AI in the workplace: a checklist for HR

Artificial intelligence has moved from pilot project to daily practice inside many HR departments. Resume screening, interview scheduling, video interview recording and notetaking, workforce analytics, and internal and external chatbots now routinely run on AI, often without a formal governance structure being put in place by the organization. Many of these tools arrive embedded in an existing Human Resources Information System (HRIS) or applicant tracking system update, which means HR may be using AI today without anyone having evaluated the privacy or cybersecurity implications of those tools.

That gap leads to real risk. Employment documents routinely include sensitive personal information, including Social Security numbers, government identification photos and numbers, health and health insurance information, background check results and financial data, including bank account numbers. Layering AI on top of that data creates new exposure under privacy and data security laws. For New Hampshire employers, understanding this exposure requires looking at both the state’s own privacy and security framework and the broader patchwork of AI employment laws taking shape nationally.

New Hampshire’s privacy and security framework

The New Hampshire Data Privacy Act (RSA 507-H) gives state residents rights over their personal data and imposes transparency, security and consumer-rights obligations on covered businesses. Notably, the Act’s definition of “consumer” excludes individuals acting in an employment context, so most employee and applicant data falls outside its direct reach. That carve-out does not, however, mean that employee data is unregulated.

New Hampshire’s breach notification statute, RSA 359-C:20, applies broadly to any business that owns or licenses computerized personal information about state residents, with no employment exclusion. A compromise of employee Social Security numbers, driver’s license numbers or financial account information through an AI vendor’s system could therefore lead to exposure under the law and trigger the same notification obligations as a breach of customer data, including notice to affected individuals and, in many cases, the Attorney General’s office.

New Hampshire has also enacted RSA 507:8-j, creating a civil cause of action for harm caused by fraudulent deepfakes. As AI-generated video and voice content becomes harder to detect, HR teams conducting remote interviews or processing identity verification should treat deepfake risk as a genuine hiring integrity issue, not a theoretical one.

New Hampshire does not currently have an overarching AI-specific law. Legislative proposals to create broader AI oversight, including a study commission and a state AI council, have been introduced, but so far New Hampshire’s enacted AI provisions focus on state government use of AI rather than private employer obligations.

The multistate patchwork employers cannot ignore

The absence of a New Hampshire AI statute does not mean the risk is absent, as many other states have begun to explicitly regulate the use of AI in the employment context. Illinois requires employers to notify applicants and employees when AI is used in hiring and other employment decisions and makes clear that AI-driven discrimination violates the state’s Human Rights Act. Colorado’s AI Act imposes obligations on employers deploying “high-risk” AI systems in employment decisions. New York City’s Local Law 144 requires an independent bias audit before an automated tool can be used to screen candidates. California’s new automated decision-making technology rules, phasing in through 2027, require notice and opt-out rights for AI-driven employment decisions.

Federally, the EEOC has confirmed that Title VII’s disparate-impact framework applies to AI hiring tools, and employers cannot point to a vendor’s design decisions to avoid liability.

Employers with a remote workforce, multistate operations or applicants located outside New Hampshire should treat these stricter regimes as the practical baseline, since a single applicant or employee in New York City or Illinois can trigger obligations.

Practical steps for HR and compliance teams

Inventory AI tools used across the employee life cycle, including features embedded in existing HR software that were never formally procured.

Request bias audit and validation documentation from vendors of any AI tool used to screen, rank, or score candidates or employees.

Provide clear notice to applicants and employees when AI plays a role in hiring, promotion, discipline or compensation decisions.

Update privacy notices, handbooks and consent forms to reflect AI-driven monitoring, screening and data processing.

Build data security requirements into AI vendor contracts, including breach notification timelines, data minimization commitments and audit rights.

Confirm two-party consent before using AI note-takers or call-recording tools, given New Hampshire’s wiretapping statute.

Establish cross-functional governance connecting HR, IT security, privacy compliance and legal before any new AI tool is deployed.

New Hampshire has not yet enacted an overarching AI-specific law, but employers should not mistake that gap for a green light. The state’s data breach notification statute already reaches employee data compromised through AI vendors, its deepfake law creates litigation exposure, and the broader patchwork of AI employment regulation across the country is converging on a consistent set of expectations: notice, bias testing, data security and documented governance. HR professionals who build these practices into their AI adoption process now will be far better positioned than those who wait for New Hampshire law to catch up.

Alex Intile is a member of McLane Middleton’s Cybersecurity and Privacy group. He can be reached at alex.intile@mclane.com.