HR Policy Chatbot: Staff Get Answers From Your Own Policies
Staff Get the Answer From Your Policy, With the Clause
An HR policy chatbot lets staff ask "how much notice do I give for annual leave?" in Microsoft Teams and get the answer from your own policy, with the document name, clause and version date underneath. Questions about bullying, injury, resignation or a pay dispute skip the bot and go straight to a person in HR. This guide covers how to get there without building something nobody trusts.
If you run HR, people and culture or IT for a business with several sites, you know the problem. The same five questions arrive every week: leave, allowances, uniforms, overtime, rosters. The answer depends on which enterprise agreement or award the person is on, and every branch answers it slightly differently.
The searching costs real time. Microsoft's 2023 Work Trend Index surveyed 31,000 workers across 31 markets. Of those, 62% said they struggle with too much time spent searching for information in their workday (Microsoft WorkLab). A Gartner survey of 4,861 employees found 47% of digital workers struggle to find the information they need to do their jobs (CFOtech Australia, reporting Gartner, 2023). Policy questions are part of that searching, and when staff cannot find the answer they ask HR.
Why "Just Use ChatGPT" Gets Vetoed and the First Bot Gets Ignored
You are probably reading this after one of four moments. Each one points to a different part of the fix.
| What you hear | What it tells you |
|---|---|
| "Every branch answers it differently" | The policy library has duplicates and site variations nobody has mapped |
| "IT won't let us paste the policy manual into ChatGPT" | The assistant has to run inside your own Microsoft 365 or Azure tenant |
| "We tried a chatbot and nobody trusted it" | Answers had no source, or came from old versions |
| "Only one person in HR really knows the EA" | Key-person risk: the knowledge lives in one head, not in a document |
The security veto is reasonable. The risk sits in the questions staff type. "Can I take leave for IVF?" and "what happens if I report my supervisor?" are personal. They should not sit in a public tool on a personal account. If shadow tools are already in use, our guide to running a shadow AI inventory is the place to start.
When a first bot fails, the content is often the cause. A chatbot fed a SharePoint folder with three versions of the leave policy will quote whichever one it finds first. Staff notice once. After that they email HR again, and the bot becomes a link nobody clicks. Our comparison of AI agents and chatbots covers why answering from a curated source matters more than the model.
What Copilot Already Does, and Where It Falls Short
If you already pay for Microsoft 365 Copilot, the fair answer is that it can do part of this. It can answer questions from SharePoint content. Microsoft's documentation says Copilot "only surfaces organizational data to which individual users have at least view permissions" (Microsoft Learn). Put a clean policy library in a well-permissioned site and Copilot will find it.
The gaps show up when you use Copilot as an HR policy assistant out of the box:
- Oversharing. Copilot surfaces anything a user can open. A salary spreadsheet or an investigation file in a loosely shared HR site becomes answerable. The Digital Transformation Agency's evaluation of the Australian Government Copilot trial found that "Copilot may magnify poor data security and information management practices" (DTA, 2024).
- Agreement mapping. Copilot does not know that a Townsville field technician sits under a different agreement from a Brisbane office coordinator. It answers from whatever document matches the words.
- Version control. Nothing in the permission model tells Copilot which document is current. A 2022 draft and the approved 2026 policy look the same to it unless someone curates the content.
- Hand-off rules. Out of the box there is no rule that says "a bullying question goes to a person, not an answer". You build that as an agent with guardrails.
- Licences. Frontline and shift staff may not hold Copilot licences, and they ask the most questions about rosters, allowances and overtime.
- Processing location. Microsoft states that customers outside the EU "may have their queries processed in the US, EU, or other regions" (Microsoft Learn). Some security teams accept that and some do not.
Copilot can still be the right choice once that groundwork is done. Our Copilot permissions audit guide walks through the clean-up.
Copilot or a Dedicated Policy Assistant?
Two Ways to Give Staff Trusted Answers in Teams
Route A: Copilot, set up properly
This route suits a business where most staff already have Copilot. The work starts with a permissions clean-up across HR and people sites. Then comes a curated policy library, one current version per document, and an agent built in Copilot Studio. The agent is told to answer only from that library, cite the clause and hand sensitive topics to HR. Our Microsoft Copilot readiness engagement covers the clean-up and the agent.
