NIST AI RMF for hiring and HR tech | what applies

How does the NIST AI RMF apply to AI in hiring and HR technology?

Your customer security review or procurement questionnaire now asks how AI in hiring is governed. The NIST AI RMF is voluntary and has no certificate. Your organization owns its controls, and only an independent auditor or assessor can issue a report on them. NIST does not validate or endorse any organization's use of the framework, so the useful answer is a documented profile of how your hiring tools are mapped, measured, managed and governed, with evidence you can show a buyer or regulator.

NIST gives the hiring use case a concrete shape. AI 100-1 Section 6 defines use-case profiles as tailored implementations of the framework's categories and subcategories for a specific setting, and it names a hiring profile as one example. A hiring profile starts from your own requirements, risk tolerance and resources, so it should list each AI tool in the hiring pipeline (resume screening, ranking, interview scoring, assessments) and record its intended purpose and the human decisions it feeds. Two state rules then set the boundaries. Colorado SB26-189 treats employment as a consequential decision, and from January 1, 2027 deployers must give consumers notice, a plain-language explanation within 30 days after an adverse outcome, and a way to request data correction and human review. Confirm with counsel whether your role makes you a deployer or a developer under that bill.

Texas Section 552.056 prohibits developing or deploying an AI system with the intent to unlawfully discriminate against a protected class, and it states that disparate impact alone is not sufficient to show intent. Your hiring profile should therefore hold evidence beyond outcome statistics: documented design choices, subgroup performance testing and a record of how adverse results were reviewed. Ask your HR technology vendors for the same evidence, and confirm which of these rules applies to your jurisdiction and workforce before you commit to a control design.

Employers, HR vendors and the rules that reach each

Employers that use AI screening, ranking or scoring tools in hiring are the deployers of those systems. Colorado SB26-189 lists employment among its consequential decisions, so an employer using AI to influence a hiring or promotion outcome should expect duties to apply from January 1, 2027. Those duties include telling consumers that the tool is in use, giving a plain-language explanation within 30 days after an adverse outcome, and offering a way to request correction of data and human review of the decision.

Notice: Candidates should learn that an automated tool contributes to the decision before the outcome is reached.
Explanation: The 30-day window after an adverse outcome means explanation records must be retrievable quickly, so ask the vendor what it logs.
Correction and review: Build a route for candidates to flag wrong input data and request a human reviewer.
Texas intent standard: Under Section 552.056, a plaintiff must show intent to unlawfully discriminate. The section says disparate impact alone is not sufficient to show that intent, but it does not remove other obligations.
Documentation: Keep records of which tools were used, for which roles, and how the employer reviewed their outputs.

Confirm with counsel which states and localities reach your hiring, including where candidates live, not only where the company is headquartered.",

How Workday applies the AI RMF in practice

Workday's documented use case is one vendor's account of how it applies the AI RMF to AI in employment decisions. The four cards below separate the partnership, the four functions it cites, its bias guidance and its product evaluation, so you can see which parts describe a process and which describe an outcome. Treat it as a reference point for your own design, not a template to copy.

Partnership with the Future of Privacy Forum

Workday worked with the Future of Privacy Forum on best practices for developers and deployers of AI in the workplace, informed by the AI RMF. The output is guidance addressed to both sides of the relationship: the vendor that builds the tool and the employer that deploys it. For a hiring team, the useful question is which obligations sit with the vendor and which stay with you as the deployer. Ask any HR technology vendor to show you how it splits those responsibilities in writing.

Map, measure, manage and govern

The use case calls on organizations to map, measure, manage and govern AI tools used in consequential employment decisions. Each verb maps to a core function of the AI RMF, so the list works as a checklist of what a hiring program needs to show. Check whether your vendor can tell you which tool outputs feed hiring decisions, how it tests those outputs and who owns the response when a result looks wrong.

