AI Governance Lead hiring kit

Every step to hire the person who tracks where your organisation actually uses AI, and can prove that use is responsible and lawful.

About this kit — the 5Ws

An AI governance lead answers one question for the whole organisation: where do we actually use AI, and can we show that use is responsible and lawful? The role sits between legal, engineering and HR. Day to day, that means keeping an AI inventory — a current, named list of every AI system in use. It means working with qualified counsel to work out each system's risk tier: how closely it needs watching, based on what it's used for, who it affects, and which rules apply. It means making sure human oversight is real — a person genuinely reviews high-stakes AI decisions, not a box ticked without looking. And it means keeping records that are audit-ready, so a regulator or auditor could check them without a scramble. The lead works alongside legal counsel throughout the process; they do not replace counsel or give the final legal opinion themselves.

Calibrated for:: Senior individual contributor to first-line manager.
Timeline:: Set an approval-to-offer target at intake, allowing for panel availability, candidate adjustments, references and any lawful checks.

Who: Hiring managers, recruiters and General Counsel teams at any organisation that uses AI in a way that touches real decisions — hiring, lending, healthcare, safety — across more than one jurisdiction.
What: Use this kit to test whether a candidate can maintain an AI inventory, classify risk with counsel, implement oversight and keep audit-ready records.
When: Use it from the moment someone in legal, engineering or HR first asks 'what AI systems are we actually running, and who signed off on them?' — before the requisition is approved — and keep using it until you've traced where the hiring timeline actually slipped.
Where: Organisations deploying AI across functions or jurisdictions.
Why: The work sample, structured questions and rubric let you compare job-related evidence consistently. For this role, that means checking whether a candidate has actually kept an AI inventory current and got a team to follow an oversight process — not only whether they can describe one.

The competency model · 6

Use these competencies to compare job-related evidence. Review any apparent gap in a must-have before deciding.

AI inventory and risk classificationMust-have · 25
Finds every AI system in active use across teams, then works out its risk tier from how it's actually used, not its label — weighing the intended use, who it affects, whether the organisation is a provider or a deployer, and which regime applies — and records the classification with counsel.
Regulatory translationMust-have · 20
Works with qualified counsel to turn a specific regulation into a checkable step a team can follow, rather than a general summary of the law — and owns making sure the step actually runs, rather than giving the final legal opinion.
Process design engineers actually followMust-have · 20
Has built a governance step that a product or engineering team adopted willingly and that is still running a year later.
Plain-language executive communicationMust-have · 15
Explains a governance risk or requirement to a non-specialist leader in a few clear sentences, with a specific recommendation.
Cross-functional coordinationCan learn · 10
Gets legal, engineering and HR into the same room and through a decision without holding formal authority over any of them.
Audit-trail and evidence disciplineCan learn · 10
Keeps records in a form a regulator or auditor could use directly, produced as a side effect of the process rather than written up afterwards.

What's required and what's optional

Your hiring journey for AI Governance Lead. Select a stage to jump to it.

Required for every hire
Optional — use when it adds evidence
AI boost — a big drafting win
Colour = phase

Phase 1
Plan
1. 01Plan the roleRequired
2. 02Agree successRequiredAI boost
Phase 2
Attract
1. 03Write the jobRequiredAI boost
2. 04Find candidatesOptionalAI boost
Phase 3
Select
Phase 4
Decide
Phase 5
Onboard & learn
1. 12Help them settle inRequired
2. 13Measure time to hireRequiredAI boost

AI drafts, people decide: Use AI to draft, rewrite and summarise your own material — never to rank, score, screen out or decide on candidates, and never with a candidate's personal data.

Plan

Attract

Select

Decide

Onboard & learn

Solid = required · dashed = optional · arrow keys move between steps

Stage 1 of 13Required

0 of 3 done

Plan the role

Workforce planning and requisition approval

Who runs it: Hiring manager + finance / HR business partner
Done when: An approved requisition with a written business case, budget and a named decision-maker.

Key tool

Answer these before the role is approved

1Which AI systems will this person be accountable for in their first year?
2How do we know today which of our AI systems would count as high-risk under the rules that apply to us?
3Could an existing person in legal or engineering grow into this in the next two quarters?

AI as an advantage4D framework

Delegate: Hand AI the first draft of the business case and the build / borrow / buy comparison. The decision, the budget and the sign-off stay with people.

Show the prompt and the checks

Describe: You are helping a hiring manager write a business case for an AI Governance Lead role. Context: I will paste the problem the hire solves, the work it involves, the capacity we already have and the time we have. Produce: (1) a one-sentence problem statement in business terms; (2) a build / borrow / buy comparison with the strongest argument for each; (3) the questions a finance partner would ask; and (4) a short recommendation with the evidence it rests on. Use British English and plain language. Do not invent figures — leave [brackets] where I need to supply numbers. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check every number and claim against your own notes and strike anything the draft assumed. Make sure 'buy' is argued from ongoing work, not from a job title.
Diligence: The hiring manager owns the final case and the budget request. No candidate information belongs here; AI drafts the case, people decide whether to open the role.

Don't miss: Opening the role only because a regulatory deadline is approaching, with no plan for what the person does once it passes.

Framework

Build · Borrow · Buy

Before opening a role, decide whether to build the capability in your current team, borrow it (contractor, agency, partner), or buy it (a permanent hire).

Write the problem the hire solves in one sentence, in business terms — not the job title.
Test Build: could an existing person grow into this within the time you have?
Test Borrow: is the need time-boxed, or does it end once a system is shipped?
Choose Buy only when the work is ongoing, core to the product and nobody inside can absorb it.
Record the decision, the budget and the one person who signs off the final hire.

Why it works: Writing the build, borrow or buy decision down exposes a vague or temporary need before it becomes a permanent requisition — and gives every later stage an anchor to check against.

• Name the final decision-maker — for example, whoever the role would report to: General Counsel, the CTO or a Chief AI Officer.

Is this a dedicated role?

Decide whether the work is sustained and substantial enough for a dedicated owner by writing down the workload, the risk, the capacity you already have and the outcomes you expect.

Answer these before the role is approved

1.Which AI systems will this person be accountable for in their first year?
Listen for: Named systems in use today, or committed on the roadmap.
Red flag: 'We want someone across all things AI' with nothing specific.
2.How do we know today which of our AI systems would count as high-risk under the rules that apply to us?
Listen for: A straight answer matters more than a confident-sounding one: if nobody can currently name which systems are high-risk, that gap is the job.
3.Could an existing person in legal or engineering grow into this in the next two quarters?
Listen for: Either a specific internal candidate with a credible path to ready, or a clear reason nobody currently fits.
4.Is the need ongoing, or does it end once a specific filing or audit is complete?
Listen for: Ongoing work — inventory upkeep, new systems, oversight processes — justifies a permanent hire; a single filing may suit a consultant.
5.What's the running cost of leaving this role open another month?
Listen for: A concrete consequence: a launch delayed for sign-off, an unanswered regulator letter, a system nobody can describe when asked.

Build, borrow or buy?

Build: give an existing legal or compliance generalist a ring-fenced learning budget and a mentor with engineering depth.
Borrow: a specialist consultant to build the first inventory and risk classification, then hand it over within three months.
Buy: a permanent AI governance lead — choose this when several systems need continuous oversight across more than one jurisdiction.

