Sarah Harris: How is AI impacting the world of HR? Risk, Recruitment, and Readiness.

If you are recruiting and you want to check whether someone's used AI in their application, you can't just do it. You have to have the permission of the potential candidate, so you have to have it written into your recruitment process. And they need to understand that you are going to use another application to check whether they've used depending on. So it is unlawful to check whether someone's used AI without their knowledge in an application.

Hello and welcome to the Marketing and AI podcast, the Map. I'm your host, Hal Kimber and today we are going to be dealing with a very important question for businesses everywhere in the UK and beyond. As team leaders, marketing leaders and business leaders, we all rely on the steady human support of our HR colleagues to keep the cogs of the business machine running smoothly. But as we step further into this AI led future, it's not just marketing that's changing.

The workplace itself is being reshaped from the inside out. So it gives me very great pleasure to welcome Sarah Harris, Managing Director of HR People Support, who's here to help us explore a vital question. Is your HR team ready for AI? Sarah, a very warm welcome to the podcast.

Thank you. So what's, what, what are you seeing from your vantage point? You know, tell us a bit more about, you know, the work you're doing with clients, how you came to set up HR People Support and then we can get into the, the meat of the question. Okay, so I set up HR People Support seven years ago.

I started with one client and just me and now we've got a team of eight based in Cheltenham and over 400 clients and they're 400 clients, all very, very different. I have a passion for AI, have done for about two and a half years since I saw a recording, a seminar with Daniel Barnett, who's a London based employment law barrister. And I think that I related quite well to his seminars because they were relevant to our sector and I guess I've parked that for a couple of years because it was all very, very new.

So up until about four months ago, it was very much just in the background. So how we've started to work with our own business and our clients is basically to start with an AI policy. And at the moment we've been going on to management meetings or board meetings to help leaders of the businesses to move forward and generally speaking, we've helped a lot in the area of policies. Interesting.

I mean, it's not uncommon for me to still hear in the conversations I have with colleagues and connections that, you know, certainly I Get the sense that some businesses still have their heads in the sand or are ignoring AI's impact. I mean, what are you seeing from your vantage point? Well, I definitely think personally that I feel most businesses are not ready. I think that's feedback from our clients and where they sit.

I think that they're probably distracted at the moment with the budget and other important factors when we're faced with running a business. So whether it's cash flow or losing contracts, you know, there are other distractions. And I think that what I'm seeing is that employees are ahead of the employers, right? Yes.

And that undoubtedly brings with it a different set of can of worms, whether intentionally or unintentionally. I think I saw recently a Microsoft study that said 71% of employees use AI tools at work without employer awareness. Is that something you get a strong sense of as well? Is the number that high?

Yes, I mean, it was a small Microsoft study which was done about four weeks ago, and it did say that 71% of employees were using AI tools without the employer's awareness. So I think that, you know, they are using the tools to aid their work. So I think that, you know, definitely there's an appetite more so from employees than there are from employers. Yes, I'm sure it's all done in good faith.

I mean, it does certainly, from my own experience of using AI, greatly facilitate some of the things that I used to find. But if you have to write a document or you have to write a deck, I think it's very good at taking some initial thoughts and polishing something out much more quickly than perhaps you would have been able to do otherwise on a Friday afternoon. Or if you're, if you're crafting an email that needs to be delicately worded. It also has a very good facility with language on that basis.

But there are hidden risks, aren't they? There are, you know, I think things like confidentiality breaches. A lot of AI tools that marketers will be using will be embedded in the existing software that they have at their disposal. Whether it's their email systems, whether it's their social media management tools, whether it's platforms themselves or Google Ads.

You know, there's an AI component, it seems to me, everywhere, and this brings a whole plethora of risks. Would it be too strong to say to businesses that they need to be mindful of? Yes, definitely. If employers don't take the lead and the employees are left to their own devices, it leads businesses into risk.

I guess there's the ip. So Employees are putting data into their own, say, mobile devices, and then that critical data is out there. So that's a risk. There's also.

We've got Cyber Essentials accreditation, so it would invalidate that. You've got to think of your cyber insurance policies. That obviously is a consideration. So I think really there is risk there that you've got to control.

And I think that if you have a robust AI policy that's driven from the business, then it will close all those gaps. And I think telling people what they can and cannot use and, and how it should be used for, you know, data, then, yes, that, that certainly closes the gap. But I think the biggest risk at the moment I see is employees. Okay.

But that nevertheless, things like Cyber Essentials, accreditation. Tell us a bit more about that. I haven't come across. And the insurance question as well, so.

Yeah, right. Have I survived so long? No. So Cyber Essentials is.

I mean, if you think about it, there are many more cyber attacks. You've only seen it with Marks and Spencer's, with Land Rover, we've got a couple of clients that have been hit. It's a huge impact. So what most businesses do is go through the accreditation and there are various levels of it depending on, you know, whether you're working on government contracts or what have you.