Responsible AI guidelines and product risk evaluation

Workday's responsible AI guidelines and product risk evaluation map to the AI RMF. The guidelines set internal rules for building AI, and the product risk evaluation assesses specific tools before and after release. Ask vendors for the evaluation criteria and the records of past evaluations, since a policy statement alone does not show that a specific tool was tested against them.

Bias work drawing on NIST SP 1270

Workday's approach draws on NIST SP 1270, *Towards a Standard for Identifying and Managing Bias in Artificial Intelligence*. For hiring, this is where fairness testing belongs: how a tool performs across groups, which thresholds trigger review and how findings reach the people who can change the tool. Confirm which fairness metrics a vendor uses, which populations it tested, and whether results are available to your compliance team.

How a hiring AI program moves through the AI RMF functions

The sequence starts with Govern so that someone owns the hiring AI and its rules, then uses Map to define what the tool does to applicants, Measure to test it for bias and performance, and Manage to decide whether it goes live and how problems are handled. Each step leaves a record that an internal reviewer or outside assessor can inspect.

Set governance and ownership first
Before any model is tested, the organization sets its AI policy, names who is accountable for hiring AI decisions, and records the tool in an AI inventory. HR, legal, security and the business owner of each hiring workflow should each have a documented role. The output is an inventory entry for every hiring tool, including vendor-supplied features, with an accountable owner, the decisions it touches and the policy that governs it. The step is complete when someone outside the project team can find every hiring AI system and identify who answers for it.
Define the hiring context and intended purpose
Under Map, the team writes down what the system is for, such as screening resumes, ranking candidates or scheduling interviews, and what it must not do. It records the roles, job families, jurisdictions and applicant populations affected, and the business value the tool is expected to deliver. The team also lists who could be harmed by errors, including applicants with disabilities or from groups the tool may treat unevenly. The output is a context statement with an intended-use boundary and a list of affected applicant groups.
Map components, data and third-party models
Hiring tools often combine a vendor model, training or reference data, and the employer's own job criteria. The team maps each component, notes where the data came from, and identifies legal, privacy and intellectual property risks in each part. It also documents which parts the employer controls and which the vendor controls. The output is a component map with the data sources, model owner and known limitations for each element, which feeds later vendor review and contract requests.
Test for bias and performance before go-live
Under Measure, the team chooses metrics tied to the most significant mapped risks, such as selection rates across protected groups and accuracy of candidate ranking. It runs those tests on representative data, including applicants with disabilities where accommodations affect results, and checks that human reviewers interpret the outputs correctly. An independent reviewer may validate the method. The output is a bias and performance test report that states the metrics, the data used, the results, and the limits of the testing.
Monitor outcomes and collect applicant feedback
After deployment, the team tracks selection outcomes, error reports and drift in the tool's behavior, and it provides a channel for candidates to report problems or request review. Measure also covers whether the metrics still reflect the real hiring process after job requirements or applicant pools change. The output is a monitoring log with dated results, logged complaints and the follow-up on each one. The reader should confirm how often their own monitoring runs and who reviews it, since those details depend on the employer's volume and legal obligations.
Record the go or no-go decision
Under Manage, the accountable owner decides whether the system is cleared for use, cleared with conditions, or withdrawn. The decision draws on the Map context, the Measure results and any residual risks the team accepts. The team records which risks remain, who accepted them and what triggers a re-review. The output is a signed decision record that links to the inventory entry, the test report and the conditions attached to deployment.
Handle appeals, incidents and communication
When a candidate appeals a decision or a monitoring result shows a problem, the team follows a documented response path. It reviews the affected decisions, decides whether to pause the tool, and informs relevant parties, including applicants and the vendor where the tool is third-party. The team also updates the inventory, context and test records to reflect what it learned. The output is an incident file with the timeline, the root cause analysis, the corrective action and the notice sent, which becomes input to the next Govern review.

What to have in place before a customer or regulator review

A customer or regulator reviewing AI in hiring will ask for records, not descriptions. The six items below connect the AI RMF functions to the documents an assessor or buyer will request, and each card says how to check that the item exists and works.

