10 AI Governance Risks Haunting HR Heading into 2027

Every October as Halloween approaches, I watch the same horror movie trope play out. Someone hears a noise in the basement, and instead of turning on the lights, they walk down the stairs in the dark...real smart.

What I've realized is that sometimes AI governance works the same way.

Most of what goes wrong with AI at work happens in the dark: tools nobody approved, decisions nobody documented, laws nobody tracked. To hijack and butcher Dumbledore's quote, "AI governance can easily be fixed, if one only remembers to turn on the light."

I'm not here to scare you off AI. It's a powerful tool and teams should use it. My goal is to show you what's lurking in the basement so you can at least walk down those stairs with a flashlight.

Here are the 10 AI compliance governance risks I'd keep an eye on heading into 2027.

1. The Phantom in the Hiring Funnel: Algorithmic Bias

Bias doesn't need a villain. It can be built into a system and run quietly on every application.

The clearest early example is EEOC v. iTutorGroup. The EEOC alleged the company's application software was programmed to automatically reject female applicants aged 55 and older and male applicants aged 60 and older, turning away more than 200 likely qualified applicants. The case settled in 2023 for $365,000 plus corrective actions.

That case involved a fairly blunt rule. More sophisticated tools can produce discriminatory outcomes in ways that are much harder to spot, which is why regulators now focus on outcomes rather than intent.

What to do: Ask every vendor how their tool has been tested for adverse impact, and run your own checks on who's advancing and who isn't.

2. "The Vendor Did It" Is a Ghost Story: Third Party Tools

A lot of HR teams assume that if a third-party tool discriminates, the liability belongs to the vendor. Courts and lawmakers are making that assumption look shaky.

In Mobley v. Workday, a federal court held in July 2024 that Workday could potentially be liable as an employer's agent for AI-powered applicant screening. A collective of applicants aged 40 and over was certified in May 2025, and court documents referenced 1.1 billion applications rejected using Workday's software during the relevant period. In March 2026, Judge Rita Lin rejected Workday's argument that age discrimination law doesn't cover job applicants. As of April 2026, the case was in pre-trial and discovery.

Notice what that means for employers: the theory is that the vendor shares liability, not that the employer escapes it. State rules are moving the same way. California's regulations extend liability to anyone "acting on behalf of an employer, directly or indirectly," including through an automated decision system. Colorado's new law voids indemnification clauses that try to shield either the developer or the employer from discrimination liability.

What to do: Treat AI vendor contracts like any other high-risk vendor relationship. Ask for documentation of intended uses, known limitations, and bias testing, and loop in Legal before you sign.

3. Shadow AI Lurking in Your Browser Tabs

Shadow AI is any AI tool employees use without approval or oversight. It's the creature that's been living in your house the whole time.

Microsoft and LinkedIn's 2024 Work Trend Index, a survey of 31,000 people across 31 countries, found that 75% of knowledge workers use AI at work, and 78% of those users bring their own AI tools.

The cost shows up later. One in five organizations attributed a breach to shadow AI, and organizations with high levels of shadow AI paid an average of $670,000 more per breach than those with little or none. Only 37% had policies to manage AI or detect shadow AI.

What to do: Banning AI usually just pushes it further into the shadows. Publish an approved tools list, explain why it exists, and make the approved path the easy one.

4. Secrets Fed to the Machine: Data Leakage

What goes into a public AI tool doesn't always stay private. In 2023, Samsung employees reportedly entered confidential material into ChatGPT at least three times within weeks of the company allowing its use: semiconductor source code, equipment data, and a recording of an internal meeting.

For HR, the stakes are personal. Think about what lands in HR inboxes: medical leave requests, investigation notes, salary data. Shadow AI incidents compromised personally identifiable information in 65% of cases, compared to a 53% global average.

What to do: Spell out in plain language which data can never go into an AI tool. Employee personal information, investigation details, and confidential business data are good places to start.

5. The Haunted Patchwork of State Laws

If you hire across state lines, you're walking through a corn maze where the walls keep moving. A few of the rules already in effect or on the way:

• New York City: Local Law 144 requires bias audits and notices for automated employment decision tools. A December 2025 audit by the New York State Comptroller found the city's enforcement "ineffective." City reviewers flagged one issue of non-compliance across 32 companies, while state auditors found at least 17 potential instances. In my view, light enforcement so far is not a reason to relax.
• California: Civil Rights Council regulations on automated decision systems took effect October 1, 2025.
• Illinois: HB 3773 took effect January 1, 2026. It bars employers from using AI in a way that discriminates based on protected classes, bans using ZIP codes as a proxy for protected classes, and requires employers to notify employees and applicants when AI is used for employment decisions.
• Colorado: In May 2026, Colorado replaced its original AI Act with SB 26-189, which takes effect January 1, 2027. The new law drops the original's impact assessments in favor of notice, disclosure, and record-keeping duties.

