Coffee Talk: AI in the Workplace

Hello everyone, and thank you for joining Ramon's Coffee Talk today. I'm Christine Whitney-Adams, Senior Human Capital Business Advisor at Ramon, and today we're very fortunate to have with us two Ramon partners, Tara Hama of our Employment Law Practice Group and Elamu Kunjunjun, our Data Privacy and Artificial Intelligence Practice Group. Tara and Elamu will guide us through the subject of AI in the workplace. And we welcome all, all your questions, and we would ask that you use the Q&A portal here for those questions. And if we have time at the end of our presentation, we will address your questions. I'd like to announce that new to our Coffee Talk program is the opportunity to earn SHRM professional development credits for attending today. So that SHRM activity code will be provided to all participants at the conclusion of the program. But before we dive into our program, I want to note that today's coffee talk does not constitute legal advice nor establish an attorney-client relationship. Past outcomes do not guarantee future results. With all that said, I want to jump right into today's subject, and we're going to start with Tara. Tara, could you explain to me some of the uses of AI that you're seeing today in the marketplace that employers are using?

Sure, Christine, thank you. And, and hi everyone. Good morning or good, good afternoon wherever, wherever you are. So there are a number of areas in which employers are using AI in the workplace with regard to hiring and the application process, the onboarding process, promotional decision-making, other employment decision-making processes. Compliance, internal HR functions. And to go a bit more granular with that, for example, in the hiring, hiring area, employers are using AI to screen resumes or applications. They're using AI to talent source, to target for job ads, to conduct video interviewing, initial screenings. Skill and personality assessments, which have been around for a long time, and then decision support as well. For instance, ranking candidates based on predicted, predicted performance or cultural fit, background checks, for example, including screening individual social media accounts or other public data that's out there, as well as productivity tracking. With regard to promotional and other employment decisions, when individuals are kind of already employed by the employer, employers are using AI in order to assist with promotional decisions or in some cases come up with a suggestion for a promotional decision in employee investigations, in conflicts of interest checks, and then with regard to just general compliance or internal HR functions, We're seeing a lot of AI tools used with regard to like a chatbot type of function where the employer kind of puts their handbook or their policies or their benefits plans into these chatbots that then will answer questions that the employees input based on the documents that are inputted into the AI tool. We're seeing employers using AI for policy drafting, different levels of that going on that we've been looking at and seeing from clients, for example, and then compliance monitoring. So there are tools that can monitor, for instance, you know, wage and hour compliance and things like that that we are seeing employers using as well. So there's kind of a ton of things that employers are using AI for. We'll talk about the purpose of this is kind of to talk about what the issues are, how they come up, and what employers should be concerned about and doing to kind of make sure that they're implementing the use of those AI tools in the right way.

I could really see how the use of these AI tools is really making the employer's job a little bit better and helping provide that information more readily available to the employees. But I do want to address the AI regulatory landscape in the US and abroad. Ilham, can you go over that for us?

Yes. So again, thanks for the opportunity to speak with everyone today. Again, and good morning and good afternoon. Yes, the legal AI regulatory landscape is is in many ways very convoluted. There are a lot of jurisdictions that are, that have draft regulations. There's a lot of conversation on the topic. Obviously AI is a very broad topic. The largest sort of regulatory The largest law in terms of impact has been the EU AI Act, even though it impacts Europe. But because it's the first, it's— what it does is it creates a blueprint for many other jurisdictions to think about. And within the US, I would say the most significant one is Colorado, and Colorado uses a lot of the same features that are in the EU AI Act. So among those, it creates risk levels and, you know, certain activities are considered high risks, by the way, including use of AI for employment decisions. It requires an annual risk assessment, provide— it requires notices, it requires a mechanism for people to appeal decisions made through AI tools. The other that's also pretty relevant is New York City's AI law that that is focused on bias and requiring partial independent bias audits both at the beginning of the use of a tool and also annually. The audit has to cover both sex and race and ethnicity. It also requires notice obligations. But, and again, there are a lot of, states that, that, that are developing laws in this area. And as I said earlier, one of the things that's really critical is looking at how AI is being treated around the world because regulators are looking for any early adopters, looking for signs to see what is working. So we've, we've been paying a lot of attention to really AI even in areas, you know, where we don't practice because they end up being good examples that our regulators here in the US use to think through how to address particular issues and risks related to AI.

