AI Governance FAQ

HRMLESS uses AI systems for interview analysis, candidate scoring assistance, scheduling optimization, and content summarization. Each system is cataloged in our AI System Inventory with a designated risk tier, Model Card, and assigned Model Owner. We currently govern four AI systems, all of which are documented and subject to our full governance program.

We apply a multi-layered approach to bias prevention. Before deployment, every AI system undergoes bias testing across protected characteristics using demographic parity, equalized odds, and calibration metrics. In production, we continuously monitor fairness metrics with automated drift detection. If any metric exceeds predefined thresholds, our AI Governance team is alerted and conducts a triage within 48 hours. All AI-assisted interview decisions require human review before any action is taken.

Our AI governance program is built on the NIST AI Risk Management Framework (AI RMF 1.0), which structures risk management into four functions: Govern, Map, Measure, and Manage. We've mapped our NIST AI RMF controls to SOC 2 Trust Services Criteria, ensuring AI governance activities are integrated into our broader compliance program. Our controls also address all seven NIST trustworthiness characteristics.

We maintain an active regulatory mapping that tracks AI employment laws across U.S. states and municipalities. This includes the Colorado AI Act, Illinois Video Interview Act, NYC Local Law 144, Texas TRAIGA, and others. Each regulation is mapped to our NIST AI RMF controls with a documented compliance status. Our legal and AI governance teams review this mapping semi-annually and whenever new legislation is enacted.

Yes. Candidates and customers can request human review of any AI-assisted decision at any time. Contact your account representative or email [email protected] to initiate a review. Requests are triaged within 24 hours. No candidate or customer is ever penalized for requesting a human review, and our human reviewers have full authority to override any AI recommendation.

We have a dedicated AI Incident Response Playbook that extends our general incident response procedures. AI incidents are classified by severity and type (bias event, model failure, adversarial attack, data quality issue). Critical AI incidents trigger a 30-minute response SLA with automatic model fallback or circuit-breaker activation. All incidents receive a post-incident review, and findings are incorporated into our governance improvements.

Each AI system's training data is documented in its Model Card, including data sources, preprocessing steps, and retention policies. We apply data minimization principles, collecting only what is necessary for the system's intended purpose. Training data is reviewed for representativeness and potential bias before use. We do not use customer data to train models without explicit consent and documented data processing agreements.

Third-party AI vendors undergo a structured assessment before integration. We evaluate their AI governance practices, bias testing methodology, data handling procedures, and security posture. Vendors must provide documentation of their own AI risk management practices. Assessments are refreshed annually and whenever significant vendor changes occur. High-risk AI vendors are subject to enhanced due diligence including review of their bias audit reports.

Bias testing occurs at multiple intervals: before initial deployment (mandatory gate), after every model update or retraining, on a continuous basis in production via automated monitoring, and through quarterly comprehensive bias audits with full demographic breakdowns. Additionally, we maintain readiness for independent third-party bias audits as required by jurisdictions like NYC and Colorado.

This Trust Center provides comprehensive public information about our AI governance program. Explore our Risk Management, Bias Prevention, Human Oversight, and Assessments pages for detailed information. Authenticated customers and auditors can access additional documentation including full Model Cards, bias audit reports, and policy documents through the Trust Center portal. For specific questions, contact [email protected].