AI for HR: what it's good for, which tools, and the rules on employee data

AI helps HR teams most with writing and finding things: job ads, policy drafts, employee emails, and answers to "what does our handbook say about this?" Using AI to screen, rank or reject candidates is a different matter: New York City requires bias audits, Illinois, California and Texas have rules in force in 2026, and Colorado and the EU follow in 2027. Keep medical, disciplinary and pay records out of consumer chatbots.

This guide covers how HR teams use AI, whether HR can use ChatGPT, the laws on AI in hiring with their current dates, the rules on employee data, the main tool types, the risks, a checklist and prompts. Facts come from regulators, the laws themselves, SHRM, Gartner and the companies' own pages, checked on 16 October 2026. It's a summary, not legal advice.

How HR teams use AI

• Recruiting: writing job ads, scheduling interviews, answering candidate questions, and, in some tools, matching or ranking applicants. SHRM's 2026 survey found recruiting is the most common HR use, at 27% of organizations.
• Policy questions: answering "how many sick days do I get?" from the handbook, for employees or for the HR team itself.
• Writing: policies, offer letter templates, announcements, training outlines and survey questions.
• Performance and engagement: summarizing feedback, suggesting goals, reading survey comments.
• Onboarding and training: checklists, welcome guides, quizzes from training material.

Adoption is real but uneven. SHRM's 2026 State of AI in HR report says "just 39% of organizations have implemented AI in their HR functions," while 62% use AI somewhere in the business. Gartner's July 2026 survey of heads of HR found 95% of organizations used AI in some way, but only one in five got significant value from it. The surveys measure different things, so the numbers don't conflict.

Can HR use ChatGPT?

Yes, for the right tasks. The line is personal data and decisions about people.

On ChatGPT's Free, Go, Plus and Pro plans, your chats can be used for training unless you turn it off; Business and Enterprise don't train by default. OpenAI itself says: "Please do not enter sensitive information that you would not want reviewed or used." Our guides to whether ChatGPT is confidential and whether Claude is safe compare the plans.

Laws on AI in hiring and HR decisions

These laws are about AI that helps decide who gets hired, promoted or fired. Drafting a job ad isn't covered. Status as of 16 October 2026:

At the federal level, the EEOC reportedly removed its AI guidance documents in January 2025, but the anti-discrimination laws behind them (Title VII, the ADA and the age discrimination law) haven't changed. Many 2026 articles still give Colorado's old June 2026 date and the EU's old August 2026 date; both are out of date.

The rules on employee data

• HIPAA usually isn't the reason. The US health department says its Privacy Rule "does not protect your employment records, even if the information in those records is health-related."
• The ADA is. Medical information from disability-related questions or exams must be kept as "a confidential medical record," shared only in limited cases.
• State privacy and discrimination laws add their own duties, such as California's.
• In Europe, GDPR covers employee data and gives people rights around decisions made only by automated means.
• Your own policies and contracts may promise employees more than the law does.

The main types of HR AI tools

Before buying a hiring tool, ask the vendor for its bias audit, what data it trains on, and how a person can review its decisions.

What can go wrong

• Bias claims. In Mobley v. Workday (N.D. Cal., No. 3:23-cv-00770), a court let age discrimination claims for applicants over 40 go forward as a collective action in May 2025, and a June 2026 order let California and disability claims continue. There's no ruling on the merits yet.
• Wrong policy answers. Microsoft found during its own rollout that its HR agent "sometimes defaulted to policies related to the US or other unrelated countries." In 2024, a Canadian tribunal held Air Canada responsible for its chatbot's wrong answer on a refund policy. An AI that answers employees needs to show where the answer came from.
• Confidentiality. An employee's health or discipline details pasted into a consumer chatbot may be kept, reviewed or used for training.

A checklist for HR teams

1. Write an AI policy: which tools, which plans, what may never be pasted.
2. Use business plans that don't train on your data, never personal accounts.
3. Keep medical, disciplinary and pay records out of general chatbots.
4. For hiring tools, check the audit, notice and record-keeping rules where you hire.
5. Keep a person in charge of every decision about a candidate or employee.
6. Check every policy answer against the handbook before you send it.
7. Review job ads for biased wording, whoever wrote them.

Prompts that need no employee data

• "Write a job ad for a part-time bookkeeper at a 20-person design studio. Plain, friendly, under 250 words, no jargon."
• "Suggest eight structured interview questions for a customer support lead, each with what a strong answer shows."
• "Draft a remote work policy for a small company: who qualifies, how many days, how to ask. Mark anything I should check with a lawyer."
• "Write an announcement that open enrollment for health insurance runs 1 to 15 November, with three things employees should do."
• "Turn these notes into a first-week onboarding checklist for new hires: [your notes, no names]."
• "Review this job ad for wording that could put off older applicants, women or people with disabilities: [ad text]."

Answering from your own HR files

Many HR questions are about your own documents: what the current handbook says about carry-over days, what an offer letter promised, which policy replaced which. Those files are full of the personal details you shouldn't paste into a chatbot.

Citenook is a Mac app that answers from folders of handbooks, policies, letters and notes without uploading them. With Apple Intelligence or a model you download, nothing leaves your Mac, and every answer links to the passage it came from. We tested it on four made-up files: a 2025 and a 2026 handbook with different carry-over rules, an offer letter and meeting notes.

It found both rules and said the newer handbook's 10 days apply. It left out one detail, that carried-over days must be used by 31 March, which is right there in the highlighted source. That's why it shows the source: HR can check before replying.

Be clear about its limits: Citenook doesn't screen resumes, rank candidates, run payroll or connect to your HR system. It's for one person on a Mac, not an employee help desk. It's free for 30 days, then from $9.99 a month. See privacy and security for what goes where.

Questions

Sources, checked 16 October 2026: NYC Department of Consumer and Worker Protection on automated employment decision tools; California Civil Rights Council AI employment regulations; California Privacy Protection Agency ADMT rules; Texas HB 149 (TRAIGA); Colorado SB 26-189; European Commission AI Omnibus and AI Act Annex III; HHS on employers and health information; EEOC guidance on medical inquiries; SHRM State of AI in HR 2026; Gartner October 2025 and July 2026 surveys; Workday and Paradox; Lattice pricing; Microsoft Inside Track on its HR agent rollout. Illinois laws, the EEOC guidance removal and Mobley v. Workday as reported by law firms naming the statute or docket. Citenook screenshot from our own test with made-up sample files.

Related: Is ChatGPT confidential? · Is Claude safe? · ChatGPT for lawyers