Buying AI for HR: Look Beyond the Bias-Audit Label

The decision this changes

This module is for the person who will sign off an AI feature that touches who is interviewed, hired, moved, promoted or let go. It changes what goes into the RFP or renewal, and what evidence the organization holds before the feature is switched on for real candidates.

Who answers for the tool: the employer, and sometimes the vendor

Using a vendor does not by itself remove employer obligations. The sources below address different duties, and some can also reach a vendor acting as the employer’s agent.

• New York City: the city’s guidance says employers, not the vendor that created a tool, are responsible for ensuring a required bias audit was done, although a vendor may commission one.
• The ADA: discrimination includes participating in a contractual or other arrangement that subjects the employer’s own qualified applicants or employees with a disability to discrimination.
• The Uniform Guidelines: an employer may in some circumstances rely on a test publisher’s validity studies, but remains responsible for compliance.
• California: the Civil Rights Council’s regulations treat an agent that screens, recruits or hires for an employer, including through an automated-decision system, as an employer itself.
• The vendor is not out of reach. In Mobley v. Workday, the court held in July 2024 that the complaint adequately alleged Workday acted as an agent of its client employers, and so as an “employer” under Title VII, the ADEA and the ADA. In June 2026 it held that Workday can be directly liable under California’s Fair Employment and Housing Act for its own conduct on employers’ behalf. The court preliminarily certified a collective on the age claim in May 2025, and a class certification motion was filed September 14, 2026. The discovery order filed October 7, 2026 recorded November 10 as the deadline for Workday’s opposition to class certification. The claims remain allegations to be proved, not findings of discrimination.

The practical consequence is that the buyer has to obtain, from the vendor, the evidence the law expects the employer to hold. That is what the eight questions ask for.

How to use the module

1. Start with the shared core. Put questions 1 to 26 to the vendor: governance, the features themselves, data, records, security, commercial terms, implementation and exit.
2. Add questions 37 to 44 below wherever a feature makes or supports a decision about a person. To have the set assembled for you, use Build your diligence questions: choose what you are evaluating, the function and what you need to understand, and it orders the questions that apply, with why each one matters.
3. Ask in writing and ask for documents. Each question takes an answer, Unknown or Not applicable. An Unknown is a finding about what the vendor will disclose, not proof that the control is missing.
4. Put the answers that matter into the contract: audit cooperation, data access for your own monitoring, notice and change terms.
5. Ask for a bounded demonstration on your own cases. Set out the intended use, excluded uses, population, error costs and escalation behavior, and add challenge cases you choose: missing facts, contradictory records, unusual employee groups and a request for another person’s data. Record the product version and configuration tested, and keep the vendor’s attestations apart from what you observed.

Are you exposed? Four checks before a tool screens real candidates

1. Can you name every AI feature that scores, ranks, filters or recommends people in your hiring and HR systems today, including ones that came with an upgrade? If not, start with the inventory.
2. For each use covered by New York City’s automated employment decision tool law, do you hold a bias audit less than a year old, and is the required summary publicly available? The law requires both before use.
3. Can you produce your own selection-rate data, by group and by stage, for the last year? The Uniform Guidelines call for adverse impact to be assessed at least annually and records kept, and California extends retention of selection and automated-decision data to four years.
4. If a feature analyzes video, voice, or facial expression, have you assessed the applicable prohibitions, notices, and consent requirements? In the EU, inferring emotions in the workplace has been prohibited since February 2, 2025, and Illinois requires notice, explanation and consent before AI analysis of video interviews.

A “no” or “not sure” to any of these is the place to start.

Questions 37 to 44: decisions about people

37. Has an independent auditor tested this tool for adverse impact, on data like ours? Can we see the full results: the groups tested and excluded, the data and its dates, the thresholds used, and the auditor’s relationship to you?

