Policy Document Agent

Cross-jurisdictional HR policy management answers to four parallel statutory regimes. In the US, Title VII and related anti-discrimination law set the floor, reinforced by the Bostock v. Clayton County (2020) precedent. In the UK, the Equality Act 2010 and its Section 78 Gender Pay Gap reporting apply. Across the EU, GDPR Article 88 governs employee data and CSRD ESRS S1 the workforce-policy disclosures. And at public companies, SOX Section 404 controls compensation policy. A single policy in a large or upper-mid-market employer can trigger all four at once, with penalty exposure into the tens of millions. Yet in a typical 1,500-employee company, 60 percent of policies are non-versioned, 70 percent of employees have never read the current handbook, and acknowledgement evidence is missing for 40 to 60 percent of distributions.

From 60 PDF versions to one Single-Source-of-Truth

This agent follows the Decision Layer principle: each decision is either rule-based, AI-assisted, or explicitly assigned to a human - and the human spots are reserved for content approval and works council co-determination.

A line manager asks HR which travel-expense rule applied for a trip in January when the claim is submitted in March under a revised policy. HR searches SharePoint and finds three PDF versions - travel-policy-v3-NEW, travel-policy-final-Jan, travel-policy-2025 - none carrying an effective date or a supersedes note. The HR generalist guesses from the file modification timestamp, applies the wrong version, and the employee receives a denial letter that is overturned six weeks later when the works council escalates. The same thing happens when an EEOC charge of disparate impact lands and the 180-day clock starts: spread across SharePoint folders, email archives and departed colleagues’ drives, HR cannot consistently prove which policy version applied at the time of the alleged action.

The problem is not employee negligence. It describes the normal state in HR departments that maintain policy libraries across legacy structures: a SharePoint folder for handbook PDFs, a Confluence space for procedures, an email distribution list for amendments, a paper binder in the works council office, an HRIS for digital onboarding consents. Each system has its own logic, its own permissions, its own gaps. A US HR director facing a Title VII charge does not know whether the SharePoint folder still holds the policy version under which the alleged discrimination occurred. A UK HR generalist responding to an Employment Tribunal claim does not know whether the email-attachment archive contains the policy version distributed to the claimant. An EU compliance officer fielding a GDPR Article 15 Subject Access Request does not know whether the paper binder contains the records subject to disclosure.

Discrimination check across US and UK

The agent checks every policy text against the EEOC Compliance Manual, the Bostock v. Clayton County (2020) precedent on sexual orientation and gender identity, the UK EHRC Code of Practice and Employment Tribunal precedent. That flagging is an indicator, not a final decision: flagged policies route to General Counsel, the DPO and the Compliance Officer for human review. Against US law it checks the Title VII protected classes alongside ADEA age protection, ADA reasonable accommodation and equal-pay rules; against UK law it checks the Equality Act 2010 protected characteristics alongside the harassment, victimisation and Gender Pay Gap provisions.

In practice the agent surfaces potentially discriminatory language, missing accommodation provisions and disparate-impact risk. Compensation policies are additionally checked against US state pay-transparency laws, and parental-leave and lactation policies against the Pregnant Workers Fairness Act and the PUMP Act.

SOX 404 controls and ISO 30414 reporting

SOX Section 404 requires management assessment and auditor attestation of internal controls, including segregation of duties for compensation-policy approval. The agent executes those controls and captures the audit evidence automatically. Records are retained 7 years under Section 802.

A SOC 2 Type II report attests the security, availability and processing-integrity controls around the policy library. ISO 30414 human capital metrics - workforce composition, diversity, leadership, productivity - are drawn from the policy library and its acknowledgement evidence, and ISO 27001 governs the access-control matrix and audit trail.

EU and UK data protection

GDPR Article 88 lets each Member State set more specific rules for employee data through law or collective agreement, and the EDPB guidelines clarify the lawful-basis hierarchy: in employment, consent is generally invalid because of the power imbalance, so processing rests on the employment contract, a legal obligation or a balanced legitimate interest, with works council agreement supplementing - never replacing - that basis. Special categories such as health or trade-union data need an employment-law derogation under Article 9, and Article 35 makes a Data Protection Impact Assessment mandatory for systematic monitoring or AI-driven evaluation.

UK GDPR mirrors this, with the DPA 2018 employment derogation and the ICO Employment Practices Code. The agent identifies policies that process employee data, applies the Article 35 DPIA criteria and routes the required works council co-determination.

Retention and the versioning lifecycle

Every policy version is archived with its effective date, expiry date and the version it supersedes, then held for the longest applicable retention period - 7 years under SOX Section 802, 6 years under UK Companies Act 2006, and the AI system log lifetime under EU AI Act Article 12. Employees always see the current version by default; historical versions stay available for audit but are clearly marked as superseded.

For every employee question the agent searches the policy library, selects the version valid at the time of the question, separates factual from interpretive cases and returns the answer with its source reference - section, version and effective date - routing interpretive cases to HR. As EU AI Act transparency rules require, each response is marked as AI-generated and carries that source reference.

Cross-reference to HR-Document-Management and Audit-Compliance

The Policy Document Agent is the authoritative policy repository for the Audit Compliance, Training Compliance, Employee Self-Service and HR Document Management agents, and it triggers the Audit Compliance Agent on a SOX 404 control deficiency or a discrimination-law finding. Two of its three core components - the versioning engine and the approval workflow - are generic infrastructure. Every agent in the Decision Layer that applies rule sets needs versioned documents with validity periods. Every agent that orchestrates multi-level approvals needs a workflow engine with deadline tracking. The Compliance Monitoring Agent checks operational data against rule sets that must be versioned. The Works Council Coordination Agent manages participation processes following the same approval logic. The Audit Agent needs proof - the acknowledgement tracking provides it.

At a glance

• 13 deterministic procedural decisions, 4 AI-augmented indicators and 1 mandatory human escalation
• Discrimination check on every policy text against Title VII, the UK Equality Act 2010 and GDPR Article 88
• Works council co-determination orchestrated per EU Member State and under the UK consultation regulations
• CSRD ESRS S1 disclosure mapping, drawing on ISO 30414 human capital reporting categories
• Acknowledgement evidence captured to defend an Employment Tribunal claim or EEOC charge
• The version valid on the request date returned for retroactive employee inquiries

Decision-Maker Distribution Policy-Document