Watch out for

Confusing this role with a data protection officer. If the hardest question is 'what does this AI system do and is it high-risk', you need a governance lead; if it is 'how do we handle personal data lawfully', that is a related but broader privacy role this one works alongside.

Stage 2 of 13Required

0 of 2 done

Agree success

Intake meeting and competency model

Who runs it: Recruiter + hiring manager
Done when: A signed-off competency model: 5–7 competencies, each marked must-have or trainable, with weights.

Key tool

Ask the hiring manager

1Which of the systems or areas this person will own worries you most, and why?
2When something there went wrong recently, how did you find out?
3In 12 months, what will be shipped, fixed or running for you to call this hire a success? Agree two or three measurable outcomes.
4Who will they work with most closely?
5What could a strong candidate learn in their first three months? Those capabilities are 'trainable' — never use them to filter applications.

AI as an advantageAI boost4D framework

Delegate: Hand AI your raw intake notes to turn into a draft competency model. Choosing the must-haves and the weights stays with the hiring manager and recruiter.

Show the prompt and the checks

Describe: You are helping a recruiter and a hiring manager build a competency model for an AI Governance Lead role. Context: I will paste the notes from our intake meeting, including the 12-month outcomes and what the hiring manager worries about most. Produce a table of 5–7 observable competencies with, for each: a one-line definition; whether it is a must-have or trainable, with the reason; what evidence of it looks like in real work; and a suggested weight so the weights total 100. Use British English and inclusive wording, avoid years-of-experience or named employers as evidence, and keep every competency job-related. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that each competency is observable and job-related, that nothing describes a type of person rather than the work, and that trainable items haven't been marked must-have.
Diligence: The hiring manager signs off the final model and weights before anyone meets a candidate. No candidate data goes into the prompt; AI drafts, people decide.

Don't miss: Writing a competency model that is really a list of frameworks and certifications, rather than the inventory, classification and oversight work this role actually does.

Framework

Competency model (must-have vs trainable)

A short list of the observable capabilities the job needs, split into what the hire must bring on day one and what you will teach.

Start from the 12-month outcomes, then ask which capabilities produce them.
Keep 5–7 competencies. With more, interviewers struggle to score each one separately.
Mark each must-have or trainable. Only must-haves can count against a candidate.
Give each a weight so they sum to 100, agreed before anyone meets a candidate.
Write what evidence of each looks like, so interviewers know what they are listening for.

Why it works: Agreeing the criteria before meeting candidates stops the bar moving from one candidate to the next, and makes it harder for 'I'll know it when I see it' to decide the hire.

Core intake questions (ask for every role)

Book 45 minutes with the hiring manager before anything is advertised, and write the answers down.
Which of the systems or areas this person will own worries you most, and why?
When something there went wrong recently, how did you find out?
In 12 months, what will be shipped, fixed or running for you to call this hire a success? Agree two or three measurable outcomes.
Who will they work with most closely?
What could a strong candidate learn in their first three months? Those capabilities are 'trainable' — never use them to filter applications.
Who is on the interview panel, and is their time held for the next four to six weeks?

Questions specific to this role

1.Which regulatory regimes and jurisdictions does this role need to cover from day one?
Listen for: Specific regimes named — for example a US state law and the EU AI Act — rather than 'everywhere we operate'.
2.Who currently signs off before a new AI system goes live, and will that authority move to this hire or stay where it is?
Listen for: A clear answer on where approval sits today, so the new hire's mandate is defined rather than assumed.
3.Has anyone in legal or engineering already attempted an AI inventory, even an incomplete one, that this person would start from?
Listen for: Whether a starting point exists or the hire begins from zero — it changes how ambitious the first 90 days can be.

What success looks like in 12 months

Every AI system in active use is in a current inventory with a named owner and a risk classification.
At least one system that had no human-oversight step now has one that is actually used.
A record exists for every high-risk decision that a regulator or auditor could review without extra work.
Legal, engineering and HR can each name the one governance process that changed how they ship or hire.

Stage 3 of 13Required

0 of 3 done

Write the job

Job description and pay band

Who runs it: Hiring manager (content) + recruiter (publishing)
Done when: A published job description that states outcomes, the must-haves, how AI tools are used and the pay information the law requires.

Key tool

AI Governance Lead

We're looking for an AI governance lead to own how [company] uses AI responsibly and lawfully as we deploy it across [hiring/customer operations/product]. You'll build and keep current the inventory of AI systems in use, classify each by risk, run our human-oversight and impact-assessment processes, and keep the records a regulator or customer could ask for — working closely with legal, engineering and HR.

What you'll do

•Maintain a current inventory of every AI system in use, with a named owner and a risk classification for each — reasoned from intended use, who it affects, the organisation's role and the applicable regime, recorded with counsel.
•Work with legal counsel to turn the regulations that apply to us into specific steps teams can follow — not a policy document nobody reads, and not a final legal opinion from this role alone.
•Design and run human-oversight processes for high-risk decisions — making sure a person actually reviews or can override the output, not just that a policy says they should — and check the process is really being used.
•Keep audit-ready records: enough detail on what a system did, who reviewed it and what happened next that a regulator or auditor could follow it without extra explanation.
•Coordinate legal, engineering and HR so a governance requirement becomes a shipped process, not a standoff.
•Brief leadership in plain language on AI risk and what is being done about it.

What you need

•You can show how you built, improved or ran an AI inventory or risk-classification process, and what changed because of your work.
•You can show a governance process a team adopted and is still running — not just a policy you wrote.
•You can work with counsel to turn applicable requirements into practical checks a team can follow.
•You can explain a legal or technical risk to a non-specialist leader in a few plain sentences.

Nice to have

•Experience running human-oversight or impact-assessment processes — checking a system's likely effect on people before or after launch — for high-risk AI systems.
•Experience coordinating legal, engineering and HR without formal authority over any of them.
•Familiarity with more than one regulatory regime — for example, both a US state and the EU.
•A background in engineering or product, not only legal or compliance.

How we use AI tools

•You'll use approved AI tools to move through review and inventory work, and check what they produce as carefully as you would a colleague's. Use only approved tools, and never put confidential, privileged, personal or security-sensitive material into one unless its use has been authorised.
•You'll know when a governance judgement shouldn't be delegated to a model at all.
•The triage exercise itself is a different context: use whatever AI tools you find useful there, and note in your submission which ones and how.

Pay

Salary range: [currency, minimum–maximum], plus [equity/bonus/benefits]. The range reflects [location/working pattern]. We place every offer within it using the same pre-set, job-related, gender-neutral factors — seniority, number of regulatory regimes the role will own, scope of the mandate (individual contributor or first-line manager) — never previous salary or negotiating style.

AI as an advantageAI boost4D framework

Delegate: Hand AI the first draft of the job description from your signed-off competency model. The must-haves, the pay range and the final wording stay with people.

Show the prompt and the checks

Describe: You are helping write an outcome-based job description for an AI Governance Lead role. Context: I will paste the competency model (must-have and trainable, with evidence), the 12-month outcomes, how the team uses AI tools, the location and working pattern, and the pay range. Produce: a summary paragraph that leads with the problem and what the hire will own; 'What you'll do' as outcomes, not tasks; 'What you need' containing only the must-haves; 'Nice to have' for the trainable items; 'How we use AI tools'; and a pay section that states the range. Use British English and inclusive, gender-neutral wording, avoid hype, and replace any 'X years' with the capability it stands for. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that 'What you need' contains only the must-haves, that no degree, employer or years requirement crept in, and that the pay range and location are exactly what was approved.
Diligence: The hiring manager owns the content and the recruiter owns publishing, including the pay information the law requires for each location. AI drafts the advert; people decide what it says.