Route B: a dedicated policy assistant in your tenant
This route suits mixed workforces. The assistant is built inside your own Microsoft 365 and Azure tenant, with the model deployed in an Australian region. Staff use it as an app in Teams, so a forklift operator or night-shift nurse can ask a question without a Copilot licence. It reads only the approved policy library and nothing else in SharePoint. Our private AI infrastructure and custom AI development pages explain how that is built and handed over. For the residency side, see the data sovereignty guide.
Both routes end in Teams. Both depend on the same groundwork: a clean library, a map of who is on which agreement, and the guardrails below.
Guardrails That Make Staff Trust the Answers
This is the part that decides whether staff use the assistant after week two. Each guardrail is a rule HR signs off, written down before anything is built.
How Each Question Is Handled
It answers only from approved, current documents
The assistant reads the policy library HR approves and nothing else. Every answer shows the policy name, the clause and the version date, so a staff member can open the source. The technique is called retrieval augmented generation. The assistant looks up the relevant clauses first, then writes an answer from those clauses alone.
When the documents do not cover it, it says so
"Our policies don't cover that. I've sent your question to HR." Staff forgive that reply. They stop using a bot after one confident wrong guess.
Sensitive topics go straight to a person
Bullying, harassment, injury, resignation, mental health, discipline and pay disputes go to HR. The assistant does not attempt an answer. This ties to real obligations. Since December 2022, employers have a positive duty under the Sex Discrimination Act to take proactive steps against sexual harassment and related conduct. The Australian Human Rights Commission has had powers to enforce it since 12 December 2023 (AHRC). Under WHS laws, employers must also manage psychosocial hazards such as bullying and harassment (Safe Work Australia). A report like that needs a trained person, so the routing rule sends it to one.
No personal or payroll data in Phase 1
The first version answers policy questions. It does not look up anyone's leave balance or pay. That keeps it clear of employee records while the answers are proven. The Privacy Act's employee records exemption is narrow and does not cover every employee-related activity (OAIC), so we design to the Australian Privacy Principles regardless. Questions typed into the assistant still count as personal information, so the logs sit in your tenant with access limited to HR.
Entitlements show the NES floor beside your clause
The National Employment Standards are minimum entitlements that an award, agreement or contract cannot reduce (Fair Work Ombudsman). Where a question touches an entitlement, the assistant shows your agreement's clause and the NES minimum it sits above. It labels the answer as a reference and points to HR for advice.
Answers depend on role and site
The assistant knows, from Entra ID or your HR system, which agreement and site a person belongs to. A field technician and an office coordinator asking the same overtime question get the answer for their own agreement.
Every question and answer is logged
HR can audit any answer. The log also shows which policies confuse people most, which gives HR a list of documents to rewrite.
For who can switch a guardrail off, see our guide to AI agent governance, data access and human override and the AI governance framework.
HR Inbox Today vs a Policy Assistant in Teams
What Changes for Staff and HR
| Metric | HR inbox today | Policy assistant in Teams | Improvement |
|---|---|---|---|
| Where staff ask | Email, phone, a corridor chat | Teams, on a phone or desktop | One channel |
| Which document answers it | Whichever version the person finds | The current approved version only | Version shown |
| Agreement applied | Depends who you ask | Matched to role and site | Consistent |
| Source shown | Rarely | Policy name, clause and date | Checkable |
| Sensitive matters | Mixed in with routine email | Routed to a person straight away | Prioritised |
| Insight for HR | None | Log of questions and gaps | Visible |
How to Turn Your HR Policies Into a Staff Assistant, Step by Step
Seven Steps From Policy Folder to Teams
Step 1: Gather and clean the policy library
Collect the policy manual, the employee handbook, each enterprise agreement, the relevant awards, site procedures, leave rules and WHS procedures. Expect to find the same policy in four places. Pick the current version of each, archive the rest and record an owner and review date. It also shows where sites have drifted apart.
Step 2: List the top questions
Pull a month of HR inbox, ticket and phone notes. Group the questions, count them and rank them. That count is your baseline, and it becomes the test set for shadow mode.
Step 3: Map who is on which agreement
Write down which agreement, award and site procedures apply to which roles and locations. This is often the work that lives only in one HR officer's head. Getting it into a table removes that key-person risk, even before any AI runs.
Step 4: Set the guardrails
Agree the sensitive topic list and the exact wording of a referral. Then agree what the assistant may never do and who reads the log. HR owns this list, and changes to it go through HR.
Step 5: Run shadow mode
The assistant answers the top questions from step 2 while HR answers them as usual. HR compares the two side by side each week. You set the accuracy threshold before testing starts. Until the assistant meets it, no staff member sees an answer.
