Responsible AI in the Workplace Is a Shared Job: Why HR and IT Must Govern It Together

A five-move, 90-day plan for turning unmanaged AI use into accountable AI use.

Responsible AI in the workplace does not begin with a software purchase. It begins with a decision about who owns the risk, and in most organizations that decision has not been made. Employees have filled the gap on their own. More than half of U.S. employees (52%) now use AI in their role, yet one in five cannot say whether their employer has formally integrated AI tools at all.^[1]

The argument here is simple. AI governance fails when it is handed to a single department. It works when HR, IT, and leadership own it together, and one focused quarter is enough to put that ownership in place.

Key takeaways

• AI use at work is already mainstream. The open question is who is accountable for it.
• HR owns workforce risk. IT owns technology risk. Leadership owns the final call.
• Five moves cover the first 90 days: assess, write policy, train, form an AI committee, and establish oversight.
• Clarity accelerates adoption. Employees with a clear AI integration plan are engaged at 43%, compared with 28% for those without one.^[2]

Is AI already being used in your organization without a policy?

Almost certainly. Individual use has outpaced formal programs from the start. In Microsoft and LinkedIn’s 2024 Work Trend Index, 78% of AI users said they were bringing their own AI tools to work.^[3] Two years later, Gallup reports that 47% of U.S. employees say their organization has integrated AI tools, a six-point jump in a single quarter, while individual use has already crossed 50%.^[1]

The space between those numbers is where unmanaged risk lives. At Samsung in 2023, engineers pasted confidential source code and internal meeting content into ChatGPT to work faster, and the company restricted generative AI on company devices.^[4] Nobody set out to leak anything. The failure was the absence of a rule, not the presence of a bad actor.

What are the real risks of ungoverned AI at work?

Five risks show up repeatedly. AI can reintroduce bias because it repeats the patterns in its training data. It produces fluent, confident answers that are sometimes wrong. Every unreviewed tool is a place where employee and client data leaves your control. Employment law did not pause for AI; SHRM reports that 19 of the most populous states have enacted AI rules related to employment, and 57% of HR professionals in those states are unaware of them.^[5] And accountability never transfers to the tool. Bias, compliance, and accountability are workforce risks, which is exactly why IT cannot carry AI governance alone.

Who should own AI governance, HR or IT?

Both, with leadership as sponsor and final decision-maker. The division of labor is clean once you name it: HR owns workforce risk and IT owns technology risk.

Most organizations have not drawn that line: SHRM found that 52% do not involve HR in AI strategy at all.^[5] Technology governance without HR produces rules employees never absorb, while HR governance without IT produces rules no system can enforce. The NIST AI Risk Management Framework makes the same point, calling for defined accountability and engagement across the organization.^[6]

How to build responsible AI in the workplace in 90 days

One quarter is enough to move from unmanaged use to accountable use when the work is sequenced and every move has an owner.

1. Assess what is already happening

You cannot govern what you cannot see. Answer four questions: who is using AI, which tools, what internal data goes in, and how the output is used. An anonymous employee survey surfaces honest answers, and leader interviews surface the use cases that matter. HR designs the questions and protects trust; IT validates the answers against sign-in activity and installed applications.

2. Write a plain-language acceptable use policy

Cover seven elements: purpose and scope, approved versus prohibited tools, data and privacy rules, acceptable use cases, human oversight, incident reporting, and a review schedule. Keep it short enough that employees will open it. HR owns expectations and enforcement; IT owns the approved tool list and data rules. SHRM found that only about a quarter of organizations with AI policies believe those policies are future-proof, so build the review date in from day one.^[5]

3. Train people, then track the results

Training is where policy becomes behavior. Cover what good and bad use looks like, how to write a useful prompt, what never goes into an AI tool, and how to spot confident nonsense before it reaches a client. Then measure it: completion rates show who attended, and usage data shows whether behavior changed.

4. Form an AI committee

Recruit AI enthusiasts from across the business, name a leader, and seat HR, IT, and leadership at the table. The committee vets new use cases and pressure-tests the policy against real work. Give it a name people remember; a committee employees want to join does more for adoption than any memo.

5. Establish ongoing oversight

Oversight closes the loop: monitor AI performance and emerging risk, manage incidents, and require human review of high-impact decisions such as hiring, pay, and discipline. Ask IT for three recurring reports: an AI tool usage report, a shadow AI report, and adoption metrics. Review them with the committee on a fixed schedule.

What happens after the first 90 days?

The calendar keeps the foundation standing. Refresh the AI inventory quarterly, review the policy twice a year, build AI training into onboarding, and reassess whenever a major tool, vendor, or regulation changes. Treat governance as a one-time project and you end up governing last year’s tools.

Does AI governance slow adoption down?

The evidence points the other way. Gallup’s 2026 data shows employees with a clear AI integration plan are engaged at 43%, compared with 28% without one. When frequent use, a clear plan, and active manager support are all present, engagement reaches 53%.^[2] What slows people down is uncertainty about what is allowed, and clear rules remove it.

The bottom line

AI is already inside your organization; the open question is whether its use is accountable. Assign the risks, give leadership the final word, and spend the next 90 days on five deliberate moves. For a closer look at executive ownership, read Who Is Accountable for AI Risk in Your Business?

Advanced Business Solutions helps organizations in Louisville, Lexington, and across Kentucky build the assessment, policy, training, and oversight behind responsible AI. See how our AI Enablement practice moves teams from unmanaged use to accountable use.