Cyber Academy Webinar: Good AI Governance: How to Avoid Risks and Pitfalls

In this Cyber Academy webinar, Constangy Cyber Team partner John Keir and Mari DeGrazia, Director of Digital Forensics and Incident Response at IDX, explain how employers can build governance programs for artificial intelligence used across the employment lifecycle. They cover the federal anti-discrimination framework that applies to AI hiring tools, the growing patchwork of state and local AI employment laws, lessons from current litigation involving AI screening vendors, and the risks of employees entering sensitive information into generative AI tools. They also outline practical steps employers can take now to strengthen AI governance.

Where Does AI Already Sit in the Employment Lifecycle, and Why Does an AI Inventory Matter?

John walks through how AI is often already in use across recruiting, screening, assessment, hiring, and workforce management. Sometimes it has been switched on inside HR platforms without legal or management knowing. He and Mari discuss why a complete inventory of AI tools is the starting point for effective governance. They also explain why procurement needs to be connected to legal and privacy teams before new tools are adopted.

How Do Existing Federal Laws Apply to AI Used in Employment Decisions?

The presenters examine how Title VII, the ADA, and the ADEA apply to AI screening and assessment tools, and how the federal enforcement posture has shifted. John also addresses the push for federal preemption. He covers two non-discrimination theories employers should watch: the Fair Credit Reporting Act as applied to talent intelligence vendors, and the National Labor Relations Act as applied to algorithmic workplace monitoring.

Which State and Local AI Employment Laws Should Employers Be Tracking?

John reviews the expanding patchwork of state and local requirements, with a focus on New York City, California, Illinois, and Colorado. These include bias audits, notice and consent, record keeping, and human review of adverse decisions. He explains why a strong privacy program can make AI governance easier, and how employers with a global footprint should think about the EU AI Act.

What Should Employers Know About AI Screening Vendors and Algorithmic Bias?

The speakers explain how algorithmic discrimination can arise through training data, proxies for protected traits, and feedback loops, and why these problems are hard to see from the employer’s side. John discusses what recent litigation involving AI screening vendors shows about employer exposure. He also covers what a recent discovery ruling suggests about how to conduct bias testing, and which questions employers should ask AI hiring vendors.

How Should Employers Govern Employee Use of Generative AI Tools?

John and Mari discuss where information goes once employees enter it into generative AI tools, and why HR data is an especially sensitive category. They describe what an effective employee AI use policy should prohibit and permit, and how to support it with training and technical controls. They also explain how anchoring a governance program to a recognized framework can help when regulators, plaintiffs, or insurers ask questions.

Key Takeaways for Employers

• Build and maintain a current inventory of the AI tools used in hiring and employment decisions, including AI features enabled inside existing HR platforms.
• Involve legal in procurement so that vendor terms, indemnities, training data, and testing practices are reviewed before an AI tool is deployed.
• Conduct bias testing under the direction of counsel to help protect the analysis under attorney-client privilege.
• Make human review meaningful by naming the reviewer, giving that person more than the AI score, and requiring an independent basis for each adverse decision.
• Adopt a generative AI use policy that names approved tools, prohibits entering confidential or personnel data into consumer tools, and gives employees a safe way to report mistakes. Reinforce it with training that uses real examples.
• Monitor federal, state, and local AI developments, and align record retention practices with them.

Related Resources

• Constangy Cyber Advisor: AI regulation in flux: What businesses should do
• Constangy Cyber Advisor: AI monitoring in the workplace
• Constangy's AI Practice

Webinar Speakers

John Keir
Partner
John advises organizations on privacy, cybersecurity, and artificial intelligence governance, including global data protection frameworks, incident response, privacy program governance, and emerging AI risk management. Before joining Constangy, he served as Lead Counsel for Data Privacy & Security at Intercontinental Exchange (ICE), the parent company of the New York Stock Exchange, where he directed global privacy and AI governance programs. He previously taught privacy, information security, and AI law as an adjunct professor at Emory University School of Law.

Mari DeGrazia
Director of Digital Forensics and Incident Response, IDX
Mari leads global forensic engagements involving ransomware, data breaches, intellectual property theft, and business email compromise. She has more than 20 years of IT experience and is a Certified SANS Instructor. She is also the author of a SANS course on applying AI and local large language models to digital forensics and incident response.