Ethical AI Governance in HRIS: A Checklist for Pakistan

Ethical AI governance in an HRIS means written rules for what AI may do with employee data, who is accountable for its outputs, how you test it for bias, what gets logged and how employees can challenge a result. Seven controls cover most of it: human oversight, bias audits, transparency, audit logs, data privacy, a named owner and vendor due diligence.

Pakistan has no law that tells you exactly how to do this for HR, which makes the work more important, not less. When the law is silent, your own policy is the standard an employee, an auditor or a court will read. This checklist is written for HR leaders in companies of 50 to 300 employees.

It means every AI feature has an owner, a boundary and a record. The owner answers for the output. The boundary says which decisions the AI may touch. The record shows what it did, when and on whose approval.

Use the table as your starting policy. Fill the right-hand column with real documents, because a control without evidence is an intention.

Less than you would like. Pakistan approved its National AI Policy in July 2025, with targets to train one million AI professionals and develop 1,000 local AI products by 2030 (The Express Tribune). The coverage we read describes skills, investment and a proposed AI Council. We found no rules in it for AI used in hiring or workplace decisions.

On data, DLA Piper's Pakistan guide describes the Personal Data Protection Bill as a draft not yet promulgated, and points to the Prevention of Electronic Crimes Act 2016 as the existing law. Section 16(1) penalises the unauthorised use of another person's identity information with up to three years in prison, a fine of up to Rs 5 million, or both (DLA Piper). Check the current status of the bill with your lawyer, since the guide is a snapshot.

Borrow from frameworks that exist. The NIST AI Risk Management Framework, released on 26 January 2023, is voluntary and organises the work into four functions: govern, map, measure and manage (NIST). The EU AI Act treats AI used in HR and employment as high-risk, and a provisional agreement reported in June 2026 would move the application date for those systems to 2 December 2027 (Sidley). Neither binds a Pakistani employer. Both show where scrutiny is heading.

Rank by consequence for the person, not by technical complexity. A chatbot that explains leave policy is low risk. A tool that ranks candidates, rates performance, suggests pay or flags someone for disciplinary review is high risk, because a wrong output changes a livelihood.

For every high-risk use, require three things: a human who can override, a written reason for the final decision and a way for the employee to ask for a review. For low-risk uses, a log and a clear notice are enough.

Compare outcomes, not intentions. Take a decision the AI influences, such as shortlisting or performance ratings, and compare the rates across groups you can lawfully and sensibly record, for example gender, branch, or age band. Large gaps need an explanation. Small groups need caution: with fewer than about 10 people in a group, a percentage tells you little, so treat the result as a prompt for review, not a finding.

Do it before launch with past data and again every quarter. Record what you found and what you changed. Ask the vendor how the system was tested, on what population, and whether it can show you the factors behind a given output. If the vendor cannot explain a score, I would not let it touch a decision about a person. That is my read, and it is a cheap rule to apply.

Our guide to predictive analytics for attrition and planning shows a use where this matters: a risk flag should start a conversation, never end a career.

Tell them which tools use AI, what data those tools read, what decisions they influence and where the final decision sits. Put it in the handbook and in the onboarding pack. Our post on the documents needed before hiring in Pakistan is a good place to add the notice.

Give employees three rights in writing: to ask which data was used, to ask for a human review of any AI-influenced decision about them and to correct wrong records. Name the person who handles the request and the time limit, for example 10 working days.

Ask in writing and keep the answers. 1) Which features use AI, and which only use rules? 2) Does our data train your models, or anyone else's? 3) Where is our data hosted, and who can access it? 4) Which decisions can the AI make without a person? 5) How do you test for bias, and can we see the results? 6) Can we export the full action log? 7) How do we get our data back if we leave? 8) What happens to our data when the contract ends?

Workflow Engine is Bitsbuffer's HRMS for Pakistani companies, and we suggest holding it to this list too. Bring the list to a demo and we will say plainly which answers we can give today and which we cannot. For the wider buying checklist, see our guide to HRMS features Pakistani companies need.

A policy does not make a tool fair. It makes you accountable for checking. It will not replace a lawyer's view on employment law, and it will not fix poor data. Review the policy every six months, because the tools and the rules will keep moving.