AI TOOL INVENTORY Tool Name: ________________________ Vendor: ________________________ Category: [ATS | HRIS | Benefits | LMS | Payroll | Analytics | General AI | Other] AI Features: ________________________ Data Accessed: [Public | Internal | Confidential | PII] Users: [Department/Role list] Approved? [Yes | No | Pending Review] DPA in Place? [Yes | No | N/A] Last Security Review: ________ Employment Decision? [Yes | No] Bias Audit? [Yes | No | N/A] Owner: ________________________ Notes: ________________________

MINIMAL RISK (Standard oversight) Meeting scheduling, email drafting assistance, document formatting, internal search Governance: General acceptable use policy Review: Annual LIMITED RISK (Enhanced oversight) Report generation, data summarization, chatbot for general HR Q&A, learning recs Governance: Approved tool list + usage logging Review: Semi-annual HIGH RISK (Strict oversight) Resume screening, candidate ranking, performance analysis, compensation modeling, promotion recommendations, workforce planning Governance: Bias audit + human-in-the-loop + adverse impact monitoring + legal review Review: Quarterly UNACCEPTABLE (Prohibited) Automated termination decisions, emotion detection for evaluation, social scoring, subliminal manipulation of employees Governance: Banned. No exceptions.

1. PURPOSE & SCOPE Why this policy exists, who it applies to, what "AI" means in this context 2. DEFINITIONS AI, ML, LLM, automated decision tool, AI-assisted vs AI-automated 3. ACCEPTABLE USE Approved tools, approved use cases, required disclosures 4. PROHIBITED USE Specific prohibitions with examples (e.g., PII in public tools) 5. DATA HANDLING Classification tiers, which data goes where, data retention, deletion requirements 6. PROCUREMENT Approval process, security requirements, bias audit requirements 7. GOVERNANCE Committee structure, RACI, decision authority 8. COMPLIANCE Applicable laws, notification requirements, audit obligations 9. ENFORCEMENT Violation process, consequences, reporting 10. REVIEW & UPDATE Review cadence, update triggers, approval workflow, version history

R=Responsible A=Accountable C=Consulted I=Informed Tool Selection & Approval HR Ops: R IT: C Legal: C CHRO: A Biz Unit: I Data Access Decisions IT: R HR Ops: C Legal: C CISO: A Biz Unit: I Bias Audit HR Ops: R DEI: C Legal: C CHRO: A Vendor: I Incident Response IT: R HR Ops: R Legal: A CHRO: I Comms: C Policy Exceptions HR Ops: R Legal: C IT: C Committee: A Requester: I Vendor Management Procurement: R IT: C Legal: C HR Ops: A Finance: I Employee Communication HR Ops: R Comms: C Legal: C CHRO: A Managers: I

EMPLOYMENT LAW □ Adverse impact analysis performed? □ Four-fifths rule compliance verified? □ ADA accommodation process intact? □ State AEDT notification requirements met? □ EEOC 2023 guidance pulled — but Title VII/ADA/ADEA still apply? □ State AEDT laws: CA CRD, CO AI Act, TX HB 149? □ FCRA compliance? (see Eightfold AI class action, Jan 2026) PRIVACY LAW □ Data processing agreement (DPA) executed? □ Data retention/deletion terms defined? □ Cross-border data transfer addressed? □ Biometric data collection (if any) consented? □ Employee monitoring laws satisfied? □ CA CRD 4-year recordkeeping requirement met? CONTRACT TERMS □ Vendor liability for AI errors defined? □ Indemnification for bias claims included? □ Right to audit vendor’s AI systems? □ Termination rights if compliance fails? INTELLECTUAL PROPERTY □ Ownership of AI-generated output clear? □ Vendor training on your data restricted? □ Confidentiality of inputs guaranteed? LIABILITY & INSURANCE □ E&O / cyber insurance covers AI use? □ EPLI updated for AI-related claims?

EXECUTIVE TRAINING (60 min, semi-annual) • AI risk landscape and liability • Governance committee role and authority • Board reporting requirements • Strategic AI investment decisions • Regulatory forecast MANAGER TRAINING (90 min, quarterly) • Full policy walkthrough • How to handle team AI questions • Identifying unauthorized AI use • Exception request process • When to escalate • Assessment: scenario-based quiz EMPLOYEE TRAINING (45 min, annual) • Approved tools and use cases • Data classification quick reference • What NOT to put into AI tools • Disclosure requirements • How to request new tools • Assessment: pass/fail quiz SPECIALIST TRAINING (varies) Recruiters: AI in hiring compliance HRIS team: AI feature configuration IT: AI security monitoring

LEVEL 1: Education First-time, low-risk violation Action: Manager conversation, policy review, document in file (non-disciplinary) // Most violations fall here LEVEL 2: Formal Warning Repeat violation or medium-risk first offense Action: Written warning, mandatory training, usage monitoring for 90 days LEVEL 3: Disciplinary Action Serious or willful violation Action: Suspension of AI tool access, formal disciplinary process, potential termination for egregious cases // Consult ER and legal before action LEVEL 4: Incident Response Data breach or compliance violation Action: Immediate containment, legal notification, regulatory reporting if required, post-incident review, policy update

ANNUAL AI POLICY REVIEW Review Date: ________ Version: ___ 1. REGULATORY SCAN □ Federal law changes (EEOC, FTC, DOL) □ Expected federal AI legislation (late 2026/early 2027) □ State law changes (CA CRD, CO AI Act, TX HB 149, etc.) □ International requirements (EU AI Act, etc.) □ Industry-specific guidance & class action trends 2. INCIDENT REVIEW □ All AI incidents cataloged and analyzed □ Root cause: policy gap vs. compliance gap □ Remediation actions completed 3. TECHNOLOGY REVIEW □ AI tool inventory updated □ New vendor AI features assessed □ Risk classifications current 4. STAKEHOLDER INPUT □ Employee feedback collected □ Manager feedback collected □ Exception log reviewed for patterns 5. POLICY UPDATES □ Sections requiring revision identified □ Drafts reviewed by legal □ Governance committee approved □ Communication plan for changes □ Training updated to reflect changes APPROVAL CHRO: ________ Date: ________ Legal: ________ Date: ________ CISO: ________ Date: ________