Is Your HRIS Vendor's AI Creating Liability for Your Business?

An HRIS vendor may describe its AI as a “recommendation,” “ranking,” or “efficiency” feature. But if the tool screens applicants, ranks candidates, or influences who advances, it may be shaping an employment decision, and that can create legal and financial exposure for your business.

Buying the software does not automatically transfer responsibility. Employers remain accountable for their hiring practices, even when a vendor supplies or operates the tool. In some circumstances, vendors may also face claims, particularly if their system performs employment functions delegated by an employer. The practical lesson for business leaders: understand what the AI does, test its effects, and document how your company oversees it.

The post-settlement lesson: automation does not erase accountability

In 2023, the U.S. Equal Employment Opportunity Commission (EEOC) announced that iTutorGroup would pay $365,000 to settle an age-discrimination hiring lawsuit. The EEOC alleged that the company’s online application software automatically rejected women aged 55 or older and men aged 60 or older, affecting more than 200 qualified U.S.-based applicants. The settlement included policy, training, and monitoring requirements, not just a payment.

The case concerned allegations under the Age Discrimination in Employment Act; it was resolved through a settlement, not a trial finding. But its business lesson is straightforward: automating a screening practice does not make the practice risk-free. The EEOC’s announcement is a useful reminder that software decisions still need employer oversight.

The vendor may not be immune either. In Mobley v. Workday, a federal court allowed a claim based on an agency theory to proceed at an early stage, where the complaint alleged that the vendor’s AI tools performed hiring functions for employers. That ruling was not a final finding of discrimination or a rule that every AI vendor is liable. It does, however, highlight why businesses should clarify who does what, and who can inspect the evidence, before putting a tool into use. (Case analysis from Seyfarth Shaw.)

First, pin down what the vendor’s AI actually does

The feature name is not enough. “AI assistant” could describe anything from drafting a job description to ranking applicants. Ask the vendor to walk through the actual workflow, from data input to employment outcome.

Find out whether the product:

• Parses résumés or filters candidates using knockout questions.

• Scores, ranks, or recommends applicants for recruiter review.

• Automatically rejects applicants or advances them to another stage.

• Analyzes interviews, tests, video, voice, or other candidate information.

• Influences promotion or other employment decisions beyond hiring.

For each function, document what the AI produces, who sees it, and whether a human can meaningfully review or override it. A nominal human sign-off is not an effective safeguard if reviewers routinely accept scores without checking them.

This inventory should also identify the feature’s configuration, version, and launch date. Those details matter if the vendor changes its model or your business changes the way it uses the results.

Due diligence: ask for evidence, not assurances

“Bias-tested” is a claim, not a complete account of how the tool was evaluated. Before you buy or enable an AI feature, ask the vendor:

1. What is the intended use? Which decisions is the tool designed to support, and which uses does the vendor prohibit?

2. What data and factors does it use? Ask about inputs, training and validation populations, job-relatedness, and known limitations.

3. How was it tested? Request the testing methodology, date, results, groups evaluated, and the tool version tested. Ask whether the assessment was independent.

4. What happens when the model changes? Clarify what triggers retesting and how you will be notified before a material change.

5. Can we examine the evidence? Ask whether your company, or an independent auditor you select, can review relevant reports and supporting materials.

6. How are accessibility and accommodations handled? Establish how candidates can request an accommodation or alternative process, and how concerns are investigated.

7. What records can we retrieve? Confirm that the system can preserve decision logs, model version, inputs, outputs, human overrides, and final outcomes.

A vendor may have legitimate confidentiality concerns, but your business still needs enough information to assess its own risk. If the vendor will not explain what the feature does or provide meaningful testing evidence, treat that as a decision point, not a reason to skip the review.

Build bias testing and audit rights into the contract

Ask your legal counsel to review contract terms before signing. At a minimum, explore provisions that give your company:

• Access to bias-audit reports, methodology, and relevant supporting information.

• The right to conduct or commission an independent review, subject to reasonable safeguards.

• Advance notice of material model changes and a way to suspend or terminate use if the change creates unacceptable risk.

• Vendor cooperation with investigations, complaints, and preservation of relevant records.

• Clear responsibilities for notices, accommodations, complaints, and remediation.

• Appropriate data security, retention, deletion, and restrictions on using your data to train models.

• Indemnity and insurance terms that reflect the risks of the service.

Contract language can clarify responsibilities and support your response if something goes wrong. It does not prevent an applicant or regulator from pursuing a claim against an employer. Nor does an indemnity guarantee recovery: its scope, exclusions, and limits matter. Have counsel assess how the terms apply to your specific tool and use case.

For more on evaluating HR technology vendors and agreements, see JHHR’s guides to auditing your HR tech stack and negotiating HRIS contracts.

Keep a decision record you can explain

Good documentation saves time when leaders need to answer questions from applicants, regulators, or counsel. It also makes it easier to spot patterns and decide whether a tool should remain in use.

Keep a central record of:

• The tool’s purpose, configuration, version, and approved use.

• Vendor documentation, audit reports, testing results, and contract terms.

• The job criteria used and the reason they are relevant to the role.

• Selection outcomes and any testing your organization conducts.

• Candidate notices, accommodation requests, and how they were addressed.

• Human review, overrides, complaints, investigations, and corrective actions.

• Changes to the model, process, or decision thresholds, and who approved them.

Set retention periods with counsel and align them with applicable recordkeeping obligations. Avoid collecting sensitive applicant information unnecessarily; your process should be designed with privacy and access controls in mind.

A practical go/no-go checklist for SMB leaders

Before an AI screening feature goes live, assign an accountable owner (typically with HR, legal, and technology input) and confirm:

• We know exactly which employment decisions the tool influences.

• The vendor has explained the tool’s inputs, outputs, limitations, and testing.

• We can access meaningful audit evidence and investigate concerns.

• A human reviewer has a real role, with authority and guidance to question results.

• Accommodation and alternative-process steps are clear to candidates and staff.

• Applicable notice, audit, and recordkeeping requirements have been reviewed.

• Contracts address model changes, audit access, cooperation, data, and remedies.

• We have a documented process to pause use, investigate, and correct problems.

Track a few practical measures after launch: audit and review completion dates, selection outcomes by relevant groups where lawful and appropriate, accommodation requests and resolution times, human override rates, and time to investigate concerns. A change in any of these measures is a signal to review the process, not, by itself, proof of discrimination or compliance.

A disciplined review can help your organization avoid preventable legal exposure, reduce the hours spent reconstructing decisions after a complaint, and protect dollars that might otherwise go toward investigations, remediation, or litigation. No vendor promise can replace sound governance. If you need help reviewing your HR technology, processes, or implementation risks, JHHR, LLC can help assess your HR tech stack. This article is general information, not legal advice; consult qualified counsel about your specific obligations.