Thank you. Thank you very much, Tara. I want to address some of the longstanding employment law concepts and how AI is adapting to that in our world today. Sure.

Thanks, Christine. So, I mean, I am a proponent of using tools to make workflows more efficient. I think AI tools can make certain traditional employment functions or human resource functions more efficient and kind of take some of the busywork out of the equation, as well as, you know, just providing assistance with all of these functions that HR people and even us as employment lawyers have on our plates. But I do think that there are still limitations and that safeguards have to be put in place with regard to these AI tools at this early stage especially. I do believe eventually that there will be a way to implement these tools into most of these traditional HR or employment law functions such as hiring, decision-making, policy implementation, compliance monitoring, some of the things that I talked about earlier. And I think that is actually happening every day in a lot of those areas. You know, employers are implementing these tools in various ways. The question, I think, is how much oversight or vetting do these tools need now or at any point in the future? Because obviously The tools change, the features change, they get better over time as we see with all of the technology that we use every day. And so I think the answer to the question of how much oversight or vetting will probably change over time. But for now, I think employers especially need to be carefully vetting the AI tools they're using in the employment context specifically. And in other contexts, quite frankly, to make sure that these tools are not opening them up to, you know, legal liability compliance risks. And, you know, that's kind of where we come in and we can assist employers on telling them what the risks are with using these tools and making sure that they have proper mechanisms in place for oversight and vetting of the tools. One example that I just, I'll mention is, you know, for example, if an AI tool is screening applicants and the AI tool is unaware of a law in a specific jurisdiction that, I don't know, says you can't screen applicants based on salary history, for instance, and the AI tool does that, that's potentially illegal and the employer is the one screening out the applicant or not making a hiring decision, not hiring that applicant on that basis by way of the AI tool, but the employer ultimately is going to be on the hook for the unlawful decision. And so I think businesses are becoming more aware of this because we've seen a lot about this, especially in the discrimination category, which we'll talk about a little bit later. In the news, in court cases, guidance from the EEOC and those types of things. So I think employers are, you know, more aware of these issues now than they were, you know, maybe a year ago, maybe 2 years ago when some of these tools first came out. But I do think employers need to be really careful about vetting the AI tools in that respect. And so I think the key takeaway here is just that employers are generally still on the hook for the decisions made by the AI tools and the outputs created by the AI tools, unless of course you've negotiated something differently with the vendor, which we'll also talk about later. But, but I think, you know, employers, just be careful when you're implementing these tools and make sure you're vetting them.

Yeah, I could see how that can become even more complex when an employer has remote employees across various different jurisdictions. So it's a very good point that you make there to ensure that those jurisdictions are being managed in accordance with the employment laws. Thank you for that. Now, Elamu, does the privacy regulation impact the role of AI in the employment law context? Can you take us from there and tell us about that?

Yeah, so privacy regulation is more mature than AI, right? AI regulation is just, you know, coming into play, but privacy has been around for a longer period of time. And, you know, what we're seeing so far is that AI seems to be sort of an accelerant for two areas: privacy and discrimination. So it's the requirements to not discriminate or protect people's privacy have been around for a while, but AI seems to have a way, depending on the various use cases, of doing those two things either violate privacy or discriminate at scale, doing it faster in some ways, doing it better if you can discriminate better or if that's even a thing. So as a result, the privacy regulations have a significant impact on AI in a variety of ways. One, in the few jurisdictions that have regulators, the AI regulator and the privacy regulator is the same regulator. It's the same office. And they look at both topics. And mostly because the topics are are intertwined, they're interrelated. And then, excuse me, secondly, because the ultimately AI requires some processes around governance and around validating particular use cases and processes. Because privacy already does this, it lends itself to using some of the same tools for evaluating AI. You use the same privacy tools that you, for example, if you're evaluating a vendor, you would use some of your your privacy impact assessment tools, you will just use that for AI assessment tools, right? So a lot of the tooling is the same, and I think that's the other reason why there is an interconnection between privacy and AI.