AI inventory of hiring tools

List every tool that scores, ranks, screens, filters or recommends candidates or employees, including features embedded in an applicant tracking system or sourcing platform. For each entry, record the vendor, the version in use, the decisions it touches and the owner inside the organization. This is the starting point for the GOVERN 1 inventory and the MAP 1 context. To check it, pick one requisition and confirm that every tool used in its workflow appears in the list. Tools that appear in the list but not in the workflow are also a finding worth fixing.

Intended purpose and excluded uses

Write a short statement for each tool that names the job it performs, the candidate population it serves and the decisions it may inform. Add a separate list of uses the organization has ruled out, such as scoring protected characteristics, inferring traits from video or drawing conclusions from unrelated personal data. This maps to MAP 1 and MAP 3. To check it, compare the statement with how recruiters actually use the tool. Gaps between the written purpose and daily practice usually show up as the first question in a regulator review.

Bias and performance test records

Keep dated records showing which metrics were chosen for the most significant risks, why they were chosen, and what the results were for each relevant group of applicants. Selection rates, error rates and any accessibility-related outcomes belong here. These records carry the MEASURE 1 method choices and the MEASURE 2 evaluations. To check them, ask whether each metric was selected before results were known, whether a second reviewer validated the results, and whether the tests were repeated after the vendor changed the model.

Notice and explanation template

Prepare a notice that tells candidates and employees that an AI tool informed a decision, and a plain-language explanation that can be sent after an adverse outcome. Colorado SB26-189 sets a 30-day window for that explanation for deployers, starting January 1, 2027, when the employment provisions take effect. Draft both documents now so that legal review, recruiter use and candidate-facing text are settled before the rule applies. To check it, send the template to a sample of rejected candidates in a test environment and confirm the explanation names the factors and the next steps without exposing confidential model details.

Correction and human review procedure

Document how a person can ask for corrections to data used in a decision and request review by a human. Name the intake channel, the team that owns the request, the time allowed to respond and the escalation path when the reviewer disagrees with the tool. Colorado SB26-189 requires a way to request data correction and human review for consequential decisions, so the procedure must work in practice. To check it, submit a test request, follow it through to closure and confirm the outcome is logged under the MEASURE 3 end user appeal process.

Vendor contract terms for data and model changes

Confirm that contracts with hiring technology vendors require notice before material model or data changes, access to documentation on training data and testing, support for bias testing, and the right to obtain logs needed for reviews. Address data retention, deletion and whether candidate data may train the vendor's models. These terms support GOVERN 6 and MANAGE 3. To check them, ask the vendor for its most recent bias testing summary and its change notification process, and confirm the contract gives you the right to receive both on request.

In-house, vendor evidence or outside help: which path fits

This table compares three ways to run the NIST AI RMF for AI in hiring: an internal program, reliance on the hiring vendor's published evidence and contract terms, or an implementation partner who prepares systems and documentation. Read each row for when the path fits and what the employer still owns, because no path removes the employer's accountability for its own hiring decisions or the need for an independent auditor's report.