Don't miss: Listing every regulation by name as a requirement. Nobody has deep expertise in all of them; what matters is the ability to read a new one and turn it into a process.

Stage 4 of 13Optional

0 of 3 done

Find candidates

Sourcing strategy

Who runs it: Recruiter / sourcer
Done when: A shortlist-ready pipeline from at least three channels, with outreach tracked.

Use when:: Inbound applications won't give you enough qualified candidates.
Skip when:: Your shortlist already comes from inbound applications or referrals.

Key tool

Search query

("AI governance" OR "responsible AI" OR "AI compliance" OR "algorithmic risk") AND ("inventory" OR "risk classification" OR "impact assessment" OR "human oversight") AND ("EU AI Act" OR "Local Law 144" OR "AI regulation") NOT ("intern" OR "student")

First outreach message

AI as an advantageAI boost4D framework

Delegate: Hand AI the search queries and the first draft of the outreach template. Choosing channels, personalising to a candidate's public work and sending stay with the recruiter.

Show the prompt and the checks

Describe: You are helping a recruiter source candidates for an AI Governance Lead role. Context: I will paste the must-have competencies, the kind of work we want evidence of, the channels we are using and the pay range. Produce: (1) one search query per channel, using OR for alternatives, AND for things that must all appear and NOT to exclude, with a one-line note on what each query looks for; and (2) a first-outreach template of under 120 words that opens with a [placeholder for something the candidate built], states the problem we are hiring to solve and the pay range, and ends with a low-pressure question. Use British English and inclusive wording. Do not refer to any specific person. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that the queries search for evidence of the work rather than job titles alone, and that the template claims nothing about the role or the pay you can't back up.
Diligence: The recruiter personalises every message to something the candidate actually built, and sends it. No names or profile data go into the prompt; AI drafts, people decide whom to contact.

Don't miss: Search for inventory, classification and oversight work across legal, engineering, product and compliance backgrounds.

Framework

Channel mix + evidence-first outreach

Spread sourcing across channels where the work is visible, and open outreach with the problem, not the perks.

Pick channels where candidates show their work, not only where they list job titles.
Write one search query per channel. OR joins alternatives, AND joins things that must all appear, NOT excludes. Keep the version that works best.
Personalise the first line to something the candidate actually built or wrote.
Lead with the problem and the pay range. Save the perks for later.
Track reply rates by channel each week and drop the channel that isn't working.

Why it works: Searching for evidence of the work can surface candidates whose current title differs from the vacancy, or whose CV undersells what they have done.

Sourcing basics

Adapt the search query for each platform — the same words behave differently on each site.
Candidates with adjacent titles may have relevant evidence. Search for the work and outcomes the role needs, not the current title.
Channel activity is a lead, not evidence. Review linked work and examples against the written competencies.

Where to look

Legal, risk and compliance networks

Profiles here can link to the actual policies or processes a person has built, which you can review directly.

Engineering and product communities that discuss AI risk

Search by the governance work described, since backgrounds here range across engineering and product rather than a single credential.

Conference talks and published write-ups on AI governance

A talk or write-up that names a process actually run, and what changed because of it, is reviewable evidence of judgement.

Your own legal and engineering teams' referrals

People who worked with the candidate on an audit or a risk review can direct you to the records or processes they produced.

Professional networks, searched by what they have done rather than their title

The title is new and inconsistent; the work is what to search for.

Boolean search string

("AI governance" OR "responsible AI" OR "AI compliance" OR "algorithmic risk") AND ("inventory" OR "risk classification" OR "impact assessment" OR "human oversight") AND ("EU AI Act" OR "Local Law 144" OR "AI regulation") NOT ("intern" OR "student")

First outreach message

Hi [name] — I read your [post/talk] on [specific thing], especially [one detail]. We run AI across [n] parts of [company] and don't yet have a single person who can say what's in use and how it's reviewed. We're hiring an AI governance lead to own that, paying [range]. Would you be open to a 20-minute call to hear what the problem looks like?

Stage 5 of 13Required

0 of 3 done

Check applications

Application screening

Who runs it: Recruiter
Done when: Every application reviewed against the same written knockouts within five working days.

Key tool

Reject only if one of these is missing

•Can meet the role's work-authorisation requirements by the start date, with sponsorship where the employer offers it. Don't ask for documents at this stage.
•Describes at least one governance or risk process they built or ran, not only policy they authored.
•Shows they can read and apply a specific regulation, not only summarise one.

AI as an advantage4D framework

Delegate: Hand AI the job of turning your written knockouts into a consistent checklist with reason codes. Reviewing each application stays with the recruiter.

Show the prompt and the checks

Describe: You are helping a recruiter prepare an application-screening checklist for an AI Governance Lead role. Context: I will paste the must-have competencies and our written knockout criteria. Produce: (1) each knockout as a yes/no question answerable from an application alone; (2) a short list of reason codes for a 'no'; and (3) a note of any criterion that looks like a proxy — a degree, employer brand or employment gap — rather than a job-related requirement, with a suggested rewrite. Use British English. Do not evaluate any applicant and do not ask for applicant details. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that each question is binary and job-related, and that every flagged proxy has been removed or justified in writing.
Diligence: A person reviews every application against the checklist and records the reason. Never paste CVs or applicant details into an AI tool, and never let a tool screen anyone out — in New York City and the EU that can bring automated-decision rules into play.

Framework

Knockout criteria

A small set of yes/no requirements, written in advance, applied to every applicant the same way.

Derive knockouts only from must-have competencies and genuine legal requirements.
Keep them binary and answerable from the application itself.
Apply them in the same order to every application and log the reason for each rejection.
Do not use proxies such as university, employer brand or employment gaps as knockouts.
Anything ambiguous gets a second review or moves forward to the skills stage.

Why it works: Early screening rejects people before richer evidence exists, so its criteria need the most care. Written criteria make decisions reviewable — but each one must also be job-related, applied consistently and checked for unjustified adverse impact.

Screening rules

Do not use degrees, employment gaps or certifications as filters unless they are demonstrably job-related and justified for this role.
Judge the claims in a CV, not how polished it is — a well-written CV may or may not have had AI help, and either way it is the evidence that matters.

Knockout criteria

Can meet the role's work-authorisation requirements by the start date, with sponsorship where the employer offers it. Don't ask for documents at this stage.
Describes at least one governance or risk process they built or ran, not only policy they authored.
Shows they can read and apply a specific regulation, not only summarise one.

Green flags

Names a process a team adopted and that is still running, with what changed because of it.
Describes a disagreement with engineering or product and how it was resolved without a mandate.
Points to a specific record or artefact you could actually check.

Red flags

Lists frameworks, principles and certifications authored, with no evidence any of it changed how a system got built.
Only policy-writing experience, with no sign the policy was ever used.
Describes governance work only in the abstract, with no system, regulation or organisation a reference could actually confirm.

