AI is no longer just a workplace assistant that drafts adverts, summarises feedback or answers employee questions. As agentic AI begins to take action, influence decisions and execute workflows, HR leaders face a much bigger question: who governs AI when it starts shaping people’s working lives? This article looks at why HR’s remit needs to expand, how meaningful human oversight should work, why organisations need clearer visibility of AI use, and what HR teams can do now to build governance, literacy and accountability into every stage of the employee lifecycle.

Fosway identifies exactly this shift in Cloud HR: agents are moving from recommendation towards execution, with AI increasingly able to perform actions that previously required someone to work inside an application.

That shift is important because it means humans are in danger of slipping further out of the loop.

When AI writes a first draft of a policy, the risk is relatively contained. When AI screens a candidate, identifies someone as a flight risk, recommends development opportunities, assesses performance or initiates an employment-related workflow; the consequences are very different. The more AI is able to act, the more important it becomes to know who is accountable for those actions. And how they can maintain that accountability without taking on the tasks themselves.

HR's remit is about to get bigger

HR needs to be at the table with a strong voice any time AI use is discussed. While traditionally, an organisation might view AI as something owned by IT, digital transformation, security or legal, but that creates a gap. Technical ownership and people responsibility aren't the same thing.

CIPD makes a particularly useful distinction here. It argues that HR's responsibility shouldn't stop at AI used by the HR department. Its remit potentially covers any AI deployment that affects people, because HR already governs employment relationships, workplace policies, skills, processes and many of the decisions that affect an employee's working life. (CIPD)

So an AI tool might technically be owned by another department while still creating questions HR needs to help answer. For example:

• Who decides whether AI can influence hiring?
• Can it recommend someone's performance rating?
• Can it determine who gets additional shifts offered?
• What happens when an employee disagrees with an AI-supported decision?
• Which decisions must always involve a human?
• What do employees need to know about how AI is being used?
• What data informs this recommendation?
• Can we understand why this outcome occurred?
• How has bias been tested?
• What can the system execute autonomously?
• What permissions does it have?
• Where are actions logged?
• Can a decision be challenged or reversed?
• What happens when the model or underlying service changes?
• SEE – Understand where AI touches people.
• SET – Define the boundaries.
• SKILL – Build meaningful human oversight.
• SAFEGUARD – Update governance around the employee relationship.
• SCRUTINISE – Keep checking the outcomes.

Because these are questions about employment, fairness, trust and organisational policy (not just APIs and data), HR should be involved in answering them. HR doesn't need to own AI, but it does need to own its impact on people.

From policy owner to decision driver

In a typical organisation, HR creates policies. But with AI’s capabilities growing, the way HR teams take ownership of them needs to grow too. This shift means HR may increasingly need to help define the boundaries within which machines can make or execute policies instead of executing them directly.

Fosway describes governance increasingly becoming part of the execution layer: permissions, approval points, auditability and guardrails need to determine what an AI agent is allowed to do and when human approval is required. For HR leaders, that creates a new design challenge.

As HRs build target operating models and workflows that include AI, the design questions they need to ask have changed. Instead of simply asking whether or not AI is capable of something, leaders need to start asking if AI should do it. And, if yes, under what conditions?

This change means we’ll need to start being a lot more explicit about how we want to use AI in any given scenario. Should it come in as a simple assistant (think, taking meeting notes, summarising calls, etc.), should it make recommendations based on the data you’ve fed it? Should it take action with your approval? Or should it take action without your direct go-ahead?

Different HR activities should sit at different points.

Unfortunately, there is no one size fits all answer for which activities belong where. Every organisation has different needs, different data and different appetites for risk. This is part of the deliberate thinking that HR leaders need to do at the beginning of transformation projects.

Human oversight has to mean more than putting a human in the workflow

There is an obvious response to AI risk: “Don't worry, there's a human in the loop.” But what does that really mean, and does it actually mitigate risk in a meaningful way?

ICO guidance says that when humans are involved in AI-supported decisions, they should actively scrutinise the recommendation, have the authority and ability to override it, and weigh it alongside other relevant information rather than routinely accepting the system’s output. (Information Commissioner’s Office) That means organisations need people who are skilled and well-trained enough to challenge the tasks they are asking AI to perform.

That has a significant implication for HR.

If managers are expected to challenge AI recommendations, they have an obligation to maintain the skills needed to spot things going awry. They need to understand enough about the system to recognise when something looks wrong at the minimum. But, to make them effective, they need to both know what information informed the recommendation and understand the limits of the technology. Without that, they’ll struggle to rectify any mistakes that do get made.

From an organisational standpoint, they have to know when escalation is required while also feeling psychologically and organisationally able to disagree with it.

Otherwise, “human in the loop” risks becoming “human clicks approve.”

This presents its own challenges as AI is expected to take on more and more of the work that early career HRs do. In the future, who will have the skills to provide useful oversight and how will those skills be acquired?

