This study aims to address the information security governance issues associated with the use of AI in HRM by developing the artificial intelligence–human resource management (AI-HRM) cybersecurity architecture (AHCA), a novel domain-specific architecture.
The review followed the PRISMA 2020 principles, and 72 peer-reviewed papers were obtained from journals indexed in Scopus and IEEE Xplore, or from CORE-ranked journals, for the years 2020–2025, with citation chaining in Google Scholar. Three research questions guided the synthesis, covering threat conceptualisation, security implications and governance. This study then created the AHCA following an iterative design science process, using each component directly from literature reviews, and constructed a structured rubric with explicit anchoring examples to enable replication of the comparative evaluation.
The review identified six categories of AI-HRM security threats: data breaches (T1), exploitation of algorithmic bias (T2), insider threat amplification (T3), model poisoning attacks (T4), regulatory non-compliance (T5) and governance and audit failures (T6). There is a wide disparity in the attention these subjects receive in the literature: algorithmic bias (43.1 %) and governance and audit failure (51.4 %) together account for 94.4 % of the corpus whose primary focus could be coded, while data breaches (1.4 %), insider threat (1.4 %) and regulatory non-compliance (2.8 %) sit at the margins, and no study takes model poisoning as its primary focus. In addition, most governance-oriented research identifies accountability gaps but stops short of architectural solutions. The AHCA is designed to address this structural deficit, pairing four-layer architecture with a 14-indicator security performance indicator (SPI) framework.
The corpus is limited to English-language publications from 2020 to 2025 that appear in journals in the AHCA’s Q1 or Q2 tiers, and the AHCA itself is a design artefact that will be tested in practice through Delphi panels of experts and longitudinal case studies. The technical security literature emerged when searching IEEE Xplore and Scopus; a complementary search of the ACM Digital Library is planned as a future extension.
The AHCA and its SPI framework offer HR practitioners and policymakers an AI-HRM-specific blueprint for general data protection regulation (GDPR) compliant, high-risk employment systems in accordance with the provisions of the European Union AI Act.
The AHCA incorporates GDPR and EU AI Act compliance-by-design principles into a single HRM-specific security architecture that is currently in the early phases of development. It is the only benchmark that addresses the HRM-specific and EU AI Act dimensions, which are not addressed by sector-agnostic comparators, and it performs well in the generic HRM security dimensions on a replicable nine-dimension rubric, benchmarked against NIST AI RMF, MITRE ATLAS, ISO 27001 and NIST CSF.
