How do you use AI in HR without crossing the legal line?
In SHRM's State of AI in HR 2026 survey of 1,908 HR professionals, published in April 2026, 39% of organizations had implemented AI in their HR functions and another 7% planned to this year. The same survey found that 57% of HR professionals in states with workforce AI rules aren't aware of those rules. The table sorts the work an HR generalist does into drafting and deciding: ten tasks with a prompt on this page, three that sibling guides cover, and one that no prompt should touch.
| HR task | Where the prompt is | Drafting or deciding? | Never paste |
|---|---|---|---|
| Write or update a policy | Prompt 1 | drafting | names, individual pay |
| Rewrite a handbook section in plain English | Prompt 2 | drafting | nothing personal is needed |
| List handbook gaps by state | Prompt 3 | drafting; every line checked by you | nothing personal is needed |
| Write the company AI use policy | Prompt 4 | drafting | nothing personal is needed |
| Plan investigation interviews | Prompt 5 | drafting | real names, medical details |
| Sort your interview notes | Prompt 6 | drafting; the finding is a decision | names, health, immigration status |
| Announce a change, with an FAQ | Prompt 7 | drafting | anything not yet announced |
| Build a 30 day onboarding plan | Prompt 8 | drafting | Social Security numbers, I-9 documents |
| Turn a policy into a training quiz | Prompt 9 | drafting | nothing personal is needed |
| Find themes in survey or exit comments | Prompt 10 | drafting; acting on one person is deciding | anything that identifies a respondent |
| Write a job description | AI prompt to write a job description | drafting | the pay band of a named person |
| Screen resumes | AI for recruiters | deciding, once it scores or ranks | names, photos, dates of birth |
| Write a performance review | Use AI to write a performance review | drafting; the rating is deciding | leave and medical details |
| Predict who will quit (attrition or flight risk scores) | none; section 2 applies | deciding: a score about a named employee | names, performance and leave data |
The last column protects the employee. The third protects the company. Rules on AI in employment decisions don't stop at hiring and promotion any more, and the chart shows how fast they've spread past them.
New York City's 2023 law, the one most guides mention, covers screening candidates for hire and employees for promotion. That's where it stops. Every rule since reaches at least one decision after that, from pay to discharge, and the table below quotes each rule's own list. Illinois (flagged) has applied since 1 January 2026, and three more start between January and October 2027.
Which state AI laws apply to HR decisions after hiring?
Five of the six US AI employment rules we read on 3 October 2026 reach past hiring and promotion, and for an HR generalist the deciding difference is whether a chat app drafting a summary counts. Only Colorado exempts drafting by name. Connecticut excludes word processing software only "insofar as" it doesn't make or materially influence an employment decision, and California's privacy rules reach only technology that replaces human decisionmaking. Illinois has no exemption: the Illinois statute ends its definition of AI with the sentence "Artificial intelligence" includes generative artificial intelligence. The table quotes each rule's own scope, United States only, as of 3 October 2026. It summarizes the texts and isn't legal advice.
| Rule | In force | HR decisions it reaches | A chat app drafting from your notes | What HR owes |
|---|---|---|---|---|
| New York City Local Law 144 | 5 July 2023 | "to screen candidates for employment or employees for promotion within the city" | covered only when the tool scores, ranks or recommends; AI for recruiters has the audit rule | yearly bias audit and notice before use |
| California FEHA automated decision rules | 1 October 2025 | a process that "makes a decision or facilitates human decision making regarding an employment benefit", defined to include hiring, promotion, compensation and discharge | word processing and spreadsheet software are excluded, "provided that these technologies do not make a decision regarding an employment benefit" | no discriminatory effect; keep automated decision data four years; employers of five or more |
| Illinois Public Act 103-0804 | 1 January 2026 | recruitment, hiring, promotion, renewal, training, discharge, discipline, tenure, terms, privileges or conditions | no exemption; generative AI is named | no discriminatory effect, no zip codes as a proxy, notice to employees |
| Colorado SB 26-189 | 1 January 2027 | "access to, eligibility for, selection for, or compensation for" employment | excluded: "a tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing" | notice before use; within 30 days of an adverse decision, the AI's role in plain language; human review on request; records kept three years |
| California CCPA automated decision rules | 1 January 2027 | hiring, allocation or assignment of work, compensation, promotion, demotion, suspension, termination | no drafting exemption; covered only when the technology is used "to replace human decisionmaking or substantially replace human decisionmaking", and a reviewer with "the authority to make or change the decision" takes it out | pre-use notice, opt-out and access, for CCPA businesses (over $26,625,000 gross revenue as of 2025, among other tests) |
| Connecticut Public Act 26-15 | 1 October 2027 | "to hire, promote, discipline or discharge", renew, training, tenure, terms, privileges or conditions | no drafting exemption by name; word processing and similar software excluded only "insofar as" it does not "make or materially influence" an employment decision | written notice before the decision; since 1 October 2026, a WARN layoff notice must also tell the state whether the layoffs relate to AI |
Read the drafting column as a summary of the texts, not a legal opinion. A prompt that turns your typed notes into a summary is the use Colorado's exemption names. California's privacy rules reach only output that replaces a human decision. Ask the same chat app which of three employees to let go, though, and it's producing the ranking five of the six rules are written about. Illinois makes it a civil rights violation "to fail to provide notice to an employee that the employer is using artificial intelligence" for the decisions in its list. Whether your own workflow is in scope is a question for employment counsel.
