Where Is Your HR Team on AI, and What Should You Do at Each Stage?

Small HR teams usually sit at one of four stages: unmanaged, guarded, repeatable or measured. Find yours with ten yes or no questions, then do one thing: at unmanaged, set rules; at guarded, pilot one task; at repeatable, document and train; at measured, review results against costs and risks every quarter.

I am Mac Malbrough. I hold a J.D. and an MS-HRM, I am not an attorney, and this is general information, not legal advice. This guide is for HR leads, owners and managers of 10 to 150 person organizations who want to know where they stand on AI and what to do next. The stages are my own framework, built from watching how small teams actually adopt tools, and I do not treat any maturity model, mine included, as a substitute for your judgment about your own work.

Why use stages at all?

Because “should we use AI in HR” is too big a question to answer, and “what is the next sensible step from where we are” is a question you can answer this week. Stages give you a shared vocabulary, a way to see that others are not far ahead and a reason to resist two common pressures: the pressure to do nothing because the topic feels risky, and the pressure to buy a platform because a vendor says everyone else has.

What are the four stages?

1. Unmanaged: people use AI tools on their own. No shared rules, no record of what is used, uneven quality and unknown data exposure.
2. Guarded: rules exist. You have a one-page policy, banned inputs and approved tools, and use is limited to low-risk drafting.
3. Repeatable: a few tasks run on shared, documented prompts with named owners, a review step and a log. Staff are trained.
4. Measured: you track time saved, error rates, complaints and costs, review them each quarter and retire what does not pay off.

Notice that none of the stages is “AI makes the decisions.” In HR, a person remains accountable for every decision about people, at every stage.

Which stage are you at? A ten-question check

Answer yes or no. Count the yes answers.

1. Do we know which AI tools our people use for HR work?
2. Do we have a written rule on what must never be pasted into a tool?
3. Does every user know that rule?
4. Do we have an approved list of tools?
5. Have we reviewed the data terms of those tools?
6. Do we have shared prompts for at least three tasks?
7. Does each prompt have an owner and a review step?
8. Do we keep a log of use and review?
9. Have we trained staff on the rules and the prompts?
10. Do we measure results and review them at least quarterly?

Zero to two yes answers is stage one. Three to five is stage two. Six to eight is stage three. Nine or ten is stage four. The score is a prompt for a conversation, not a grade.

What should you do at stage one?

Stop the drift. Find out what people are using by asking, without blame. Write a one-page rule covering banned inputs, approved tools and who to ask. Share it and explain the why. Pick one person to own the topic. Do not buy a platform yet. Your goal is to move from invisible use to visible, governed use within 30 days. My starter plan includes a one-page policy outline you can adapt.

What should you do at stage two?

Run one pilot. Pick a single task with low risk and clear value, such as drafting job descriptions or summarizing anonymized survey comments. Name an owner, write the prompt, set a review step and run it for 60 days. Track the minutes saved and the edits needed. At the end, decide whether to adopt, change or drop it. One real pilot teaches more than a year of reading. See my guide on a safe prompt library for HR tasks for how to structure it.

What should you do at stage three?

Document and train. Turn the pilots that worked into standard procedures with owners and versions. Train every person who touches them, and refresh the training quarterly. Add a log, because a decision about a person may someday need proof that a human reviewed the work. This is also the stage to check your legal exposure: California’s civil rights regulations on automated decision systems apply to tools used in employment decisions, and SB 947 requires human corroboration before discipline or termination, effective July 1, 2027. See my guide on SB 947.

What should you do at stage four?

Review results against costs and risks every quarter. Look at time saved, error rates, employee complaints, vendor costs and any incidents. Retire tools that do not pay off. Test for bias on any tool that touches hiring or pay. Reassess your rules when a tool’s terms change. And ask the question many teams skip: are we redesigning the work, or are we only speeding up the old work? Sometimes the best gain comes from removing a step, not automating it.

How do you move from one stage to the next without stalling?

Set a 90 day target and one measurable sign that you have arrived. For stage one to two, the sign is a written rule that every user has read and acknowledged. For stage two to three, it is a prompt with an owner, a review step and a log entry for every use. For stage three to four, it is a quarterly review with a decision to keep, change or retire each use. Teams stall when the target is vague, such as “be more advanced on AI.” They move when the target is a document, a date and a person.

What does each stage cost and save?

Stage one costs nothing visible and carries hidden risk. Stage two costs a few hours to write rules and one owner’s attention. Stage three costs training time and a small amount of upkeep each month, and it usually saves the most per hour invested because the gains repeat. Stage four costs the time to measure and review, and it pays off when the use is large enough that a small percentage improvement matters. Estimate your costs in hours before you decide to move up, and compare them with the hours you expect to save, using your own numbers, not a vendor’s.

Why might staying at stage two be the right answer?

Because maturity is not a race. A 20 person employer with no payroll complexity may get most of the value from a few guarded drafting tasks and gain little from a measured program. The cost of governance, training and monitoring is real. Move up a stage only when the use is large enough to justify the effort or the risk is large enough to demand it. Staying put is a decision, not a failure, as long as the rules at your stage are followed.

What guardrails apply at every stage?

• A person decides every hiring, pay, discipline and termination matter. Tools may draft or summarize.
• No confidential employee data goes into a general-purpose tool.
• Tools that touch hiring are tested for bias and covered by the civil rights rules.
• Employees are told, in plain language, how AI is used on matters that affect them.
• If a tool displaces jobs, California’s layoff notice rules may apply; see my guide on SB 951.

How do you talk to employees about this?

Be direct. Say what you use AI for, what you do not use it for, who is accountable and where to raise a concern. Do not promise that jobs are safe, and do not predict that they are not. My piece on what to say to employees who fear AI will replace them offers wording that stays honest.

How does the UHR handbook template help you move up a stage?

The problem for most small teams is that AI use began informally, and nobody wrote the rules at the stage they are really in. Moving from unmanaged to guarded starts with a written policy. The California employee handbook template ($149) gives you the editable policy structure where your AI use rules belong, alongside the California clauses they must respect. Once the rules are written, you can measure whether people follow them, which is what the later stages require.

What should you do this week?

Answer the ten questions and write your stage and the one action that fits it on a single page. Share it with whoever owns HR. If you want a second set of eyes on where you stand and what to do next, the HR compliance check-up includes an AI review, and fractional HR support can run the next step with you.

Related reading: a green, yellow and red map of where AI helps HR.

Sources

• California SB 947 (2026), read on the California Legislative Information site
• California Civil Rights Department, automated decision system regulations

McKinley holds a J.D. but is not a licensed attorney. Articles here are general information, not legal advice. For your specific situation, talk with an employment attorney.

Data current as of November 2026. Sources are linked where each figure appears.