit itself.
• This is a draft, not a filing. You're producing a working document for a cross-functional conversation. Nothing from this workflow should go to a regulator or into a handbook without legal review.

Time saved

Rough estimate: 4-6 hours per policy review cycle. The manual version is a full day of reading plus half a day of writing. This workflow collapses the reading-and-mapping phase into one prompt run and the register-building phase into a second, leaving you to spend your time on the judgment calls — which gaps actually matter, which draft language your GC will accept, and which decisions you push to leadership. Treat the time saving as directional: it's the review and drafting hours that compress, not the stakeholder meetings that follow.

What we got when we ran it

We executed every prompt above, in order, against the sample input (model: claude-sonnet-4-6). Outputs below are real and unedited apart from length truncation.

Step 1 output

Northwind Logistics — HR AI Governance Gap Analysis ### Summary Table | # | Category | Coverage Rating | One-Sentence Explanation | |---|----------|----------------|--------------------------| | 1 | Generative AI use with candidate PII (resumes, cover letters, references) | **MISSING** | No policy addresses the use of generative AI tools to process, summarize, or generate content from candidate personal information. | | 2 | AI/algorithmic screening and ranking of candidates (adverse-impact testing, four-fifths rule) | **MISSING** | The EEO policy states a non-discrimination commitment but contains no reference to algorithmic screening tools, adverse-impact testing, or the four-fifths rule. | | 3 | Interview recording, transcription, and AI notetakers (consent, retention, use) | **PARTIAL** | The Interview Guidelines address candidate-initiated recording requests but are silent on company-initiated AI transcription, AI notetakers, or retention/use of AI-generated transcripts. | | 4 | Candidate disclosure — telling applicants when AI is used in the hiring decision | **MISSING** | The Candidate Privacy Notice describes data uses but never discloses that AI or automated decision-making may be involved in evaluating applications. | | 5 | Agentic AI tools taking actions on behalf of recruiters (outreach, scheduling, rejections) | **MISSING** | No policy references autonomous or agentic AI tools, and the Technology Use policy's prohibition on unauthorized third-party data sharing does not contemplate AI agents acting on recruiter behalf. | | 6 | AI in performance reviews, promotion, and compensation decisions | **MISSING** | The EEO policy names these decision types but says nothing about AI-assisted or

…output truncated at 250 words.

Step 2 output

Northwind Logistics — HR AI Governance Gap Register ### Priority-Sorted Gap Register | Gap ID | Gap Description | Risk Rating | Likely Owner | |--------|----------------|-------------|--------------| | G1 | No policy governs recruiter use of generative AI tools (e.g., ChatGPT, Copilot) with candidate PII such as resumes, cover letters, and references. | **HIGH** | HR + InfoSec + Legal | | G2 | No algorithmic screening or ranking controls exist, and no adverse-impact or four-fifths rule testing is required for AI-assisted candidate filtering tools. | **HIGH** | HR + Legal | | G3 | The Candidate Privacy Notice does not disclose to applicants that AI or automated decision-making may be used in evaluating their application. | **HIGH** | Legal + HR | | G4 | No bias testing cadence, documentation standard, or remediation ownership is established for any AI tool used in hiring or employment decisions. | **HIGH** | HR + Legal | | G5 | No human-in-the-loop requirement exists before an AI-generated recommendation results in an adverse employment action. | **HIGH** | HR + Legal | | G6 | The Vendor Management Standard requires DPAs and security questionnaires but contains no AI-specific due diligence requirements for HR tech vendors with embedded AI. | **HIGH** | Procurement + Legal + InfoSec | | G7 | No policy governs company-initiated AI notetaking or transcription during interviews, including consent, retention, or downstream use of AI-generated transcripts. | **HIGH** | HR + Legal | | G8 | No policy governs agentic AI

…output truncated at 250 words.

Step 3 output

AI Governance Gap Analysis — Executive Summary **Prepared for:** Chief People Officer | General Counsel **Date:** July 2025 | **Reviewer:** HR Policy & Compliance --- **Bottom line:** Northwind's existing HR policies were not written with AI in mind and provide virtually no governance over how AI tools are used in hiring, performance management, or employee monitoring. All ten reviewed risk categories are either missing coverage or only partially addressed. The single highest immediate risk is regulatory: if Northwind uses any algorithmic screening or scoring tool for roles in New York City, the company is likely out of compliance with NYC Local Law 144 today. --- **Top 3 gaps requiring decisions this quarter:** **1. Algorithmic candidate screening (G2).** Using an AI screening tool without documented adverse-impact testing exposes Northwind to EEOC enforcement and, for NYC roles, mandatory third-party audit obligations under Local Law 144 that carry per-violation penalties. Commission an immediate audit of every tool in the hiring pipeline and determine whether a third-party bias auditor must be engaged before the next hiring cycle. **2. Candidate AI disclosure (G3).** Failing to tell applicants that AI is used in evaluating them violates GDPR Article 22 for EU applicants and the Colorado AI Act for Colorado roles, both of which are in force now. Legal must approve updated Candidate Privacy Notice language and determine at which application stage disclosure must appear. **3. Generative AI with candidate PII (G1).** There is no policy preventing recruiters from pasting resumes into consumer AI tools, creating

…output truncated at 250 words.