When you talk about that privacy, can you give me, I guess, a specific example of how that relates to the employment context? Like, give me a real-world example that you may have run into. Where that connects.

Yes, yes. So, uh, so for, for example, the, um, you know, a particular client is implementing some AI tools to better track productivity of its employees. And the— it's been tracking productivity for a long time, but with the AI tools, it's able to to organize badge information. Your, your, your, your smart card, your, your, your ID has information about where you've walked in the facility, and it, it's able to correlate all this information in a way that was not possible before. So The, the employee's privacy, which was already very limited in the workplace, becomes almost nonexistent with the combination and correlation of all these AI tools that track the movements of an employee.

Thank you for that. I could see where we need to evaluate that before implementing it. Thank you. That's a good example. Now I want to go back to Tara, and you know, we touched on this a little bit before, but how do we prevent that AI tool from functioning in the discriminatory way?

Sure. So I think Ilimu talked about some of this earlier when he was talking about the, the laws that are in effect in some jurisdictions and some of the proposed legislation in other jurisdictions. But some of the state and local legislation requires bias audits to be completed on AI tools. That are used in the employment context by employers. So that's one way that as an employer, you can make sure that your AI tool is not functioning in a discriminatory manner. Another way is for businesses to maintain human oversight over the AI tools, especially when they are either making or assisting in making decisions with regard to employment matters. And so essentially what that means is, okay, AI tool spits out the output and says this person is the best for the promotion, but then you actually have a human review and go through and make sure that, you know, the decision was made for the right reasons and not for discriminatory reasons and that type of thing. Another way is to really review the AI vendor or tools data, information, whatever is available before implementing it. So, you know, ask the questions of the vendors that you're using as to how the tools are tested, how are they vetted, do they do bias audits on their tools, what data they can share with you related to that testing or auditing. And really make sure that you're using tools that are up to par, up to standard, with regard to that type of thing. The EEOC, like I said earlier, has issued a bunch of guidance on the use of AI tools in employment decision-making. And essentially, the EEOC has said, hey, employers, you can't hide behind an AI tool vendor or an AI tool with regard to these discriminatory decisions. Even if a third-party tool is used, the employer generally remains responsible for the decisions that are made using the AI tool and for ensuring that there is no discrimination or discriminatory impact. You know, the EEOC suggests that employers again should ask vendors whether their tools have been tested for disparate impact, whether they've been validated for, you know, making job-related decisions and using data that's reliable and fair. And so those are all the types of things that employers using AI tools should be thinking about, especially when it comes to the discrimination, disparate impact type of issues that we see with some of these AI tools and some of the court cases that we've seen in the recent past related to discrimination in the use of AI tools.

Thank you, Tara. You know, Elamu, I know that AI, you know, seemingly makes things a lot easier. How is that making surveillance easier in the workplace? Is that true? And if so, how does that work?

Yeah.

So in addition to kind of the example earlier that I gave, one other— so one, yes, workplace surveillance is, I would say, a lot easier with AI. And let me even give another example of what some employers are doing. So many employers are concerned about insider threat, and that's the concept of where an employee may be doing some things that perhaps benefit them and not the employer. and the employer wants to, to really minimize its own risk by its own security risk by, by more granularly monitoring its employees. So one of the— some of these tools will do things like track your— the times that you're working. Track if you are going to certain types of sites, whether it's constant visits to job sites or constant visits to particular sites where someone may be, may be putting in a sort of anonymous complaint, right? So So there's downloading large documents, using the system in many different locations, like throughout the world. So there's a lot of tracking that is very easy to do with some of the emerging AI tools. And now, There, there is debate as to whether some of those things are, are appropriate, ethical, or legal.