Compliance checkpointNew York CityEU

For a New York City employment decision, work out whether a tool is an 'automated employment decision tool' (AEDT) under Local Law 144 — one that uses covered techniques to substantially assist or replace a discretionary decision. Before using a covered tool, make sure an independent bias audit was completed no more than a year earlier, publish the required summary, and give covered candidates or employees the required notice at least ten business days before use. In the EU, the AI Act (Annex III) lists AI used to recruit, filter applications or evaluate candidates as high-risk, subject to the Article 6(3) exception; the related obligations apply from 2 December 2027 under the amended timetable. A manual screen does not exempt an AI tool used elsewhere in the process.

Sources: NYC DCWP — Automated employment decision tools · EU AI Act — consolidated Regulation (EU) 2024/1689 · checked 2026-09-25

Stage 6 of 13Optional

0 of 2 done

Recruiter call

Recruiter screen

Who runs it: Recruiter
Done when: A 20–30 minute call that confirms logistics, motivation and one or two must-have signals.

Use when:: You are hiring at volume, or pay and logistics need confirming early.
Skip when:: You have only a handful of applicants — fold the pay and logistics questions into application screening instead.

Key tool

Ask every candidate, in this order

1Walk me through the most recent governance process you were responsible for — who ended up using it?
2How did you know the process was actually being followed?
3Which regulatory regimes have you worked with directly — not just read about?
4Did you build that process largely on your own, or as part of a larger compliance or legal team?
5Our range for this role is [range]. Does that work for you?

AI as an advantage4D framework

Delegate: Hand AI the first draft of the screening-call script and its evidence anchors. Running the call and taking the notes stay with the recruiter.

Show the prompt and the checks

Describe: You are helping a recruiter write a 20–30 minute structured screening call for an AI Governance Lead role. Context: I will paste the must-have competencies, the logistics we need to confirm (location, working pattern, notice period) and the pay range. Produce: an opening that explains the process, the timeline and the pay range; 4–6 questions in a fixed order, each with one line on what a strong answer contains; and a closing that asks whether the published range works. Use British English and inclusive wording. Do not include questions about salary history, age, family, health or any other protected characteristic. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that every question is job-related and lawful, that the pay question asks whether the range works rather than for history, and that the anchors describe evidence, not impressions.
Diligence: The recruiter asks the same questions of everyone and writes the notes. No candidate details go into the prompt; AI drafts the script, people run the call and decide.

Don't miss: Asking the recruiter to weigh in on whether a specific regulatory reading is correct — that belongs in the inventory-and-regulation interview round; the recruiter call checks logistics and whether the candidate can describe their own work clearly.

Framework

Structured screening call

The same short set of questions for every candidate, with notes taken against what a strong answer contains.

Open by explaining the process, timeline and pay range. No surprises later.
Confirm logistics: location, working pattern, notice period and whether the range works for them.
Ask the same 4–6 questions in the same order, and note evidence, not impressions.
Leave time for the candidate's questions. Don't score their questions unless they test a written, job-related competency.
Decide within 48 hours and tell the candidate either way.

Why it works: Using the same questions and written evidence anchors makes answers easier to compare, and a short, predictable call respects the candidate's time.

Screening call basics

Set the decision timetable before sourcing and tell candidates when to expect each update.
Ask every candidate what draws them to this particular role, and listen for interest in the work described rather than the title.
Confirm notice period and whether they are in other processes, so you can plan the timetable.
End every call by asking whether the published pay range works — never ask for salary history.

Recruiter screen questions

1.Walk me through the most recent governance process you were responsible for — who ended up using it?
Listen for: A specific process, a real team that adopted it and the candidate's own part in it.
Red flag: Talks about 'the team' rolling out the process but can't say what they personally decided or built.
2.How did you know the process was actually being followed?
Listen for: Any concrete check — an audit, a sample review, records that exist because of it.
Red flag: 'People seemed to like it' or 'nobody complained'.
3.Which regulatory regimes have you worked with directly — not just read about?
Listen for: Named regimes tied to specific work, so the panel knows what to probe rather than re-covering ground the recruiter already checked.
4.Did you build that process largely on your own, or as part of a larger compliance or legal team?
Listen for: A candid answer on their own share of the work — it flags whether the interview loop needs to dig for what they personally decided.
5.Our range for this role is [range]. Does that work for you?
Listen for: A clear answer on whether the published range works. Don't ask for salary history — this process sets pay from the published band and pre-set, job-related factors.

Compliance checkpointUS (state and city)EU

Don't ask for salary history. In the EU, national laws implementing Article 5(2) of Directive (EU) 2023/970 must prohibit the question. US rules vary, but jurisdictions including California and New York prohibit employers from seeking salary history. Ask whether the published range works instead.

Sources: EU Pay Transparency Directive 2023/970, Article 5 · California Labor Commissioner — salary history · New York State DOL — salary history ban · checked 2026-09-25

Stage 7 of 13Required

0 of 2 done

Work sample

Skills assessment / work sample

Who runs it: Hiring manager (design) + recruiter (logistics)
Done when: Every shortlisted candidate completes the same job-shaped task, marked against criteria written in advance.

Key tool

Triage a governance finding and design the intake step that should have caught it

You receive a fictional company profile and short descriptions of five AI systems it runs. An internal review found that one of those systems has operated for months without a recorded risk tier and without anyone reviewing its output. Decide how you'd classify and handle that system today. Then design the intake step that should have caught this earlier — one a busy product team would actually follow.

Planned for up to three hours (adjustments available on request). At the agreed stopping time, write a short note on what you would examine next, and what you deliberately left out.

AI as an advantage4D framework

Delegate: Hand AI the first draft of the work-sample brief and its marking sheet. Choosing the task, setting the timebox and marking stay with the hiring manager.

Show the prompt and the checks

Describe: You are helping a hiring manager design a work sample for an AI Governance Lead role. Context: I will paste the competency model, a real problem the team solved recently with anything confidential removed, the timebox, and our AI-tool policy for candidates. Produce: a candidate-facing brief (what to do, what to hand in, the time cap, how to request an adjustment, which AI tools are allowed and how to report their use); and a marking sheet with 4–6 criteria tied to named competencies, each with what a 1, a 3 and a 5 look like. Use British English and plain, inclusive wording. Do not design anything that needs more than the stated time. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that the task fits the timebox, that every criterion maps to a competency, and that the brief gives all candidates the same starting materials.
Diligence: The hiring manager owns the task and the criteria, and people mark every submission. Do not paste candidate submissions into an AI tool for scoring; AI drafts the brief, people mark and decide.

H-EvaluateH-Evaluate can generate a job-specific assessment from your job description, so you don't have to build the task by hand.How H-Evaluate helps →

Don't miss: Asking for a general essay on AI ethics. It measures writing ability, not the job.

Framework

Work-sample test

A small, realistic slice of the job, marked against criteria written in advance. Give candidates equivalent materials and arrange reasonable adjustments where required.

Take a real problem the team solved recently and shrink it to fit the timebox.
Write the marking criteria first, tied to the competency model.
Timebox honestly — for take-home work, a few hours at most — and say so in the brief.
State the AI-tool policy in writing. Where the job permits these tools, use equivalent conditions in the assessment and evaluate how candidates verify their output.
Mark without CV details where you can, and have two people mark borderline submissions.

Why it works: A well-designed work sample gives direct evidence of job-relevant skill rather than a proxy for it, and gives candidates a realistic preview of the work.

Assessment rules for every candidate

State the planned time cap and how to request an adjustment. At the agreed stopping time, ask candidates to note what they would examine next and what they left out — never reward unpaid overtime.
Give every candidate the same starting materials, and use a second marker for borderline submissions.
Say in writing which AI tools are allowed and ask candidates to tell you how they used them.
Invite every candidate to ask for adjustments, and answer each request promptly.
Pay for anything the task costs the candidate to run, such as model or cloud usage.

