High risk by default
Employment records, health-adjacent notes, background-check logistics and conflict documentation require strict purpose limitation. Most consumer AI tools are inappropriate. Prefer organisational systems with access control, retention settings and clear processors. Align with GDPR-compliant AI for dioceses.
Lower-risk assistance examples
- Drafting generic job posting language from approved requirements
- Turning handbook sections into FAQ drafts for staff portals
- Summarising public training materials
- Helping managers structure 1:1 agendas without personal case detail
Keep individual case notes in the HRIS or approved confidential channels only. “Anonymise first” is not a free pass in small communities where roles re-identify people.
Volunteer coordination
Volunteers rotate quickly. AI can help draft role descriptions and onboarding checklists from approved content. Do not upload spreadsheets of personal volunteer data into unapproved tools. Minimise data in prompts; work from role templates instead. Time-box access when assignments end.
Governance checklist for HR leaders
Document approved tools, ban lists, retention, who may use AI for HR tasks, and escalation paths. Train managers explicitly. One forward of a performance email into a chatbot can create a reportable incident. If you would not put it on a postcard, do not put it in a free prompt box.