Two Illinois facts matter for a small company. Since 1 July 2020 (Public Act 101-0430), the Human Rights Act has counted as an employer "any person employing one or more employees within Illinois during 20 or more calendar weeks" of the year of the violation or the year before. And the notice rules are still missing. The Department of Human Rights published proposed rules in the Illinois Register on 15 May 2026, then on 2 June 2026 temporarily withdrew them and postponed the 10 June hearing "to allow for continued collaboration with other state agencies" (its update page, archived 4 June 2026). The statute says the department "shall adopt" rules on "the time period for providing notice, and the means for providing notice". We found no adopted rule and no new hearing date on the department's site on 3 October 2026.
What are the best AI prompts for HR policies and the handbook?
The best HR policy prompts hand the model your decisions and forbid it from adding legal requirements of its own. Prompts 1 to 4 work the same in ChatGPT, Claude or Gemini: fill the brackets and paste. For the rest of the job, the HR prompts pack has 20 more, from rejection emails to the themes across a stack of exit interviews.
Prompt 1, a policy from your decisions:
Draft a [remote work] policy for a [120] person company with employees in [states]. Use only the decisions below. Sections: purpose, who it covers, the rules, how to ask for an exception, who to contact. Under 600 words, plain English. Where a decision is missing, write [DECISION NEEDED] instead of choosing one. Do not add any legal requirement; at the end, list every point where a state law might apply so I can check it with counsel. Decisions: [paste].
Prompt 2, a handbook section in plain English:
Rewrite this handbook section so a new hire understands it on one read. Keep every rule, number, date and deadline exactly as written. Short sentences, second person, no legal Latin. After the rewrite, list any sentence whose meaning you were unsure of instead of guessing. Section: [paste].
Prompt 3, the state gap list:
Here is our handbook's table of contents and our headcount by state: [paste]. List the policy topics an employee handbook for these states commonly needs that ours lacks (paid sick leave, final pay timing, lactation breaks and the like). For each, name the state and the law as you understand it, and mark every line VERIFY. Do not write any policy text.
Prompt 3 produces a list for counsel, not an answer. Every model has a training cutoff, and state leave and pay laws change each year, so check each VERIFY line against the state labor department's own page before anything goes in the handbook.
Prompt 4, the company AI use policy:
Draft a one page AI use policy for employees of a [size] company. Include: the approved tools and plans [list]; what may never be pasted into any AI tool (medical and leave records, Social Security numbers, immigration documents, background checks, customer data, anything under NDA); a rule that AI output may not be used as a factor in any decision to hire, promote, discipline, discharge or set pay for a person without review by [HR role]; and who employees ask with questions. Plain English, under 400 words.
Prompt 4 fills the gap most handbooks still have, and its decision rule lines up with Colorado's text. A chatbot that talks to employees (an HR help bot answering policy questions, for one) falls outside the 2027 law only if nobody intends it for consequential decisions and it's subject to "an acceptable use policy that prohibits generated content to be used in a consequential decision".
How do you use AI on a workplace investigation?
Use AI to plan the interviews and to sort your own notes, and never to judge credibility or reach the finding. The finding is the decision that leads to discipline or discharge, and Illinois, Connecticut and both California rules name those decisions in their texts. Replace every name with a role before you paste.
Prompt 5, the interview plan:
I am investigating a workplace complaint. Here is a summary with names replaced by roles (Complainant, Respondent, Witness 1, Witness 2): [paste]. The policies at issue are: [paste]. Write an interview plan: who to interview in what order, six to ten open questions for each person, and the documents to request (messages, schedules, badge records). No leading questions. Do not assess anyone's credibility and do not suggest an outcome.
Prompt 6, your notes to a factual summary:
Below are my typed notes from interviews in this investigation, names replaced by roles. For each allegation, list what each person said (quote their words where my notes quote them), the documents that bear on it, and where the accounts agree and conflict. Do not assess credibility, do not reach a finding, do not recommend discipline, and do not add anything that is not in my notes. Notes: [paste].
If counsel is directing the investigation, ask counsel before you paste anything into an outside tool, a company plan included. Treat the model's summary as a working draft. The report that goes in the file is the one you wrote and signed.
Which AI prompts handle announcements, onboarding, training and surveys?
Announcements, onboarding plans, quizzes and survey themes are pure drafting, so they are the safest place for AI in HR and the place it saves the most typing. Prompts 7 to 10 cover them.
Prompt 7, the change announcement and its FAQ:
Write an all-staff email announcing [the change], effective [date]. Open with what changes for the employee and when, then the reason in two sentences, then what they need to do and by when, then who to ask. Under 200 words, no exclamation marks, no "exciting". Then write five FAQ entries for the questions employees will ask, answered only from these facts: [paste].