The work sample

Triage a governance finding and design the intake step that should have caught it

Timebox: Planned for up to three hours (adjustments available on request). At the agreed stopping time, write a short note on what you would examine next, and what you deliberately left out.

What the candidate hands in

Your risk classification for the system in the finding, with the reasoning.
Your immediate recommendation: what happens to the system this week.
The intake step you'd add, written the way you'd actually hand it to a product team.

Marking criteria (write these first)

The risk classification is reasoned from the system's actual use, not just its label.
The immediate recommendation is proportionate — not everything found in a review needs to be switched off.
The intake step is specific enough that a team could follow it without asking a follow-up question.
The note shows judgement about what's urgent, what's important and what can wait.
The writing is in plain language a non-specialist reader could act on.
Nothing in the submission promises a compliance guarantee no process can actually deliver.

Adjustments: Candidates can ask for more time or a live, talked-through version instead. We'll share the same materials with everyone in advance if requested.

Watch out for

Do not ban approved AI tools categorically, but never put confidential, privileged, personal or security-sensitive material into one unless its use and data handling have been authorised.

Compliance checkpointUSGreat BritainEU

In the US, covered employers must provide a reasonable accommodation to a qualified applicant with a disability unless it would cause undue hardship (ADA). In Great Britain, the Equality Act 2010 requires reasonable adjustments in recruitment. In the EU, the duty comes from national equality law. Don't ask for more medical information than the law allows.

Sources: EEOC — prohibited practices · Equality Act 2010 · checked 2026-09-25

Stage 8 of 13Required

0 of 3 done

Structured interviews

Structured interview loop

Who runs it: Interview panel (named in advance)
Done when: Every competency has a lead interviewer and at least one second source of evidence, with the same questions for every candidate.

Key tool

Interview questions by pillar

Free in this kit: Domain questions for every round. The other three pillars and the AI-fluency check are measured by H-Evaluate.

Free in this kit

General Counsel or senior legal counsel · AI inventory and risk classification · Regulatory translation

1.Walk me through how you'd build a first AI inventory at a company with no central record of what uses a model. Where do you start, and how do you know you're not missing anything?
AI inventory and risk classification
Good answerNames concrete sources — procurement records, vendor contracts, engineering repositories, a team survey — and cross-checks at least two independent sources against each other.
Weak answerAssumes a single survey will surface everything accurately.
2.A hiring tool has been scoring candidates for months with no recorded risk tier and no one reviewing its output. Walk me through how you'd classify its risk today — intended use, who it affects, whether we're the provider or the deployer — and what you'd have in place by the end of the week.
AI inventory and risk classification
Good answerReasons the classification from how the tool is actually used rather than its label, loops counsel in on the determination, and names concrete week-one steps — for example restricting the use pending review and tracing who approved it — not just a write-up.
Weak answerDescribes the finding without reaching a classification or changing how the tool is used.
3.A product team asks whether its AI CV-screening feature falls under the EU AI Act's high-risk rules. How would you work out the answer with counsel — what evidence would you gather about the feature, what would you hand the team, and how would you record what is still uncertain?
Regulatory translation
Good answerGathers intended use, affected people, the organisation's role (provider or deployer) and decision influence; brings counsel in for the legal call; hands the team a short record of the classification, open questions and next review date.
Weak answerGives a confident legal verdict from memory, or hands the question to legal without gathering any evidence about the feature.

Optional follow-ups (1)

4.A vendor tells you their screening model is 'explainable and bias-tested.' What would you actually ask for before relying on that claim to classify or approve the system?
AI inventory and risk classification
Good answerRequests specific evidence — intended-use limits, evaluation methodology, subgroup results, data provenance, monitoring commitments, contractual accountability — rather than accepting the summary.
Weak answerAccepts the vendor's description, or asks for a single headline metric.

AI as an advantageAI boost4D framework

Delegate: Hand AI the drafting of probe questions and strong / weak anchors for one competency. Asking, listening and scoring stay with the interviewer.

Show the prompt and the checks

Describe: You are helping an interviewer prepare a structured technical interview for an AI Governance Lead role. Context: I will paste one competency, its evidence description and the core question we ask every candidate. Produce: four probes in this fixed order — what would you do, why that choice, what else did you consider, how would you know it worked — tailored to the question; a one-line description of a strong answer and of a weak answer; and two follow-ups to use only if time allows. Use British English and inclusive wording. Keep everything about the work, nothing about the person. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that the probes test the named competency rather than trivia, that the anchors describe observable evidence, and that no question touches a protected characteristic.
Diligence: Interviewers ask the same core questions of every candidate and score alone against the rubric. Interview notes and candidate names never go into an AI tool; AI drafts the questions, people interview and decide.

H-EvaluateH-Evaluate can add evidence on Cognitive, Situational judgement, Behavioural and AI fluency for your panel to review alongside these interviews.How H-Evaluate helps →

Don't miss: Scheduling all three rounds back-to-back in one day. Give interviewers time between rounds to submit independent scores before comparing notes on a specific system or regulation.

Framework

Structured technical interview

Every candidate gets the same job-specific questions, each interviewer leads on specific competencies, and every answer is probed with the same four follow-ups: what would you do, why, what else did you consider, and how would you know it worked.

Give each competency a lead interviewer, plus a second source of evidence — the work sample, another round or an independent marker. Avoid asking the same thing twice, but never let one person's view be the only evidence for a critical competency.
Ask the three core questions for your round, in order, for every candidate. Use an optional follow-up only if there is time.
Probe each answer: why that choice, what else they considered, and how they would know it worked — until you hear the candidate's own technical decision.
Take notes on evidence during the interview. Don't rate until it's over.
Fill in your interviewer sheet and submit it before you talk to any other interviewer.

Why it works: Structured interviews make answers comparable: every candidate faces the same job-related questions and is scored against the same anchors.

Interview rules

Use the same core questions in the same order for every candidate.
In the work-sample review, understand the candidate's decisions against the rubric — don't turn it into a debate about your preferred solution.
Avoid trivia disconnected from a real job decision. Use a realistic debugging, design or evaluation problem instead.

Compliance checkpointUSUKEU

Don't ask about protected characteristics — such as age, disability, pregnancy or family plans, religion, race or nationality — unless applicable law permits the question for a specific, necessary, job-related purpose, and HR or counsel has confirmed that basis beforehand. Ask only whether the candidate can meet the role's work-authorisation requirements. If a candidate volunteers protected information, don't probe; record only what is lawfully needed, keep it separate and restrict access.

Sources: EEOC — prohibited practices · Equality Act 2010 · checked 2026-09-25

Where to find more interview questions

Use web question banks for inspiration only: ask every candidate the same job-related questions, check each one against this kit's competencies, and never ask about protected characteristics. Don't reuse this kit's work sample from a public bank — candidates can find questions that circulate online, so a widely posted question tests preparation more than skill.