So there are different levels, but by undergoing that, you're closing down your cyber risks. But it does, you know, your employees are a part of that. So confidentiality is so important there. So that's the Cyber Essentials, the insurance.

Well, we've all got various insurance, but we do have the cyber. And so what employees do will have an impact on that. So if that's written into an AI policy, the reasons why you shouldn't be putting certain data in various places and exposing extra risk to the business, then that protects you. And if employees unfortunately go down that kind of route, you should have your robust policies in place, updated to go through disciplinaries or written warnings or remove people from the business who don't carry out what's really important for businesses.

So. So I think that, yeah, those, those couple of areas are, you know, important too. Absolutely. You can't afford to ignore them or if you do so at your peril.

Which brings us on to what I guess is still the lifeblood for every business, which is their employees. I think we can still say that even in the age of AI. As it arrives, AI will transform the relationship between a business and its existing employees, but it will start with recruitment as well. I thought it would be a sensible place to start and look at how AI is changing the whole job application and CV management and filtering process.

What are you seeing there? Yeah, so I can imagine that most jobs that are applied for these days have some form of AI assistance in those applications. So how candidates are using it? Well, they could be using it in all sorts of ways and I.

I would really like someone to use it when they apply for a job with us because it shows that they're embracing technology that saves them time. I think what I would be interested in is asking them how they've used it and if they've used it and if they have used it, how have they used it? So have they used it for spelling? Have they used it to make something look pretty?

Have they used it to hone in on some skills and what have you? So people are definitely using it and I think it's positive if they are. Yeah. It's an interesting question, isn't it, between it being a very useful tool to help people overcome perhaps nervousness, particularly in a job, you know, hunting scenario, where you could.

You could be nervous, but also where, because AI is so good at crafting words that it could perhaps mask or give an impression of an ability with communication that actually isn't there in the candidate. I don't know whether that's something that. Yeah, I think it puts people on a level playing field, doesn't it? If they're all using it, then they've all got the same chance.

But I think that if you are recruiting and you want to check whether someone's used AI in their application, then you can't just do it. You have to have the permission of the potential candidate. So you have to have it written into your recruitment process. And they need to understand that you are going to use another application to check whether they've used it.

So it is unlawful to check whether someone's used AI without their knowledge in an application. And I did speak recently to an IT business who said, well, they only check using their own tool and it's safe within their own environment. And I said, it's still unlawful. That candidate still needs to know that you are running various tool checks whether to establish whether they've used AI or not.

Wow. And I would expect that's not a commonly known risk for businesses, even with experienced HR leads. Potentially. I think that's a whole new dimension, isn't it, that's recently come in this risk that just by simply using an AI checker or whatever for someone's CV could expose the Business to legal issues down the line if they're not making the candidate aware that that's what they're doing.

Yes, definitely. And I think in this country, I think we're more aware of that. And there needs to be the human element during the recruitment process as well. And I think there have been a few cases in the US that have gone to tribunal on there being no human element during a recruitment process.

Well, it's got that far, isn't it? I was about to say, I hope there is still the, the timeless need for a human at some point to speak to someone verbally. Yeah. It also needs that human oversight.

Yeah. I mean, nevertheless, I'm sure even with AI as it is, that you could create a bot and an avatar that would give a very realistic impression, possibly for the early stages. But I would see it as being. I think it's really interesting because I have been hearing that candidates have been sent a set of questions in preparation for an interview.

Quite often the same set of candidates will come back with very similar answers or prepared through OpenAI. So I've been hearing that a lot of people nowadays are interviewing, using teams, but doing it in a way that they're visible so they can't sort of start tapping into another screen and getting, you know, answers. So recruitment has changed. It really has.

That's. Yeah. And so what sort of questions then should a candidate be? I mean, I do, I do from the other side recognize that increasingly when people are applying for jobs, they do go through an anonymous AI led phase.

Not even beyond submitting this DV and having that reviews by an AI. I've also heard stories where people have had to record videos of themselves answering a set of questions, but there's not a human at the other end asking the questions. They basically just got to. And they've got to sort of animate their personalities which then go off somewhere presumably to get reviewed and evaluated.

I mean, that's really, really a good point because I think that that's when discrimination slips in. Whether there's a particular tone, a particular sound, facial expressions, your body language, it all comes across and gets analyzed. And so, so I think it is sort of, you know, the bias creeps in then beforehand, you know, people applying for jobs didn't put their names on so that you couldn't see whether they. Are male or female or age or any of that.

Yeah. Or maybe a surname that wasn't perhaps originated in the uk. So there's lots happened sort of leading up to this. But yes, I think there's no question that the human element has to be involved in the recruitment process as much as possible.