Colorado's switch is a good reminder that this landscape shifts. A checklist built in 2024 may already be out of date.

What to do: Map where your employees and applicants are, then match each location to its rules. Revisit that map at least once a year.

6. The Federal Fog

Here's where it gets murky. On December 11, 2025, President Trump signed an executive order titled "Ensuring a National Policy Framework for Artificial Intelligence." It created a Department of Justice AI Litigation Task Force to challenge state AI laws and directed other federal agencies to discourage "onerous" state regulation.

It's tempting to read that as "state AI laws are going away." That's not what the order does. As Paul Hastings notes, the order "does not, and cannot, overturn existing state law." That can only happen through Congress or the courts. As of April 2026, a Law and the Workplace analysis reported that the Task Force did not appear to have filed any lawsuit against a state AI law and advised employers to keep complying with existing state and local AI laws. In September 2026, 26 state attorneys general asked Congress for a federal framework that explicitly prohibits preemption of state AI laws.

What to do: Don't pause your compliance program while you wait for the fog to lift. Follow the laws on the books today, and check with counsel as federal activity develops.

7. Confident Ghosts: AI Hallucinations

Generative AI can produce answers that sound authoritative and are completely made up. That's a big problem when someone relies on them.

In Mata v. Avianca, a federal court in New York fined two lawyers and their firm $5,000 in June 2023 for submitting a brief with fake case citations generated by ChatGPT.

Companies also own what their chatbots say. In Moffatt v. Air Canada, the airline argued that its website chatbot was a "separate legal entity that is responsible for its own actions." A British Columbia tribunal disagreed in February 2024 and held Air Canada responsible for the chatbot's misleading information about bereavement fares.

Picture an HR chatbot giving an employee the wrong answer about leave eligibility. The lesson carries over.

What to do: Keep a human reviewer on anything AI-generated that touches policy, legal, or employment decisions. "The AI said so" isn't a defense.

8. The Mask With No Face: Deepfakes

Halloween is the one night masks are supposed to fool you. Deepfakes do it year-round.

In May 2024, a Hong Kong finance employee at Arup, an engineering firm, joined a video call with what appeared to be the company's CFO and other colleagues. All of them were deepfakes. The employee made 15 transfers totaling roughly $25.6 million.

HR is a natural target. Payroll changes, onboarding paperwork, and requests that appear to come from executives all depend on trusting that the person on the other end is real.

What to do: Set verification steps for high-risk requests, like a call-back to a known number before changing direct deposit details. Train employees to recognize the signs of deepfakes and AI-powered scams.

9. The Missing Paper Trail: Notice, Explanation, and Records

When AI is part of an employment decision, newer laws expect you to tell people about it, explain it, and keep records. Without that trail, you'll have a hard time defending the decision.

• Colorado (from January 1, 2027): Employers must give notice before using covered AI for employment decisions. Within 30 days of an adverse decision, they must provide a plain-language explanation of the decision and the technology's role, plus the right to request human review. Records must be kept for at least three years.
• California: Employers must keep automated-decision records for at least four years, up from two. Anti-bias testing done before and after adopting a tool can count in an employer's defense.

What to do: Keep an inventory of every AI tool that touches an employment decision: what it does, who owns it, how it was tested, and where the records live.

10. The Untrained Coven: AI Literacy Gaps

Every risk on this list gets worse when employees don't know the rules. The training gap is real. Only 39% of AI users receive AI training from their company. Governance is lagging too. About 63% of breached organizations lacked a formal AI governance framework or were still developing one.

Regulators have noticed. Under the EU AI Act, an AI literacy obligation for providers and deployers has applied since February 2, 2025. The EU's Digital Omnibus, published in July 2026, softened that obligation and pushed full high-risk obligations, which cover AI used in employment, to December 2, 2027. A deadline that moved is still a deadline. If you have employees or candidates in the EU, the clock is still running.

What to do: Give employees short, practical training on AI use: what's approved, what data stays out, and how to spot AI-powered scams. Then refresh it as your tools and the rules change.

Turn On the Lights: Train Your Employees on AI

None of these risks is a reason to avoid AI. But they certainly are reasons to govern it.

Bias, shadow tools, leaky data, and bad answers all lose their power once someone is responsible for finding them, writing them down, and training people to handle them.

If you're starting from scratch, start small. Inventory your AI tools this month, publish a short acceptable-use policy next month, and train your people after that.

On that last step, EasyLlama's AI Course Collection covers four areas: Understanding AI, Using AI at Work, Protecting Data & Privacy, and Recognizing AI Threats like deepfakes and scams. Each course takes 5–10 minutes, and admins can personalize courses with their own branding, policies, and workplace examples.

Build AI Awareness Across Your Workforce — Explore EasyLlama's AI Compliance Training.