HR will need visibility over AI’s impact

AI is increasingly spread across the whole business. Which mean that the responsibility for its impact will seem very diffuse. It might sit inside the HRIS, ATS or payroll system, but also within productivity tools, workforce management platforms, management software and applications procured independently by other functions.

What matters to HR leaders is impact. Especially impact on people. To know where HR oversight makes sense, every instance of AI should be evaluated. Fosway predicts organisations will increasingly need something like an “agent inventory”. It should provide clarity about both the human impact of the AI and how agents are configured and controlled.

For every significant AI use case affecting employees or candidates, HR teams need to understand where AI is being used and who it affects. But the inventory should also cover important things like "what data is it using?" and "what happens if something goes wrong?" It's important to align these use cases with the types of oversight mentioned in the previous section.

HR will need to build AI governance into the employee lifecycle

Rather than treating responsible AI as a standalone policy, HR should start embedding it into the people processes it already owns. AI is no longer something that sits separately from day-to-day work. It is increasingly built into the systems, programmes and workflows employees use across the business, which means its impact is spread across the employee lifecycle. If AI is influencing how people are hired, managed, developed, rewarded or supported, then the policies that govern those moments need to reflect that.

Recruitment is one of the clearest examples. With more employers using automated tools to screen applications, rank candidates or support hiring decisions, new standards and safeguards are emerging for good reason. The ICO’s 2026 work with more than 30 employers found gaps in transparency, safeguards, consistent human involvement and bias monitoring in automated recruitment. It has since called on employers to review how they use automated decision-making. (Information Commissioner’s Office)

The same principle should extend throughout the employee life cycle. At each stage, HR leaders can ask: Where is AI influencing an outcome, and are our existing controls still appropriate? Do we need to have a greater human influence here, or can we trust an automated system?

Responsible AI doesn't necessarily require HR to invent an entirely new governance discipline. In many cases it just means updating the governance and policies you already have in place. This process becomes a lot easier when you’ve already done the work of mapping out the AI impact and understanding the level of human oversight needed for each use case.

AI literacy will become an HR capability – not just an IT skill

Going back to human oversight – HR professionals will need a solid foundational knowledge of how AI works, not just how to use it. While no one is expecting HR Directors to be building their own AIs (right now), there will be a need for HRs to know enough to challenge AI and understand its impact in different situations.

That includes being able to ask vendors and internal technology teams the right questions to make sure AI is effective and compliant. A good set of starter questions include:

These questions are just the beginning. The more you know about AI, the better able to interrogate it you become. That ability to ask questions and dive deeper will be the difference between using AI and really making it work for you.

This concept aligns well with NIST's broader risk-management approach, which treats AI governance as an organisational discipline spanning the design, deployment, use and evaluation of AI rather than something confined to technical development. (NIST)

Accountability needs a name, not a committee

Cross-functional AI governance is logical. HR, IT, legal, security, data and business leaders all bring different expertise. There’s no doubt that all of these voices need to be heard. But having an “AI committee” is a surefire way to let issues stagnate without clear accountability.

AI governance needs clear ownership of outcomes. That ownership may sit in different places depending on the technology, the process and the way AI is being used. But for every use case that affects employees or candidates, organisations need to know who owns the tool, who owns the process and who is accountable for the decision or action that follows. Crucially, that includes who responds to employees when something goes wrong.

That level of clarity comes from naming an accountable individual, not relying on a general AI committee. Committees can advise, challenge and support, but accountability still needs to sit somewhere specific. Without individual ownership, responsibility can quickly become everyone’s concern and no one’s job.

How HR leaders can prepare now

Now is the time to tackle these issues. Based on these needs, you can use a clear and simple framework to get your HR team ready. Follow these steps in order:

SEE > SET > SKILL > SAFEGUARD > SCRUTINISE

See

Map significant AI use cases across the employee lifecycle, including technology outside HR.

Set

Decide which activities AI can assist with, recommend or execute, and where human judgement remains mandatory.

Skill

Give HR teams and managers enough AI literacy to interrogate recommendations rather than simply accept them.

Safeguard

Review policies, procurement, employee communications, escalation routes, permissions, and mechanisms for challenging decisions.

Scrutinise

AI governance isn't finished when a system goes live. You need to monitor outcomes, bias, accuracy, unintended consequences, and whether the technology is delivering the benefit originally expected. But from an HR standpoint, the most important thing to pay attention to is how is this impacting your people?

There is a huge opportunity to use AI to make working life easier and better for employees. AI could remove administration, make expertise more accessible, help managers make better decisions and give HR greater influence over how work is designed and delivered.

But it doesn’t come without risk. And the more that we use it to help, the greater the risk. As AI moves deeper into the decisions and processes that shape people's working lives, HR's role can't simply be to adopt the technology once somebody else has decided how it works.

HR has a vital role to play in deciding where AI should be used, what it should be allowed to do, where human judgement must remain in control, and how issues are handled when something goes wrong. The organisations that get this right will not be the ones that adopt AI the fastest, but the ones that build the governance, skills and accountability needed to use it well. HR leaders who start that work now will be better prepared to manage AI’s risks and better placed to shape how it improves working life.