I mean, there's AI applications that you can help to sift through and break down and get certain skills and patterns and what have you. So I do remember reading a book where a CEO of a big business in America applied for a position in his own company and he got accepted for a first interview. So he was within the 20% of people and he used AI, pure AI to apply for that job and got selected. His HR teams were absolutely mortified that he broke through and he said, please don't be mortified.

I'm testing the way we do things and it just demonstrates that we have to make some changes to make sure that we have a little bit more human element at the right stages to make sure that that doesn't happen. So yes, that was interesting. That I can imagine caused a lot of, well, heart failure, I'd imagine. Most HR teams, we didn't spot the boss when he was coming.

Yes. So just, just to wrap this one up then, are there any particular phrases that candidates should be looking out for when they're applying to jobs or. I mean there's a, I think there's a, a lot of marketing job seekers out there at the moment, sadly. You know, are there questions that they should be asking in terms of how their applications are going to be processed to make them look as though they're a bit more on the ball and aware?

Yeah, I, I think that recruitment is, is very different for each sector and I think that you have to have a set of questions for the interview and it could be what skills you've got, what experience you've got. Competency based questions so that we compose real life scenarios to draw out how they would deal with certain aspects of the role that they're applying for. So I think that you can use AI to help you put those together, but when you do the interviews you can delve more into the answers that come back.

So there definitely needs to be a format and there definitely needs to be those competency based questions just to get ahead of the normal preparation that people can get using OpenAI. Yes, yes, excellent. Well, let's hope after all that you do manage to recruit someone so we can move on to the next area, which is then how we embed AI into our people strategy, as our friends in HR put it. So what does, what does that look like from an HR perspective that moving from that AI prohibition, you can't use it.

It's, you know, there's Risks all attached to it, to actually AI enablement. That's really interesting. Every business is different at the moment, but I'm getting the sense that the IT companies are not very helpful. So I think they're coming at an area of caution rather than empowerment and I think that they are very much guarded.

So for example, they will often recommend just using copilot within Office 365 because that contains client data, customer data sensitive data and IT wraps it all around a safe environment. But we know that we need to use other tools to enhance our various jobs within organizations. And so we can't get away with not using OpenAI or other tools. Now in various sectors there are different tools that people can use for their own sectors and that's plain to see.

So I think companies have got to try and understand where the risks lie without compromising the empowerment and the innovation of their employees. Because I think the risk is that if employees aren't equipped with these tools that everyone else seems to be using, then they're not going to stay with that business, they're going to move on. So you have to look at a bigger picture. And I think it starts at management level, the board meetings.

They have to drive the risk versus the potential of where that business is going. And it fundamentally starts with the goals of that business. We're all very different. What are you trying to achieve and work back from that and empower teams to move it forward.

So there are risks. And I think that if you divide those projects up amongst departments, then they can do the research, they can do the legwork, they can report back as to this would work really well, this wouldn't. And I think that we should invest in that. And of course we haven't talked about the investment in AI.

So it's got to be used effectively and for the purpose of what it's supposed to achieve. Well, absolutely. And I think even if the business is satisfied that it's ticked all the legal and compliance boxes from AI adoption, there are still risks that come with its day to day usage. From my experience, I mean certainly I've seen firsthand that AI can be less than 100% accurate in its mathematical calculations.

I think its memory can be sometimes erratic. And obviously we all know about AI hallucinations which some people downplay and some people don't. I personally think they are something that people would need to be very much on their guard to spot. So all of this then suggests that businesses really should be looking at that structured training programs to drive this adoption effectively and to minimize these kind of risks.

Because a lot of these pitbulls, I found out the hard way from my own usage of AI, I wasn't, you know, I was genuinely going in, I was giving me the impression that it was able to operate as a business expert on analysis of CRM data or whatever it was. And actually it was only one instance in particular where I had the wit for once to say, can you show me your working? That I realized a massive mathematical error in its calculation. So, yeah, so, I mean, I guess that's it.

It's, you know, as, as business partners, as HR professionals often describe themselves, it's then moving into that space of we need to deliver structured training to our employees. You think that's fundamental, nice to have? I guess it depends a little bit. On the size, but I think it's important, whatever your size of business is, and I think that training just helps people get the information they need to make use of these tools to their best advantage and at the same time understand the risks.

So training is crucial, in my opinion. And I think that not only is there training on maybe bespoke software that's been designed, it's off the shelf AI like Copilot training needs to happen there, but also general training, I think. So what you were just saying, Hal, about hallucinations. I think if people understand what to do and how to do it, then they're going to get what they need and want.

So, for example, OpenAI can get it wrong. And quite often when they get it wrong is when people ask them to look at PDF documents. But if you've got actual data and it's written and you put it in and you give it the right prompt, you will get the right information back. Now, a hybrid of that would be a passport.