Prompt 8, the onboarding plan:
Build a 30 day onboarding plan for a [role] joining a [size] company: day one, week one, and by day 30. Give every item an owner (HR, manager, IT or the new hire). Include our required items exactly as listed: [paste, for example Form I-9 Section 2, benefits enrollment window, policy acknowledgments]. Output as a table.
Prompt 9, a policy into a training quiz:
From the policy below, write eight multiple choice questions that test the rules a new hire must apply, each with four options, the correct answer, and the policy sentence it comes from. No trick questions and no questions about wording. Policy: [paste].
Prompt 10, survey and exit interview themes:
Here are [N] anonymous comments from our [engagement survey or exit interviews], with names, team names under five people and identifying details removed: [paste]. Group them into themes. For each theme give the number of comments and two short quotes, word for word. Do not guess who wrote any comment and do not infer age, gender or any other trait.
Prompt 10 stays a drafting job only while it's about themes. Once a summary is used to single out one employee for action, it's an input to a decision, and the rule table above applies. Reviews follow the same rule: the performance review guide keeps the rating with the manager for that reason.
What should HR never paste into ChatGPT?
Never paste medical information, leave certifications, accommodation requests, Social Security numbers, I-9 documents, background check reports or an investigation with real names into any AI chat. Medical records have their own federal rules: the ADA requires information from employee medical exams to be kept "on separate forms and in separate medical files" (29 CFR 1630.14), and FMLA certifications must be "maintained as confidential medical records in separate files/records from the usual personnel files" (29 CFR 825.500). A chat history is neither.
The plan matters as much as the paste. OpenAI's data controls page says consumer ChatGPT conversations can train its models unless you switch off "Improve the model for everyone". ChatGPT Business isn't used for training by default, and it costs $25 a seat a month, or $20 billed yearly, with a two seat minimum as of October 2026. Claude Team is $25 a seat, or $20 billed yearly, also with a two seat minimum, with training "None by default" against an opt-out on Free, Pro and Max. On company plans the employer can see more, not less: Can my employer see my ChatGPT conversations explains the Enterprise Compliance API, and what never to paste into an AI chat has the full list for every vendor.
For an HR team of one, Whizi is one option. Starter at $15.99 a month ($10.99 billed yearly) runs GPT and Claude Haiku, and Pro at $29.99 ($19.99 yearly) adds Claude Sonnet and Gemini. A project holds the handbook (up to 10 pinned files of 10 MB each, PDF and .docx included), so Prompts 2, 3 and 9 read your own text every time. Whizi doesn't train its own models on your chats, but a message sent to GPT still reaches OpenAI and one sent to Claude reaches Anthropic. Where Whizi loses: it has no team accounts, so an HR department that needs shared seats and central controls is better served by ChatGPT Business or Claude Team.
Will AI replace HR?
No, on the US government's own projection. The Bureau of Labor Statistics counts 224,900 human resources manager jobs in 2025 with a median pay of $149,280 in May 2025, and projects 6 percent growth from 2025 to 2035, faster than average; HR specialists, 939,700 jobs, are projected to grow 6 percent as well. Its one line on the manager's job describes work a chat app does not do: they "plan, coordinate, and direct the administrative functions of an organization."
So run the ten prompts for the writing and keep a person on every decision about a named employee. Illinois' notice provision has been in force since 1 January 2026. Colorado and California's privacy rules add notice duties on 1 January 2027, and Connecticut on 1 October 2027.
- Draft with AI and decide with a person: no score, rank or recommendation about a named employee
- Replace names with roles before pasting any investigation, survey or review
- Keep medical, leave, I-9 and background check records out of every prompt
- Use a plan that does not train on your chats by default, or switch training off
- Publish an AI use policy that bars AI output from hiring, discipline, pay and discharge decisions without HR review
- If you use AI for a decision about an Illinois employee, the statute requires notice; Colorado, California and Connecticut add duties in 2027
Frequently asked questions
Can HR use ChatGPT?
Yes, for drafting policies, announcements, onboarding plans, quizzes and summaries from your own notes, on a plan that doesn't train on your chats by default (ChatGPT Business or Claude Team as of October 2026) or a consumer plan with training switched off. Keep medical, leave and identity records out of it, and keep the decision about any named employee with a person.
Is it legal to use AI to decide who gets disciplined or fired?
None of the six rules on this page bans it outright as of October 2026. Illinois makes it a civil rights violation to use AI "that has the effect of subjecting employees to discrimination on the basis of protected classes", or to use it without telling employees. From 1 January 2027, Colorado requires a plain language account of the AI's role within 30 days of an adverse decision, plus human review on request. California's privacy rules add notice and opt-out on the same date, and Connecticut adds written notice from 1 October 2027. That's a summary of the texts, not legal advice.
Do HR professionals need an AI certification?
None of the six rules on this page requires an AI certificate for HR as of October 2026. Colorado's 2027 law defines meaningful human review as review by someone who "is trained to conduct the review", so what counts is documented training for whoever signs off on an AI-influenced decision; a course certificate is one way to show it.