Mm-hmm.

But, but definitely AI makes it all possible and makes it, makes it easier to happen.

Thank you. How does, just to continue with you, how does that deci— the automated decision-making come into play with AI? I hear that and like you to explain that.

Yes. So, Like, like all these tools, and, and Tara mentioned this earlier, there is— AI has the ability to, to make decisions on our, on our behalf, on behalf of the user, right? So whether it is, say, rejecting an applicant based based on data through an algorithm that, that concludes that an applicant is not, is not fit for a particular position. That's an example of automated decision-making. And so that concept has actually been in place within several privacy regulations for a long time, that automated decision-making should, um, should always have a, um, a person who independently analyzes the outcome and, and makes an independent decision that's separate from what the tool provides. The, the tool may provide, um, a data point, but the data point should not be determinative as to what actually happens. So, but the topic has become more important because in the last few years there are more and more things, more and more actions that can be done in an automated way. And that has made it more prevalent and has escalated sort of the topic in a way that it hasn't been in the recent past.

Thank you, Tara. I do want to go back to what you touched on before about the AI vendors, and I want to discuss a little bit more about how to manage and protect the organization when we're speaking about those AI vendors.

Sure. So I mean, a lot of these tools are vendors that provide these AI tools for employers to use. They're businesses, right? So you're contracting for an AI tool or an AI service or something like that with these vendors. And so, you know, you're going to want to have some type of contract in place, whether it's a services contract or a software use contract, whatever it is. You'll likely be having some type of agreement in place with these vendors or these, you know, these, the, the people that own these tools. And so businesses should be careful in, you know, reviewing those. I know a lot of times in the normal course of business, maybe you have, you know, you get a contract that you think is standard, you just sign off on it, and that's the end of the story, especially for smaller businesses who may be using, you know, certain tools or applications or things like that. But with regard to AI tools, you know, I, I would recommend that you look at them and have potentially have counsel review them. There are provisions in these contracts, specifically indemnification provisions, that, you know, may be a subject of negotiation. So for example, if this AI tool vendor is advertising, you know, our tools are tested to the greatest extent possible, there's no discriminatory decision-making outputs that come out of this tool, you know, essentially guaranteeing that their tool is safe for employers to use, but then you read the contract and it says, well, if it makes a mistake, we're not responsible for anything. You know, how much is that advertising that your tool is perfect really worth if you're not kind of putting your money where your mouth is? So employers should be careful about that, looking at these contracts. You know, if you have small smaller AI tool startup companies, they may be more willing to negotiate those types of provisions to kind of get the business in the door. And so, you know, not just signing off on what you think to be a standard contract, services contract, or contract to use this type of software, and looking at those features, I think, can be a way that employers may be able to protect their organization and maybe limit a little bit of the liability associated with those tools.

Thank you. Ilham, when we, when we talk about those AI security tool security controls, how can we make sure whether or not the employer is responsible or the vendor is responsible? Can you elaborate further on that?

Yes, so I think the short answer is both. Both are responsible, but they're responsible at different stages. So the vendor is responsible for incorporating all the fundamental security controls that the product needs to have. So there are more and more guidance around what security features AI products should include. And the vendor is responsible and accountable for doing that. As Tara said earlier, those are some of the, you know, those are some of the things like when you're negotiating with the vendor, you want to make sure that they are disclosing all the security practices, the security features that they have embedded into the product. Because there are just certain things that only the developer of a solution can attest to and can do. One, as the user of an AI solution, you do have some things you can do, and I'll talk about that in a second. But the, I would say 75% of the controls need to be built into how the product is built. And that is true as well for AI products. Now, For the employer, often these AI products have optional security features that, that can be implemented where the, the vendor is saying, hey, we have these features that are available to turn on or turn off depending on your risk posture. And so it's the employer's a duty to understand what those optional features are and assess which, which of those features are important for, for their employer in terms of satisfying the security policies and privacy policies of that company. So that's sort of the second bucket. And then the third bucket is the use of the, of the tool once you're implementing it. So there are other security features and processes that need to be put in place, you know, because, because not everything can be managed at a technical level. So, for example, you know, have a client who, because of some technical limitations, you know, they, they created essentially a, a checklist of, hey, if any person using this, you cannot do these 5 things. You cannot put any employee names in the system. You can put certain, certain attributes, but you can't put names. You can't, you can't put addresses in the system. Like, like there are certain features that, that it, that they, that the employer has, has asked its employees who use the systems to do to, to address sort of security vulnerabilities in the tool. So, so having that 3-pronged approach, technical, controls from the vendor, using the optional security measures, and then from an implementation perspective, taking those steps that are necessary, I think is critical to protect the AI security.