Path	When it fits	What the organization still owns
Run the AI RMF program in-house	Employer builds or heavily customizes its own screening or ranking models and has staff who can perform Map, Measure and Manage work for employment decisions	All four functions, the AI inventory, bias testing results, candidate notices, human review of adverse outcomes and sign-off on go or no-go decisions
Rely on the hiring vendor's evidence and contract terms	Employer buys a commercial hiring tool and needs to review the vendor's published governance material, testing summaries and data handling terms	Its own use context, MAP 1 and MAP 3 decisions, impact review for its applicant pool, monitoring of outcomes and any state notice or correction duties
Engage an implementation partner	Employer needs help preparing documentation, test plans, inventories, role definitions and evidence packs for a specific review or contract requirement	Control ownership, risk acceptance, policy approval and final decisions. The partner prepares systems and evidence but does not certify or issue reports
Independent auditor or assessor	Any time a customer, regulator or contract asks for a formal report or attestation of the program	Engagement scope and access to evidence. Note that NIST has no AI RMF certification, so an independent auditor's report is the only form of third-party assurance to request
Vendor published evidence alone	Employer only needs to show that it asked the right questions during procurement	Proof that the tool works for its own applicant population, which vendor documents rarely establish on their own
Contract terms to request	Any buying path, including where a vendor is a Workday-style provider with published guidelines	Written rights to bias test results, change notices, audit cooperation, data correction support and incident notice timelines the employer needs for state rules
Ask for in any quote	Before choosing an implementation partner for a fixed scope	Named deliverables, which AI RMF categories are covered, who performs bias testing, what evidence is handed over and who approves it

Where hiring AI programs stall or overreach

Employers and HR technology vendors tend to stumble in the same few places: reading NIST material as a rulebook, describing the framework as a credential, and misreading state employment rules. Each card names one of these missteps and the check that prevents it, so the program stays grounded in what the framework and the statutes actually require.

Treating the profile as a checklist

Teams often copy the hiring profile's suggested actions into a spreadsheet and mark them complete one by one. NIST says the AI RMF is neither a checklist nor an ordered set of steps, and the Playbook says the same of its suggested actions. Organizations choose which categories and subcategories fit their hiring tools, risk tolerance and resources. Avoidance step: write down which subcategories apply to each hiring tool, why the others do not, and who signed off on that scope.

Claiming NIST certification

Some vendors describe their hiring product as NIST certified or NIST accredited after adopting the framework. No AI RMF certification exists, and NIST does not validate or endorse any organization's use of the framework. Procurement teams may ask for proof and receive a marketing claim instead. Avoidance step: describe the work as alignment with the AI RMF, and back it with a documented profile, mapped evidence and, where a buyer asks for independent assurance, a report from an assessor that the organization selected.

Assuming Texas intent rules remove disparate impact review

Texas Section 552.056 bars developing or deploying an AI system with the intent to unlawfully discriminate against a protected class, and it says a disparate impact is not sufficient by itself to show that intent. Some teams read this as permission to skip outcome testing by selection rate. The statute sets an intent standard, but the MEASURE and MANAGE work still helps show that intent was absent and that harmful bias was found and handled. Avoidance step: keep subgroup outcome testing in place for each hiring stage and record the response to any gap, whatever the intent analysis concludes.

Missing Colorado notice and correction duties

Colorado SB26-189 covers employment among consequential decisions. From January 1, 2027, deployers must give consumers notice, provide a plain-language explanation within 30 days after an adverse outcome, and offer a way to request data correction and human review. Hiring teams that wait until the deadline often find their applicant portals, vendor contracts and reviewer roles cannot support these steps. Avoidance step: ask each hiring vendor now whether it can produce adverse outcome explanations, accept correction requests and route cases to a human reviewer, and confirm the steps with counsel.

Questions employers and HR vendors ask about the NIST AI RMF

Is the NIST AI RMF certifiable?

No. The NIST AI RMF is a voluntary framework and there is no certification, accreditation or conformity assessment program for it. NIST states that it does not validate or endorse any individual organization or its approach to using the framework. An organization can say it follows the AI RMF and show its documentation, but no body issues an AI RMF certificate. If a customer or auditor asks for independent assurance over AI controls, that comes from a different standard or from an independent assessor, and the report is issued by that assessor, not by DeployOpen. DeployOpen prepares systems, records and evidence for an assessment but does not issue reports or certificates.

Does Colorado require employers to use the NIST AI RMF?