So a passport document is both. So you've got the pictures, you've got the words, you've got it like a PDF, the actual document itself, but then you've got the chip and it's in the chip that's got the data. So if you've got data, it's going to be more accurate. If you've got the wrong prompt or you're asking it to read a PDF or a document in the wrong format, then it's going to make its own stuff up.

So again, that boils down to training and understanding and that would be basic training, in my opinion. So moving it down to get those foundations in place, do you have a framework that you tend to use when you're working with your clients to get those AI foundations ready, what every organization needs to have in place. Yeah, I think what we tend to do, it follows our HR really, but we've put a few bells and whistles on in terms of AI. So it is an audit where we used to do HR compliance audits, now we do a more in depth audit so that it takes into consideration, have you got an AI policy, what are you doing in AI, what's in place and then from that audit, because let's face it, every business is different.

They're different in a sector, number of employees, how risky they are, how much assistance they've got in order to implement. They're all very different. But I think that once we do an audit, we then have a plan from closing the risk gap. So the framework comes from that analysis, I suppose.

Yeah. And are there any external references that you would recommend to listeners? Anything that you've seen recently you think has been very useful again in helping? Yes.

So just think about sort of the regulation. So the government in June 2025 this year, what they did was they decentralized the AI regulation and they've pushed it into various sectors. So, for example, the FCA have been targeted with AI governance, ICO as well. I think that that's when you go online, they're pretty useful.

So there are, you know, about half a dozen different areas where regulation has been decentralized via the government. But personally, the most effective and informative document that I have read so far is a checklist for business readiness from Institute of Directors. And that is, it's called AI Governance in the Boardroom. And that document is, I think is about 30 pages long.

It's got checklists, it's got checklists at board level, checklists for risk assessments. It seems to have got it packaged up nicely. And when you're a business leader, you are bombarded every day with AI and you're like a rabbit in headlights. But with that document, I really do think that's the best thing that I've read that helped me in my own business and it's helped me support our clients as, as well.

So that definitely a big recommendation and. Still just about short enough that you can read it yourself rather than putting in an AI to give you a digestive. Yes, it's very clear and it's very pretty. Yeah, yeah, good.

And big font, hopefully. Excellent. But you also do round table workshops yourself. Don't you forget your existing businesses.

Tell us more about how those work and have you got any coming up that could also be. Yeah. So I started about A month ago with a launch of AI and really sort of focusing in, on the human side of things and employees. So what I did was I worked with an IT business because I'm not an AI expert.

Technically, that's not my field. But they do go, they do run alongside each other. So. So we did that and then what we've done is we've built four round tables over the next sort of few months and actually we did our first one this morning and the first one that we did was, was all about setting your.

Your stance on, on AI, so getting to grips with how you're going to approach it. You know, how are you going to form, you know, a committee or a board or how are you going to sort of feed this through, what are your goals, all those sorts of things. So we've got three more lined up. One is on recruitment, one's on change management, one's on policies.

Because, let's face it, if you've got an employee putting IP data into OpenAI, yes, you've got to be able to have the protection in your policies to move someone out of the business or at least go through a written warning. So that might be a clause in your contract of employment that might be revisiting your data protection, updating your disciplinary, all those sorts of areas. So, yes, so we, although we've started today with, you know, from the beginning, that is management level.

The next set of roundtables are really for HR managers, HR directors or MDs of small businesses, where it's now focusing on the people strategy. So if you are going to implement a strategy where. What does that mean for jobs? Is there going to be a restructure?

Are there going to be redundancies? Are you going to redeploy people? So, yes, I, you know, I particularly enjoyed that this morning. Yeah, I bet all of the hot topics of the day, but.

And anyone can join these roundtables. I mean, I will absolutely. They are in, they are in person. So they're based in Cheltenham.

But there's not to say that if there's interest, we could do those, you know, through teams and online. Excellent. So just last question then, I guess is, you know, this has been a hugely informative conversation, at least for me, but I imagine a lot of our listeners. Any final advice for HR and business leaders now realizing that they really need to start their AI journey?

Well, I think I'd say, what are your goals, what you're trying to achieve? And then look at having an AI policy to protect yourself. And I think that employers have got to lead rather than their employees. I think that you find AI champions within your business.

Maybe set up a depending on the number of your employees and the size of your business. Or do you have a champion? Do you have an AI officer? Do you have a full committee that's got half a dozen department heads within it?

But start at board level and use the Institute of Directors checklists to make a start. And I would think that doing appropriate risk assessments and reviewing those quite often would be helpful. But, yes, look at what the impact is on your workforce, look at what's happening elsewhere in your sector and. Yeah, move it forward and seize the moment.

Carpe diem. Excellent. Thank you so much, Sarah. And if people want to get in touch, is LinkedIn the best way to contact you?

I'll share the details in the show notes. Yeah, LinkedIn message. You could come through the website. You'll find me.

Excellent. Thank you so much again.