Definitely. That last piece, that educational piece is so important.

Go ahead, Tara. Yeah. No, I just wanted to add on that. We've had a couple of clients recently who have asked us to implement AI use policies for their employees. And I think it's really important, even if you aren't using any other— any tools other than kind of the OpenAI tools that are available to everyone, because, you know, if you are a medical practice and you're— the people taking your notes are putting confidential patient information into an open-source AI, tool to summarize the notes, for example, or something like that, that can be a real problem. And so, you know, you have to make sure that the, the people using the tools are aware of what they are and are not permitted to use them for. So yeah, I think that last piece is important, especially at this stage now when we have kind of all these things floating around that are available. To be used, but people maybe still don't really understand what happens to the information once it's in there. So just, just, yeah. Yeah.

Ilhamu, there's a term that's called agentic AI. I wanted to know what role that plays in the employment context. Can you explain a little further? I know we have some time left in our program and we have a few other topics, but I wanted to touch on that as well.

Yeah, so agentic AI is sort of the newest thing within AI. And you know, just how, you know, currently, you know, you can put a prompt in ChatGPT, you know, you can ask it, you know, what's a good restaurant in San Diego, right? And it will give you a response. Right now, agentic AI kind of functions almost like a, like a project manager in that it has a goal. That's an important feature within agentic AI. It has a goal to do something, and that something usually includes multiple steps. And it manages the completion of those steps. So it's, it's, it's almost, it's a, it's a smarter version of the regular AI. So, so for example, at, at actually a prior employer of mine, we were using an agentic AI solution where the employee could, could ask the system, hey, how many PTO days do I have? And, and then, and then it'll say, okay, hey, you have, you have 7 days. And the employee could say, okay, I want to take a PTO for the last 7, the last 7 Fridays of the year, and it will It will go put it in the system. It will block your calendar. It will create out-of-office messages that are ready for each of those days. So it did all of that through it. Again, it was an early version of a Genentech AI solution, but that's the kind of capabilities that is possible. So it's a smarter version. It's used— the use cases today are usually around talent acquisition, employee onboarding. That's one of the areas that I'm seeing a lot of solutions on where you have a new employee. The agentic AI basically figures out how they get their badges, how all the training that they need to get, all the mandatory training. And it, it arranges the mailing of the things that have, you know, your— they need to go to your home and all those things.

Yeah.

So, um, it's, um, it, it has significant impact and, and I— and it's, it's, it's going to grow as it gets better.

Wow, that sounds, um, wonderful and scary all at the same time.

Yes.

I wanted to move to our federal government, and we know that they're doing a lot of cost cutting, and, um, how does play into the employment law compliance and all that shifting to the states? Can you touch on that for us?

