Our AI vendor says their tool is already bias-audited. Doesn't that cover us?

No. A vendor audit covers the vendor's model on their test data. It does not cover how your recruiters use the tool, the roles you screen for, or your candidate pool. Under Local Law 144 and Title VII, the employment agency is responsible for the outcome. Courts have named staffing firms directly. If a candidate files a claim, the vendor's certificate will not be your defense. You need your own audit and your own records.

We only use AI to rank resumes, not to make final hiring calls. Are we still exposed?

Yes. The law does not require the tool to make the final decision. It applies when the tool substantially assists or replaces human judgment in screening. Ranking resumes counts. If your AI pushes some candidates up and buries others, that is a screening decision. That is exactly the activity a bias audit examines.

How much does an internal AI governance program actually cost to stand up?

Less than one discrimination claim. For most mid-sized staffing firms, a working program means a named owner, an inventory of your AI tools, a signed data agreement with each vendor, an annual third-party bias audit, and a candidate notice process. The audit itself runs a few thousand dollars per tool. The internal work is time, not big software spend. The exposure you carry without it is six figures and up.

AI Compliance Is Your Firm's Job, Not Your Vendor's

Staffing firms are named 'employment agencies' under the law, and you can't sign that liability over to a software vendor. If you use AI screening tools, you're carrying legal exposure right now. Here's what you have to own.

The law names you. Staffing firms are 'employment agencies' under Title VII, and courts have now confirmed that you cannot sign that responsibility over to a software vendor. If your AI screening tool discriminates, the candidate sues you. Your vendor contract does not change that.

This stopped being theoretical in the last twelve months. NYC's Local Law 144 got a December 2025 audit that called its own enforcement 'ineffective,' which means regulators are about to get serious. Colorado signed its revised AI Act. And judges have started pointing at staffing firms by name when candidates bring bias claims tied to automated screening.

Here is the part most firm leaders miss. You are already exposed. If you run resumes through any AI ranking, matching, or scoring tool right now, you are carrying undisclosed legal risk. A contract clause that says the vendor is responsible does not move that risk. It just makes you feel better until the complaint arrives.

Why the Vendor Contract Doesn't Save You

Staffing firms love a good indemnification clause. It reads like protection. It is not.

Two problems. First, indemnification is a private agreement between you and the vendor. The candidate is not a party to it. When someone files a Title VII claim, they name the employment agency, which is you. You defend the claim. You pay the fees. Then you fight your vendor separately to try to recover, which takes years and often fails.

Second, the vendor's bias audit covers the vendor's situation, not yours. They tested their model on their data. You are screening for warehouse leads in Ohio or nurses in Texas with your own candidate pool and your own recruiter behavior. The audit that matters is the one that looks at how the tool performs in your workflow. The vendor cannot run that for you, because they do not control your workflow.

The law agrees. Local Law 144 puts the audit obligation on the employer or employment agency using the tool. Not the maker. You.

What You Actually Have to Own

Compliance here is not a document you buy. It is a small governance program you run. This is a Build. Change. Adopt. problem, and it stalls at the same place every tech rollout stalls: nobody owns it after launch.

Here is what the program includes. None of it is complicated. All of it has to be yours.

An AI tool inventory. List every tool that touches candidate screening. Your ATS matching feature counts. Your sourcing tool's ranking counts. Chances are you have more than you think, and half of them turned AI features on by default.
A named owner. One person accountable for this. Not 'the team.' A name. If nobody owns it, it does not get done, and the audit finds a gap.
Your own bias audit. Annual, third-party, run against your use of each tool. This is the record that protects you when a claim lands.
Candidate notice. Local Law 144 requires you to tell candidates you use an automated tool and give them a way to request an alternative. Build this into your application flow now.
A vendor data agreement. Not indemnification theater. A real agreement that gives you access to the audit data and model information you need to prove compliance.

That is the whole program. Five parts. A mid-sized firm can stand it up in a quarter.

Why This Stalls at Adoption

Firms buy the AI tool, sign the contract, and think they are done. That is the Build phase. It feels finished.

Then the Change never happens. Recruiters keep working the way they always did, now with a tool that quietly ranks people. And Adopt, the part where governance becomes routine, never starts, because nobody was assigned to start it.

This is the same failure I see in every stalled rollout. The technology goes live. The behavior around it never changes. Six months later the tool is running unsupervised, making screening decisions nobody is auditing, and the firm has no record to show a regulator.

The fix is boring and it works. Assign the owner before you expand the tool. Make the audit a calendar event, not a someday task. Put the candidate notice in the application flow so it happens automatically. When governance is built into the daily motion, it sticks. When it is a policy PDF in a shared drive, it does not.

PE-backed portfolios have an extra reason to move. This exposure shows up in diligence. A buyer's counsel will ask for your AI governance records, and 'our vendor handles it' is now a documented wrong answer. A clean program is a value item. A missing one is a discount.

Do This Week

Pull your tool inventory. Sit down for one hour and list every system in your stack that ranks, scores, or matches candidates. Check the settings on each one, because vendors keep turning AI features on without a loud announcement.

Then name one person to own AI compliance and put it in writing this week. That single step moves you from exposed to accountable. Everything else builds from there.

You cannot outsource this. But you can get in front of it, and the firms that do this now will be the ones still standing when enforcement gets real.

You Can't Outsource AI Compliance to Your Vendor: What Staffing Agencies Must Own Before the Next Bias Audit

Why the Vendor Contract Doesn't Save You

What You Actually Have to Own

Why This Stalls at Adoption

Do This Week

Common questions