Show 7 sites

US OPM — Structured interviews(opens in a new tab)
US federal guidance on building structured interviews, with a guide, training material and sample questions with rating scales.
FreeFor interviewers
Acas — Interviewing job applicants(opens in a new tab)
UK public guidance on preparing fair interviews, asking applicants the same questions and avoiding discriminatory ones.
FreeFor interviewers
Workable — Interview questions library(opens in a new tab)
Sample interview questions for employers, listed by job role, including machine learning, data and engineering roles.
FreeFor interviewers
Indeed for Employers — Interview questions(opens in a new tab)
Sample interview questions for employers by job title and skill, with notes on what to look for in answers.
FreeFor interviewers
Tech Interview Handbook(opens in a new tab)
Open-source software-engineering interview preparation: coding, system design and behavioural questions.
FreeFor candidates and interviewers
Chip Huyen — Machine Learning Interviews Book(opens in a new tab)
Free online book with knowledge questions on maths, computer science and machine learning, grouped by difficulty.
FreeFor candidates and interviewers
Blind — Interview questions channel(opens in a new tab)
Anonymous posts by tech workers about questions they report being asked. Unverified; some content needs sign-in.
Free, some content needs sign-inCandidate reports, unverified

Links checked 2026-10-05. External sites; we don't control their content.

Stage 9 of 13Required

0 of 1 done

Compare evidence

Scoring, calibration and debrief

Who runs it: Hiring manager (chairs) + panel
Done when: A documented hire / no-hire decision traceable to scored evidence against the competency model.

Key tool

Interactive scorecard

Score one candidate against the rubric. Everything stays in your browser. Download it as a spreadsheet for your records.

AI inventory and risk classification Must-have

Weight

What do 1, 3 and 5 look like?

1: Can't describe a method for finding AI systems in use beyond asking around; treats risk classification as a label rather than a reasoned call.
3: Builds an inventory when asked and classifies systems correctly most of the time, using the obvious source.
5: Builds and keeps an inventory current without being asked, cross-checks it against an independent source, and classifies systems from how they're actually used.

Regulatory translation Must-have

Weight

What do 1, 3 and 5 look like?

1: Summarises a regulation in its own words but can't say what a team should actually do differently because of it.
3: Turns a regulation into a checklist when asked, though it sometimes misses a nuance a specialist would catch.
5: Reads a new regulation unprompted, identifies exactly what changes for the organisation, and hands teams something specific enough to check against.

Process design engineers actually follow Must-have

Weight

What do 1, 3 and 5 look like?

1: Writes policy with no sign it was ever adopted, or a process so heavy that teams route around it.
3: Designs a workable process when asked, though it takes iteration to get teams to actually use it.
5: Designs a process teams adopt willingly because it removes friction as well as adding a check, and it is still running months later.

Plain-language executive communication Must-have

Weight

What do 1, 3 and 5 look like?

1: Can't explain a risk or requirement without jargon or hedging.
3: Gives a clear explanation when asked directly, though it can run long.
5: Explains a risk and a recommendation in a few plain sentences, unprompted, to any audience.

Cross-functional coordination Can learn

Weight

What do 1, 3 and 5 look like?

1: Escalates to a mandate at the first sign of resistance, or avoids the disagreement entirely.
3: Gets the right people in a room and reaches a decision, though it sometimes takes longer than it should.
5: Finds what a requirement costs a resistant team and reduces it, reaching a timely decision without needing formal authority.

Audit-trail and evidence discipline Can learn

Weight

What do 1, 3 and 5 look like?

1: Keeps a policy document but no record of what actually happened in specific cases.
3: Keeps records when told to, covering the obvious cases.
5: Designs records to be produced automatically as a side effect of the process, covering the cases a regulator would actually ask about.

Weighted score– / 5

AI as an advantage4D framework

Delegate: Hand AI the drafting of a blank debrief worksheet and agenda from the competency rubric alone. People add the evidence locally; the scores and the decision stay with the panel.

Show the prompt and the checks

Describe: You are helping a hiring manager prepare a debrief for an AI Governance Lead role. Context: I will paste the competency rubric only — the competencies, their weights and their 1, 3 and 5 anchors. Produce: (1) a blank debrief worksheet with one row per competency and empty columns for each interviewer's independent score, the evidence they cite, the spread of scores and an 'evidence gap?' box; (2) a 45-minute agenda: confirm every scorecard is in and reveal all scores at once, discuss the widest spreads using evidence only, review any must-have scored 1, then look at the weighted total and decide (hire, no hire or one targeted follow-up), and record the reasons; and (3) neutral questions the chair can ask to draw out evidence rather than adjectives. Leave every evidence and score cell empty. Do not suggest a score, a rating or a recommendation. Use British English. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that the worksheet follows your rubric exactly — same competencies, weights and anchors — and that the agenda keeps independent scores hidden until the reveal.
Diligence: Interviewers fill in the evidence and scores locally, alone, before the debrief, and the panel decides together. Candidate notes and personal data never go into an AI tool; AI never scores, ranks or compares candidates.

H-EvaluateH-Evaluate gives you a report on each candidate's assessment evidence to bring into this debrief.How H-Evaluate helps →

Don't miss: Letting a strong regulatory translation score carry a candidate who couldn't show any AI inventory work — the two competencies test different things and neither substitutes for the other.

Stage 10 of 13Optional

0 of 1 done

Check references

References and background checks

Who runs it: Recruiter (references) + HR (checks)
Done when: At least two references that test specific competencies, plus only the checks that are lawful and relevant to the role.

Use when:: It is lawful where you hire, and specific evidence from a referee would change the decision.
Skip when:: Local law or company policy rules it out.

Key tool

Ask each referee

1What did [candidate] put in place that's still being used?
2How did they get a resistant team to actually follow a requirement?
3How did non-specialists find working with them?

AI as an advantage4D framework

Delegate: Hand AI the drafting of reference questions aimed at the competency the panel was least sure about. Choosing referees, making the calls and interpreting the answers stay with the recruiter.

Show the prompt and the checks

Describe: You are helping a recruiter write competency-based reference questions for an AI Governance Lead role. Context: I will paste the competency model and the one or two competencies where our evidence is thinnest — no candidate details. Produce: 3–4 questions per competency that ask for specific examples ('tell me about a time…') rather than ratings; an opening question about how the referee worked with the person and for how long; and a closing question about what their next manager could do to help them do their best work. Use British English and inclusive wording. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that the questions ask for examples rather than opinions, that they stay on job-related competencies, and that none asks about health, family or other protected matters.
Diligence: References are taken with the candidate's consent and interpreted by people. Referee answers and candidate details never go into an AI tool; AI drafts the questions, people decide.

Don't miss: Taking a quick 'yes' to 'would you hire them again?' at face value instead of asking for the specific work behind it.

Framework

Competency-based referencing

Treat references as a last structured conversation about the candidate's work, aimed at the competencies where your evidence is thinnest.

With the candidate's consent, ask for two people who saw their relevant work directly — ideally a former manager and a peer.
Accept suitable alternatives if a manager or peer isn't available, and never penalise a candidate for a former employer's no-reference policy.
Aim your questions at the one or two competencies the debrief was least sure about.
Ask for examples, not ratings. 'Tell me about a time they…' works here too.
Set the timing of each background check by the law and policy that apply.

Why it works: Generic reference questions tend to produce little job-related evidence. Asking for specific examples tied to the role's competencies turns referencing into something you can use.

Core reference questions and checks

Open with: 'How did you work together, and for how long?' — it tells you how much weight the rest can carry.
Ask: 'Tell me about a time something they owned went wrong. What did they do?'
Close every reference with: 'What should their next manager do to help them do their best work?'
Verify only claims that were material to the decision — don't verify a degree the role never required.
Run criminal-record checks only where the role justifies them and local law allows; many roles don't need one.
Schedule formal work-authorisation checks at the legally required time: before employment starts in the UK; for US Form I-9, Section 1 by the first day of paid work and Section 2 within three business days.