Sure. I mean, employment law in general has always kind of been a patchwork of federal, state, and local laws and regulations, which vary very significantly from jurisdiction to jurisdiction. I think anyone who is in the HR field or employment law field knows that, you know, if you work for a multi-state employer as an HR professional, you know that there are different wage and hour laws in every state, different training requirements in every state, different leave requirements in every state. So I don't believe that this will be a lot different with regard to employment law as it, you know, as it relates to AI. I do believe that under this administration specifically, we've seen We've seen the guidance that is basically saying there's going to be less federal agency action and more state action in these respects. In the employment discrimination context specifically, the EEOC has already said— well, the administration has already said that it essentially won't prosecute claims of disparate impact, which is one of the areas where we see risk related to AI tools. Essentially, you know, is the AI tool decision-making having a disparate impact on a specific protected class of people, people with disabilities, women, those types of things. And essentially, the administration has said, you know, the EEOC is not going to be enforcing those types of discrimination claims. So I think we will see state— more state involvement in that regard, because as we all know, most states have their own discrimination laws, and most of them prohibit disparate impact in these types of decision-making and policies and tool use. So I think we will see a bit of a shift from federal enforcement moving more towards the states. But like I said, I think employment law has kind of always been very state-specific And varies widely from jurisdiction to jurisdiction.

Yeah, so I have a quick comment just on the kind of federal versus state distinction. So within the AI space, the federal government enforcement has been mostly on misleading claims. You know, there are companies who would say, Oh, my product is AI-powered, even though it doesn't really use any AI. So they're going after those types of things, those types of claims. Also, where a vendor might say that, you know, their product does X, Y, and Z, but in practice, it doesn't. It doesn't do that or it doesn't do it the way the vendor describes it. So most of the enforcement from the FTC and Federal Trade Commission has been around that. And, but on the state side, as the laws, both AI and privacy are, you know, the few that are in place are just starting to, become enforceable because many of the laws pass, but then the enforcement date is at a later point. We're not seeing much yet, but we're expecting that we'll see quite a bit within the next couple of years as some of these laws become effective.

Thank you. Thank you. I want to just summarize. We're coming to the end of our program, and if you could just give us 4 or 5 bullet point action items for us, for us key takeaways so that employers know what to do about AI and if they wish to implement it, how to go about that. Sure.

I mean, I think one of the most important things and one of the things that may be required depending on what jurisdiction you're in is to audit these tools, review your selection of these tools, check whether they are creating an adverse impact on certain protected classes. Or whether they are providing outputs that are otherwise in violation of employment laws. And just making sure that you're vetting the tools properly, you know, either internally or with the vendor based on the vendor's provided data and information. Again, just to make sure that they are not providing outputs that are in violation of employment laws.

Yeah, so the related, related to that, you know, what I've seen, you know, companies do that, that do this well, they build an internal AI governance program so that they can, they can manage these audits of their solutions with a level of consistency and effectiveness, because if you If you have an internal process that works and you do it all the time, you know, it's, it's, it's both more defensible and you're more likely to get the desired outcome.

That's great.

Yeah, I think, I think checking the security issues with regard to the AI tools, Alimu mentioned that those 3 kind of buckets of security solutions, making sure that you're really paying attention to those, both, you know, in your discussions with the vendor, in your agreements with the vendor, and then, you know, internally to the extent you can do it technically. But then also as an employer, making sure that your employees know via policies, procedures, those types of things, what they can and cannot do with the AI tools that you are using.

Well, thank you. Thank you. Anamal, you wanted to add an ending point?

Yeah, no, I just wanted to add that almost all HR activity is high risk just because of the potential that it would impact— it has the potential of of creating discrimination or violating privacy. So having a system, a program in place where you're at least annually checking these high-risk systems and processes is critical to one's success.

Well, thank you. Thank you very much, Tara and Elamu, for generously sharing all of your insight on this complex topic. And for those that are requiring the SHRM credit, Here's the activity code in— let me just put this in the chat. Hopefully everybody could see that the SHRM activity name is AI in the Workplace and the activity code is 25-M as in Mary, T as in Tom, 5, C as in cat, S. We will— I don't see anything in our Q&A. There was one question just about the spelling of agentic AI. I provided that. And I thank everyone for attending today. And what we'll do is for each of the participants, we'll send you a link of the presentation by email along with the addresses of our presenters today and a link to our website, ramonlaw.com. You'll see that too. Our next coffee talk is scheduled for January 2026. And until then, have a wonderful day. And thank you again for participating.

Thanks, everyone.

Thank you.