Step 6: Go live in Teams
Start with one site or one group of staff. Every answer still carries its source, and a "this was wrong" button sends the exchange to HR.
Step 7: Review monthly
Read the log, fix the policies people misread and add the questions the assistant could not answer. When HR approves a policy change, it goes into the library that day, and the assistant answers from the new version.
What the Time Is Worth: a Worked Example
We do not know your HR team's question volume. Here is the arithmetic to run on your own baseline. The figures below are an example, not a forecast.
Example only: your numbers will differ
Replace the 40 and the 10 with your step 2 count and a timed sample. Then decide what share of those questions the assistant must answer correctly before it is worth running. That share is your shadow mode threshold. The other benefit is harder to price: the same answer at every site, with the clause to prove it.
How a Solve8 Engagement Runs
Each phase is fixed price and ends at an exit point. You proceed, pause or stop, and keep everything delivered.
- Phase 1, Discovery and Design: Library audit, top-question baseline, agreement map, guardrails and the Route A or Route B decision.
- Phase 2, Build and Shadow Mode: The assistant is built in your tenant and tested against HR's answers each week. No staff member sees it yet.
- Phase 3, Co-Pilot and Handover: Live in Teams for a first group, with HR reviewing flagged answers. Code, documents and admin access pass to your IT team.
After handover, managed AI services are an option if you want help keeping the library and guardrails current. This post goes deeper on one piece of the broader AI HR agent for policy questions, leave and onboarding. If you also want customers to get answers from your documents, see our guide to client-facing GPTs built on business knowledge.
The lead on every engagement spent 18 years on operations and data systems for BHP, Rio Tinto and Senex Energy, gained while working with previous consulting employers. These companies are not Solve8 clients.
Common Questions
Will an HR policy chatbot give wrong answers?
It can. That is why it answers only from approved documents, shows the clause and version, and says "I don't know" when the policy is silent. Shadow mode tests it against HR's own answers until it meets a threshold HR sets, and nothing goes live before then.
Can staff see other people's data through it?
No, by design. Phase 1 holds no personal or payroll data, so there is nothing personal to see. It reads only the approved policy library, not the rest of SharePoint, and the question log is limited to HR.
Does a policy assistant replace HR?
No. It takes the repeat lookups so HR can spend its time on the matters that need a person. Bullying, harassment, injury, resignation, mental health, discipline and pay disputes always go straight to HR without an attempted answer.
What if we have several enterprise agreements and awards?
That is the main reason to build it properly. Step 3 maps each agreement, award and site rule to roles and locations. Two people asking the same overtime question then get the answer for their own agreement.
Can we use Microsoft Copilot instead?
Often, yes. Copilot answers from SharePoint content a user can already open. It needs a permissions clean-up, a curated policy library and a Copilot Studio agent with hand-off rules. A dedicated assistant suits staff without Copilot licences or a need for Australian-region processing.
Where is our data stored?
Inside your own Microsoft 365 and Azure tenant. In Route B the model runs in an Australian Azure region and your documents and logs stay in your environment. The code and credentials are yours after handover.
Find Out Which Route Fits Your Policies
Bring a month of the questions your HR team answers most. In a free 30-minute Microsoft Teams call we will go through them with you. You leave with a straight answer on whether Copilot or a dedicated assistant fits, and what your library needs first.
Book your free 30-minute policy question review
Related Reading
- AI HR Agent: Leave Approvals and Onboarding - The broader HR agent, including leave approvals and onboarding, that this policy assistant fits inside.
- Microsoft 365 Copilot Readiness: Audit Permissions First - The SharePoint and Teams permissions audit to run before Copilot answers HR questions.
- Shadow AI inventory and policy for Australian businesses - What to do when staff are already pasting policy text into public AI tools.
- AI agent governance: data access, privacy and human override - Who controls the guardrails and how human override is designed.
Sources: Microsoft Work Trend Index 2023 (WorkLab); Gartner digital worker survey, 2023, as reported by CFOtech Australia; Microsoft Learn, Data, Privacy, and Security for Microsoft Copilot (updated October 2026); Digital Transformation Agency, Copilot trial evaluation summary (October 2024); Australian Human Rights Commission, positive duty compliance and enforcement; Safe Work Australia, psychosocial hazards; Office of the Australian Information Commissioner, employee records exemption and Australian Privacy Principles; Fair Work Ombudsman, National Employment Standards.