Reference questions specific to this role

1.What did [candidate] put in place that's still being used?
Listen for: Concrete, lasting work — not general praise.
2.How did they get a resistant team to actually follow a requirement?
Listen for: Independent confirmation of process design that teams actually follow.
3.How did non-specialists find working with them?
Listen for: Examples of clear explanation or productive pushback, not just being liked.

Compliance checkpointUS

If a consumer reporting agency provides a background report, the Fair Credit Reporting Act requires a clear, stand-alone written disclosure and the candidate's written authorisation before you order it. Before rejecting someone because of the report, give them a copy and the FCRA summary of rights and a reasonable opportunity to review and dispute it before any adverse action; if you still reject, send a final adverse-action notice. State and local 'fair chance' laws may delay criminal-history questions or checks until after a conditional offer.

Sources: FTC — Background checks: what employers need to know · FTC — Using consumer reports: what employers need to know · checked 2026-09-25

Stage 11 of 13Required

0 of 2 done

Agree the offer

Offer, negotiation and close

Who runs it: Hiring manager + recruiter
Done when: An accepted written offer within the approved band, with a start date.

Key tool

Build the offer around

•The problem: they'll own a function that currently exists nowhere in the organisation.
•Mandate: a reporting line and the standing to convene legal, engineering and HR.
•Learning: budget and time to track regulatory change relevant to the role.
•Clear scope: what they own now, and what's planned to be added as the function grows.

AI as an advantage4D framework

Delegate: Hand AI the first draft of the offer message built around what the candidate said matters to them. The figure, the approval and the conversation stay with the hiring manager.

Show the prompt and the checks

Describe: You are helping a hiring manager draft an offer message for an AI Governance Lead role. Context: I will paste three general priority categories (for example: learning, flexibility, scope) — not the candidate's words, notes or personal details; the parts of the offer; and the start-date options — without the salary figure. Produce: a warm, plain-English message that links each part of the offer to one of their priorities, says what happens next and when the written offer follows, and invites questions. Use British English and inclusive wording, and leave [brackets] for figures and names. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that nothing promised is outside policy or the approved band, that every claim about the role is true, and that the message reads as personal rather than templated.
Diligence: The hiring manager places the offer in the band using the same pre-set factors for everyone and makes the verbal offer personally. Figures and personal details are filled in by people, never pasted into AI.

Don't miss: Sitting on approvals for a week while a competing offer lands. Get budget sign-off within the band before the final interview, not after.

Framework

Close plan (motivators → offer → objections)

Build the offer around what the candidate told you they care about, anticipate their objections, and make sure the verbal and written offers match.

List the candidate's top three motivators from your notes at every stage.
Make the verbal offer personally, and link each part of it to a motivator.
Ask what else they are weighing and when they have to decide.
Place the offer in the band using the same pre-set, job-related factors for everyone, and record why.
Send the written offer promptly after the verbal one.

Why it works: A close plan ties the offer to the candidate's stated priorities and makes approvals explicit before the final interview.

Offer checklist and negotiation

Stay inside the approved band. If the candidate is worth more, re-level them with evidence rather than stretching the band.
Trade in things that cost less than salary where policy allows: start date, learning budget, working pattern.
Before the written offer, ask: 'What would make this an easy yes?'
Agree approval and the pay band before the final interview, so the offer isn't held up.
The hiring manager makes the verbal offer; the written offer follows within a working day.
Record which pre-set factors placed the offer where it is in the band.
Tell unsuccessful finalists personally, without avoidable delay, with brief feedback.

What will close this candidate

The problem: they'll own a function that currently exists nowhere in the organisation.
Mandate: a reporting line and the standing to convene legal, engineering and HR.
Learning: budget and time to track regulatory change relevant to the role.
Clear scope: what they own now, and what's planned to be added as the function grows.

Compliance checkpointEUUS

Use objective, gender-neutral, pre-agreed factors to place candidates within the band, apply them consistently and record the decision as an internal pay-equity control. Check the national law implementing Directive (EU) 2023/970 and any local record-keeping rules; this recommendation is good practice, not a universal statutory documentation rule.

Sources: EU Pay Transparency Directive 2023/970 · checked 2026-09-25

Stage 12 of 13Required

0 of 2 done

Help them settle in

Pre-boarding and 30-60-90 onboarding

Who runs it: Hiring manager + buddy + HR
Done when: A new hire who has worked through a written 30-60-90 plan tied to the 12-month outcomes, with a check-in at each milestone.

Key tool

Before day one
Laptop, accounts and access to the systems they'll need to inventory, ready before day one.
Days 1–30: learn
Meets legal, engineering, HR and any vendor-management contacts who touch AI systems.
Days 31–60: contribute
Classifies every system in the inventory by risk and gets sign-off from the right owners.
Days 61–90: own
Owns a running inventory and classification process, kept current by design, not by memory.

AI as an advantage4D framework

Delegate: Hand AI the first draft of the 30-60-90 plan from the 12-month outcomes. Agreeing the plan with the new hire stays with the manager.

Show the prompt and the checks

Describe: You are helping a hiring manager draft a 30-60-90 day onboarding plan for a new AI Governance Lead. Context: I will paste the 12-month outcomes from the intake meeting, the systems and people the hire will work with, and anything they will need before day one. Produce: a pre-boarding checklist (equipment, access, a named buddy, a first-week schedule); then three sections — days 1–30 learn, days 31–60 contribute, days 61–90 own — each with 3–4 concrete, checkable expectations and one milestone check-in question. Use British English and plain wording. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that each expectation is realistic for a new starter, ties back to a 12-month outcome, and offers the hire support rather than a test.
Diligence: The manager agrees the plan with the new hire in week one and owns the check-ins. The new hire's personal details stay out of the prompt.

Don't miss: Giving a new governance lead a full policy rewrite to complete before they have seen a single real system or process.

Framework

30-60-90 day plan

Three phases — learn, contribute, own — with written expectations for each, agreed with the new hire in week one.

Before day one: equipment, access, a named buddy and a first-week schedule.
Days 1–30, learn: systems, people and the current state of the work.
Days 31–60, contribute: a first scoped piece of work shipped with support.
Days 61–90, own: an area of responsibility with clear outcomes.
Hold a check-in at each milestone against the written plan.

Why it works: Hiring doesn't end at the signature. A written onboarding plan makes expectations and support visible to the new hire and their manager.

Before day one
- Laptop, accounts and access to the systems they'll need to inventory, ready before day one.
- Named contacts in legal, engineering and HR.
- A reading list: any existing policy, the list of AI systems already known about, past incidents or findings.
Days 1–30: learn
- Meets legal, engineering, HR and any vendor-management contacts who touch AI systems.
- Builds the first current inventory, even if incomplete, and flags the biggest gap.
- Reviews one existing AI-related decision end to end, to learn where the records actually live today.
Days 31–60: contribute
- Classifies every system in the inventory by risk and gets sign-off from the right owners.
- Stands up or hardens a human-oversight step for the highest-risk system.
- Finds and reports at least one gap nobody had previously flagged.
Days 61–90: own
- Owns a running inventory and classification process, kept current by design, not by memory.
- Has one governance process a team adopted and is still following.
- Briefs leadership in plain language on where AI risk sits today and what's being done about it.