Colorado's SB26-189 covers employment among its consequential decisions, and the obligations it sets for deployers, including notice, a plain-language explanation within 30 days after an adverse outcome, and a way to request data correction and human review, apply from January 1, 2027. The bill summary does not require the NIST AI RMF as such, so employers should read the statute and confirm with counsel what it expects. A framework like the AI RMF can still help organize the risk assessment, documentation and monitoring work behind those duties. Confirm the current text and any rulemaking with the Colorado General Assembly before relying on any reading.

What does a hiring profile contain?

A use-case profile, as described in Section 6 of NIST AI 100-1, applies the framework's functions, categories and subcategories to a specific setting. The framework gives a hiring profile as one example, built from the organization's requirements, risk tolerance and resources. In practice, a hiring profile usually records the intended purpose of each screening, ranking or interview tool, the job-related criteria it uses, the groups it could affect, how its outputs are tested for disparate performance, who reviews adverse outcomes, and how candidates can appeal or request correction. The AI RMF Roadmap encourages organizations to write profiles like this and share them. Treat the profile as your own working document, tailored to your tools and jurisdictions.

Can we apply the NIST AI RMF ourselves?

Yes, in principle. The AI RMF is free to read, and NIST's Playbook offers suggested actions, documentation prompts and references for each subcategory, though NIST says the Playbook is neither a checklist nor a set of steps. Internal teams with HR, legal, data science and security skills can do the mapping, measurement and governance work. Outside help is most useful where the team lacks testing capacity for bias and performance evaluation, needs an independent review of the risk assessment, or must build monitoring for a tool used across many roles. Ask any partner for a written scope that names deliverables, owners and the systems covered before work begins.

What does the work need from our HR and legal teams?

The work depends on decisions that HR and legal teams own. HR should define the job-related criteria, the human steps in each hiring stage, the candidate communication and the escalation path for disputed decisions. Legal should identify which laws apply in each location, such as Colorado's consequential decision rules and Texas's intent-based prohibition, and review notices, appeal wording and vendor contracts. Both teams should approve the risk tolerance, the go or no-go decision for each tool and the residual risk record. Engineers and data teams supply the testing and logs. Plan for these reviews as recurring work, not a single exercise, because tools and hiring rules change.

Does Texas make disparate impact illegal?

No. Section 552.056 of the Texas Responsible Artificial Intelligence Governance Act bars developing or deploying an AI system with the intent to unlawfully discriminate against a protected class. The enrolled text also states that a disparate impact is not sufficient by itself to show intent to discriminate. That does not mean an employer can ignore outcome differences. Disparate impact remains relevant under other federal and state employment laws, and measuring it helps show that a tool was tested and monitored. Confirm the scope and any exceptions of the statute with Texas counsel, since the text governs and this summary does not replace legal advice.

How DeployOpen prepares AI hiring systems and evidence

DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure, and prepares the systems and evidence an employer or HR technology vendor needs to show how AI in hiring is governed and tested. We do not issue audit reports or certifications; independent assessors do.

How we scope

Engagements are fixed-scope, with the systems, hiring workflows and AI tools covered agreed in writing before work starts.
The written scope names which NIST AI RMF functions, categories and subcategories the work supports, such as the hiring profile.
Scope lists the employment decisions in view, including any Colorado or Texas obligations your counsel has identified for your deployment.

How we build

We set up the inventory of AI tools used in hiring, including third-party components and the data each one receives.
We configure logging, documentation and human review steps so that outputs and overrides can be traced back to a decision.
We run fairness and performance testing on hiring models and workflows, then record the methods, metrics and results for review.

How we hand over

Deliverables include written documentation of the system context, risk tolerances, test results and residual risks for your team to own.
We provide a handover of runbooks and evidence so your staff can keep the records current after the engagement closes.
Each evidence item is mapped to the subcategory it supports, so your assessor or legal reviewer can follow the trail independently.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work is complete.
A retainer can cover periodic review of hiring models, updates to documentation and retesting after material changes.
Ask us to confirm in writing which parts of the work your internal team, your counsel and your independent assessor will each own.

NIST AI RMF for hiring and HR technology