Your HR tech stack isn’t one system — it’s a constellation. Your HRIS (Workday, UKG, BambooHR) holds the employee master record. Your ATS (Greenhouse, Lever, iCIMS) holds candidate data. Your payroll system holds compensation history. Your benefits platform holds enrollment and claims data. Your LMS holds training records.

Data flows between these systems through integrations — file feeds, APIs, middleware like Workato or MuleSoft. The critical question: when an AI feature processes data, which system is the source of truth, and where does the AI output go? If your ATS AI scores a candidate, does that score feed back into the HRIS when they’re hired? Does the HRIS AI use that score for future decisions? These connections create invisible dependencies.

A classification model sorts things into categories. In HR, that means: qualified vs. not qualified (resume screening), high risk vs. low risk (flight risk flags), compliant vs. non-compliant (policy violation detection). Think of it as a very fast, very consistent rules-based sorter — except it learned the rules from data rather than having them written by a human. The danger: it may have learned rules you wouldn’t endorse, such as “candidates from certain schools are always qualified.”

Regression models output a number on a scale rather than a yes/no. In HR: attrition risk score (0–100%), engagement score prediction, time-to-fill estimates, compensation benchmarking. These are the models behind dashboards that show you risk heat maps and predicted outcomes. The key question: what’s the confidence interval? A model that says “72% attrition risk” but is only accurate plus or minus 30% is essentially guessing.

Natural Language Processing models analyze text. In HR: survey sentiment analysis (is this comment positive or negative?), resume parsing (extracting skills and experience from unstructured text), chatbot understanding (what is the employee asking?), job description optimization (flagging biased language). These range from simple keyword matchers to full LLMs. Ask your vendor: is this a keyword model or a language model? The difference in capability and cost is enormous.

Benefits recommendation: “Based on your profile, consider the HSA plan.” Learning paths: “Employees in similar roles took these courses.” Job matching: “Internal openings that match your skills.” These work like Netflix suggestions — they find patterns in what similar people chose and predict what you’d choose. The risk: if similar people historically made suboptimal choices (e.g., under-enrolling in benefits), the AI perpetuates that pattern.

When your vendor says their product “uses AI,” the AI can live in two very different places. Embedded AI means the AI model is built into the vendor’s own platform — they trained it, they host it, it runs inside their infrastructure. API-based AI means the vendor calls out to an external AI service (like OpenAI, Anthropic, or Google) every time the feature is used. Your data leaves the vendor’s environment, travels to the AI provider, gets processed, and the result comes back.

Think of it like catering: embedded AI is an in-house kitchen. API-based AI is ordering from an external restaurant. Both can serve food, but the supply chain, quality control, and liability are completely different.

When an AI feature processes an employee’s performance review, here’s what can happen. The text of the review leaves your HRIS. It goes to the vendor’s AI processing layer. If the vendor uses API-based AI, it travels to a third-party AI provider. The AI provider may store it temporarily for processing, or may retain it for model improvement unless you’ve opted out. The AI output (a sentiment score, a summary, a flag) returns to the vendor and appears in your dashboard.

At each hop, ask: Who can see this data? Where is it stored? How long is it retained? Is it used beyond this specific request? The answers often surprise even seasoned IT teams.

Training means your data is used to improve the AI model itself — it becomes part of the model’s learned patterns. This is a much bigger deal than inference. Inference means the AI processes your data to produce a result but doesn’t learn from it permanently. Most enterprise AI vendors promise inference-only, but verify this in writing. If your 10,000 employees’ performance reviews train a vendor’s model, that model now carries patterns from your workforce into every other customer’s predictions.

Traditional vendor lock-in is about data and workflows: your employee records live there, your processes depend on their UI. AI lock-in adds new layers:

Model dependency: The AI learned patterns from your data. If your vendor’s attrition model was tuned on 5 years of your workforce data, that tuning doesn’t transfer to a new vendor. You start from scratch.

Workflow embedding: Your approval chains, escalation paths, and exception processes now depend on AI predictions. “Flag employees above 80% attrition risk for a stay interview” — that workflow is meaningless without the model behind it.

Historical baseline: Your trend data, benchmark comparisons, and improvement metrics are all tied to that vendor’s specific model. A new vendor’s model will produce different scores for the same employees, breaking your historical continuity.

1. Own your data extracts: Negotiate contractual rights to export not just raw data but AI-generated scores, labels, and predictions in a standard format. If the AI tagged employees as “high flight risk,” you need those tags exportable.

2. Document the logic, not just the output: Require vendors to explain the key factors in their models. If their attrition model weighs “time since last promotion” heavily, you can rebuild that logic elsewhere.

3. Avoid proprietary metrics: If a vendor invents a “Talent Score” that only exists in their ecosystem, you’re locked in. Push for models that output industry-standard measures.

4. Build parallel processes: For critical decisions, maintain a human-driven backup process that doesn’t depend on any vendor’s AI. If the AI disappeared tomorrow, could you still run your operation?

Buy (Vendor Built-in): Use the AI features already in your existing platforms. Workday’s skills intelligence, Greenhouse’s resume scoring, UKG’s predictive analytics. Lowest effort, least control. The AI is a black box — you use it or you don’t.

Buy (Specialized Add-on): Purchase a dedicated AI product that integrates with your stack. Tools like Eightfold for talent intelligence, Textio for job posting optimization, or Paradox for conversational AI. More capability, more vendors to manage, more integration points.

Configure (DIY): Set up an AI tool yourself for specific HR use cases. A GPT-based assistant for HR policy Q&A, a workflow automation that uses AI for ticket routing, or a custom analytics dashboard with predictive elements. Most control, most effort, requires some technical capability.

Privacy regulations weren’t written for AI, but they apply directly. GDPR Article 22 gives individuals the right not to be subject to purely automated decision-making, including profiling, that significantly affects them. Employment decisions absolutely qualify. CCPA/CPRA gives California employees rights over their personal information, including the right to know what’s collected and how it’s used. State-level AI laws are accelerating — Illinois BIPA covers biometric data in video interviews, NYC Local Law 144 requires bias audits for automated employment decisions, and Colorado’s AI Act imposes obligations on “high-risk” AI systems, which include hiring tools.

The practical reality: if you have employees or candidates in multiple states or countries, you need a privacy architecture that meets the strictest applicable standard, not just your headquarters’ local law.

Right now, AI features are being activated across your HR tech stack — sometimes by vendors pushing updates, sometimes by well-meaning team members, sometimes by IT responding to executive requests. Without a comprehensive system map, you have no single view of where AI touches employee data, no way to assess cumulative risk, and no way to respond to an employee who asks “how is my data being used?”

This exercise creates that map. It should be owned by HR Operations and updated quarterly. It becomes your foundation for every AI governance decision, every vendor review, and every compliance audit. Think of it as your AI asset inventory — you can’t govern what you can’t see.

Step 1: List every system in your HR tech stack (HRIS, ATS, payroll, benefits, LMS, engagement, analytics).
Step 2: For each system, identify every feature marketed as AI, ML, “intelligent,” “smart,” or “predictive.”
Step 3: Fill in the template for each feature.
Step 4: Draw the data flow arrows between systems.
Step 5: Flag any feature where you can’t complete the template — those are your immediate action items.