Compliance checkpointUSUK

US: the employee completes Form I-9 Section 1 no later than their first day of paid work, and the employer completes Section 2 within three business days after that day (on the first day if the job lasts less than three business days). UK: complete the prescribed right-to-work check before employment starts, and apply it the same way to everyone.

Sources: USCIS — Form I-9 instructions · GOV.UK — Check a job applicant's right to work · checked 2026-09-25

Stage 13 of 13Required

0 of 3 done

Measure time to hire

Measure the process: mean time to hire

Who runs it: Recruiter / talent lead + hiring manager
Done when: A stage-by-stage timing record for this hire, the slowest step named, and one change agreed before the next requisition opens.

Key tool

Record when the hire accepts

•Time to hire: days from the successful candidate entering the pipeline (application or first contact) to the accepted offer. Average it across hires for mean time to hire.
•Time to fill, recorded separately: days from requisition approval to the accepted offer.
•Days per stage, from the stage's first action to its last — and whether the time was spent waiting or working.
•Offer-acceptance rate: offers accepted divided by offers made.
•Where candidates dropped out, and the reason you were given.
•Days legal sign-off took at each stage it touched — the triage brief, the final offer — set against how long that sign-off was expected to take.

Check in at 90 days whether the hire is meeting the outcomes in the job description — that tells you whether the process picked well.

Read: mean time to hire Read: time to hire vs time to fill

AI as an advantageAI boost4D framework

Delegate: Hand AI the job of building a blank timing worksheet and the instructions for reading it. Entering dates, working out the timings and deciding what to change stay with the recruiter and the hiring manager.

Show the prompt and the checks

Describe: You are helping a recruiter and a hiring manager set up a timing review for an AI Governance Lead hire. Context: I will list the stage names we used, in order (for example requisition approved, sourcing, screening, recruiter call, work sample, interviews, debrief, references, offer accepted). Produce: (1) a blank worksheet with one row per stage and columns for start date, end date, days in stage, days spent waiting (scheduling, approvals, no reply) and number of candidates who entered and left; (2) step-by-step instructions for us to work out, from our own records, time to hire (the successful candidate's entry to the pipeline, by application or first contact, to the accepted offer; average it across hires for mean time to hire) and, separately, time to fill (requisition approval to the accepted offer); (3) five questions we should ask about the slowest stage, separating waiting from working; (4) a short template for recording one change to make before the next hire. Use British English. Do not include benchmarks or example figures. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that the worksheet covers every stage you actually ran, that the two definitions are not mixed up, and that the questions point at the process rather than at any person.
Diligence: People fill in the dates and do the arithmetic from their own records, choose the one thing to fix and write it down. No dates, names or details about any candidate go into the prompt.

Don't miss: Assuming a slow search means too few candidates exist, without first checking whether legal sign-off or reference timing was the actual bottleneck.

Framework

Mean time to hire, by stage

Time to hire is the number of days from the successful candidate entering your pipeline (their application or your first contact) to their accepted offer; mean time to hire is that figure averaged across hires. Time to fill — requisition approval to acceptance — is a separate measure. Record both per stage, so you can see where the time went rather than only the total.

When the hire accepts, write down the date each stage started and ended, and the day the successful candidate entered the pipeline.
Work out the days per stage, the time to hire and the time to fill, and mark the slowest stage.
Note the offer-acceptance rate and the stage where most candidates dropped out.
Separate waiting time (scheduling, approvals, silence) from working time, and decide which one to shorten.
Fix one thing before the next hire, and write down what you changed.

Why it works: A single total hides where the delay sits. Per-stage timing points at the one step to fix, and the acceptance rate and drop-out points show whether candidates kept pace with the process.

Record for every hire

Time to hire: days from the successful candidate entering the pipeline (application or first contact) to the accepted offer. Average it across hires for mean time to hire.
Time to fill, recorded separately: days from requisition approval to the accepted offer.
Days per stage, from the stage's first action to its last — and whether the time was spent waiting or working.
Offer-acceptance rate: offers accepted divided by offers made.
Where candidates dropped out, and the reason you were given.
Check in at 90 days whether the hire is meeting the outcomes in the job description — that tells you whether the process picked well.

What to log for this role

Days legal sign-off took at each stage it touched — the triage brief, the final offer — set against how long that sign-off was expected to take.
How long reference and background checks ran, and whether that stretched the gap between the offer and the agreed start date.
How many sourcing channels had to be tried before enough candidates with genuine inventory or classification work came through.

Where this role's hiring slows down

Watch for legal sign-off queuing behind unrelated matters with no standing priority given to a hiring decision.
Watch for the process stalling at reference checks simply because so few people can speak to this specific kind of work.
Watch for the process-design round and the cross-functional round being booked so far apart that panel members have forgotten their own reasoning by the debrief.

Compliance checkpointUKEU

Under the EU and UK GDPR, tell candidates how long you will keep their data, or the criteria used to decide. Give that notice when you collect data from them directly, or within the Article 14 time limit when it comes from another source (such as a referral or a sourcing tool). Delete or anonymise data when it is no longer needed, keeping only what a documented lawful purpose still requires.

Sources: GDPR — Regulation (EU) 2016/679, Articles 5, 13 and 14 · ICO — UK GDPR guidance · checked 2026-09-25

General information, not legal advice. Rules depend on the employer, the role and where the work is done — confirm what applies with HR or counsel.

Frequently asked questions

What does an AI governance lead do day to day?

Most days are spent keeping the AI inventory current, checking whether a new or changed system needs a fresh risk classification, and following up on whether a human-oversight step is actually being used rather than skipped. The rest is coordination: helping legal, engineering and HR agree how an obligation becomes a workable process, and briefing leadership in plain language when risk changes.

Is a full-time AI governance lead necessary, or can General Counsel absorb the work?

Set out the AI systems in use, the jurisdictions involved, who currently keeps the inventory and oversight records, and what a dedicated lead would own. General Counsel remains essential; a dedicated lead is justified when the operational governance work itself needs a full-time owner.

AI governance lead vs responsible AI officer — is there a difference?

Usually just the title. The same job is called AI governance lead, responsible AI officer or AI compliance manager depending on whether an organisation frames it through legal, ethics or engineering. What matters for hiring is scope, not the label: who owns the inventory, who signs off risk classifications, who runs oversight, and who holds the audit trail. Settle those before you write the job description.

What should I test in an AI governance lead interview?

Test for a process that was actually adopted and is still running, not a policy that was only written. A work sample built from a realistic finding — an unclassified system, a missing oversight step — separates candidates who have done the operational work from candidates who can only talk about frameworks fluently.

How long does it take to hire an AI governance lead?

With this process, plan for five to seven weeks from an approved requisition to an accepted offer, covering a work sample and three structured interview rounds. Reserve panel and reference-call time before sourcing begins so those steps don't add avoidable delay.

Does an AI governance lead need a law degree?

Not necessarily. Legal judgement and the ability to read a new regulation matter far more than the credential, and plenty of strong candidates have come up through engineering, risk or product rather than a legal qualification. Test for whether they can turn a regulation into a process a team will actually follow, not for the degree on their CV.

Go deeper

Guides

Skills tests

See your first AI-generated assessment in 5 minutes

No credit card. No question library to learn. Paste a job description and watch H-Evaluate build.

Request early access