RopesTalk · Ropes & Gray LLP

AI at Work – Drafting an Effective and Compliant AI Workplace Policy

April 8, 2026·21 min·1 clip

Any bias embedded in an AI model used for resume screening or candidate evaluation becomes the organization's liability — even if a third-party vendor built the tool.

1. RopesTalk's "AI at Work" podcast series examines a specific pressing question: whether and how employers should implement a dedicated AI workplace policy. 2. The episode features Jan Cormier and Greg Demers, partners in Ropes & Gray's employment practice, and Alyssa Horton, a partner in the asset management practice, as guests. 3. The episode's core thesis is that a well-crafted AI policy creates employee accountability, provides a defensible compliance framework, and forms the foundation for enforceable training. 4. Greg Demers opens by noting that a comprehensive AI policy signals the organization takes responsible AI use seriously, and that without a clear policy, meaningful training and credible enforcement are both impossible. 5. Alyssa Horton identifies investment advisors as a particularly high-risk category, citing a concrete scenario: an analyst submitting material non-public information (MNPI) about a portfolio company to a public AI tool, triggering insider trading liability, breach of fiduciary duty, and SEC enforcement. 6. The SEC, Horton notes, views AI governance as a direct extension of an investment advisor's compliance obligations, making this area one of active regulatory interest. 7. Definitionally, the speakers distinguish between traditional AI — algorithms performing tasks like resume screening or pattern recognition — and generative AI, which creates new content from prompts, each carrying different regulatory profiles. 8. Open generative AI tools (accessed via personal or non-enterprise accounts, where inputs may train the underlying model) are contrasted with enterprise-licensed closed tools that contractually prevent model training on company data and restrict third-party access. 9. Governance structure is discussed: an AI committee or legal and compliance function should oversee AI use, employees should require clearance before using any tool outside a pre-approved list, and vendor contracts should be reviewed to understand how inputs are used. 10. Protected categories that must be kept out of AI tools — particularly open tools — include employee personnel files, performance reviews, medical information, accommodation requests, investigation files, NDA-covered information, trade secrets, and privileged communications. 11. For investment advisors, protected information also includes portfolio investment details, information about prospective investments, investor data, and counterparty information. 12. Jan Cormier emphasises that AI can perpetuate and amplify bias, creating Title VII, ADA, and ADEA liability; she states explicitly that bias embedded in a third-party vendor's model becomes the organisation's liability. 13. Specific prohibitions recommended include: using AI as a significant factor in hiring, promotion, compensation, discipline, or termination decisions; using AI to analyse witness statements in investigations; and any use that could be considered discriminatory or harassing. 14. Greg Demers surveys the patchwork of state and local law: NYC Local Law 144 requires bias audits of automated employment decision tools; Illinois has the Artificial Intelligence Video Interview Act; Colorado has passed algorithmic discrimination legislation. 15. The EEOC has issued guidance clarifying that employers bear liability for AI-driven discrimination under federal anti-discrimination law, even when the AI tool was built by a third-party vendor. 16. Multi-jurisdiction employers — the example given is a firm headquartered in New York with offices in California, London, and Hong Kong — must establish baseline standards satisfying the most stringent applicable requirements, with jurisdiction-specific adaptations. 17. AI transcription is described as a "minefield": the recommended baseline is consent from all meeting participants, a review process for transcript accuracy, defined storage and access controls, and categorical exclusions for interviews, performance evaluations, and meetings involving privileged communications. 18. Safe use cases identified include research, fact-checking, brainstorming, summarising industry trends, and drafting first versions of documents like job descriptions or internal communications — always subject to human review and validation before use. 19. Compliance professionals, employment lawyers, HR leaders, and investment advisors navigating AI adoption will find actionable policy guidance in this episode. 20. Listeners looking for technical AI explanations, product demonstrations, or non-legal content will find this episode too narrowly focused on legal risk management.

As heard by us

A practical guide to drawing enforceable boundaries around workplace AI.

AI at Work treats workplace AI policy as something managers and counsel actually have to write down, not a shiny side topic. It is strongest when it gets specific: data breaches, discrimination claims, IP disputes, and the line between AI a worker can use and AI that should stay…

Read the full review in PlayNext →

Why you'd press play

You need a workplace AI policy before AI starts shaping HR and talent decisions.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from RopesTalk