Why it matters. In New York City, an employer may not use an automated employment decision tool to screen candidates or employees unless it had a bias audit within the prior year and a summary is public before use. The audit must report selection or scoring rates and impact ratios by sex, race or ethnicity and their intersections, and state how many people were left out as unknown. An employer may rely on an audit built on other employers’ data only if it supplied its own historical data or has never used the tool. The city’s guidance says an auditor is not independent if it works for the employer or the vendor, was involved in using, developing or distributing the tool, or has a direct or material indirect financial interest in either. The New York State Comptroller’s December 2025 audit of the law’s enforcement found that three of the 22 employers’ posted audits it reviewed were not conducted by an independent auditor, in two because the vendor selling the tool performed the testing, and that nine did not adequately explain the data used. A November 2025 audit summary for another vendor’s candidate-matching platform likewise rested on the vendor’s own testing, covered gender and race or ethnicity only, and reported an eight-person group with a selection rate three-quarters of the highest group’s. Elsewhere, California makes evidence of anti-bias testing, or its absence, relevant to a discrimination claim or defense, and from October 1, 2026 Connecticut lets its commission or court consider evidence of anti-bias testing or similar proactive efforts.

Evidence to request. The full audit report, not only the published summary; the data sources and dates; the cut-off or threshold used to compute selection rates; the categories excluded and why; the auditor’s engagement terms.

Ask when: A feature screens, scores, ranks or recommends candidates or employees for a decision.

38. Can we monitor adverse impact on our own applicant flow, by job and by stage, and export the data to do it?

Why it matters. A vendor’s audit may rest on other employers’ data rather than the buyer’s. The Uniform Guidelines call for each user to keep records of a procedure’s impact by sex and by race and ethnic group, and to determine at least annually whether the total selection process has an adverse impact. They treat a selection rate below four-fifths of the highest group’s rate as generally regarded by federal enforcement agencies as evidence of adverse impact. The federal posture is changing: in June 2026 the Justice Department’s Office of Legal Counsel concluded that the Uniform Guidelines embrace an unconstitutional reading of Title VII, and the EEOC’s 2026 regulatory agenda lists a final rule rescinding their interpretive portions for November 2026. The final rule reached review at the Office of Information and Regulatory Affairs on October 16, 2026 and was still unpublished in October 2026, so Part 1607 remains codified. Illinois is moving the other way: from June 1, 2027 its Human Rights Act makes employment criteria or methods that have the effect of discriminating a civil rights violation unless the employer shows they are job related and consistent with business necessity, and even then if the complainant shows a less discriminatory alternative would serve that necessity. State and city rules that require testing, records and retention remain: California four years, Colorado three years from 2027 (subject to a federal court’s enforcement stay), and EU deployers’ logs for at least six months. Do not assume the vendor holds the evidence: in Mobley, the magistrate judge held Workday’s own bias-testing data privileged because its attorneys curated it and used the results to give legal advice, and found in July 2026 that Workday does not have possession, custody or control of its customers’ applicant data.

Evidence to request. A data export of applicants, outcomes and stage by requisition; the fields available for demographic analysis; how long the vendor keeps decision data and logs, and whether the retention period can be set to the employer’s legal requirement.

Ask when: The organization uses the tool at volume, operates in a jurisdiction with records or testing duties, or relies on the tool’s output in decisions.

39. What evidence shows that the tool measures something related to the job, and was it validated for the way we will use it: as a pass-or-fail screen, or to rank people?

Why it matters. Under the Uniform Guidelines, a user obtaining a procedure from a publisher should determine that the information needed to support validity has been established and will be made available, and should consider evidence of test fairness when deciding to buy. Where two procedures are substantially equally valid, the user should choose the one with less adverse impact. Evidence enough to support a procedure as a screen may not support using it to rank people where ranking has greater adverse impact. The ADA separately bars selection criteria that screen out people with disabilities unless they are job-related and consistent with business necessity.

Evidence to request. The validation study or technical manual; the jobs and populations it covered; how the tool should and should not be used (screen, rank, weight); the alternatives the vendor considered.

An accuracy figure may answer a different question. Ask what was predicted, against which reference, for which population and at which stage. A model that extracts resume fields accurately has not shown that it can rank candidates validly.

Ask when: The tool produces a score, rank or recommendation that the organization will use to select people.

40. Which settings change who passes: weights, thresholds, knockout questions, cut scores? Who can change them, are changes logged, and does a change trigger a new audit?

Why it matters. The bias audit described at the top of this page names the job requirements calibration process as the setting that can affect the model’s output, and says clients define those settings role by role, with no calibration made for the testing. An audit run at one configuration describes that configuration. Shared core question 7 asks who can change a feature’s configuration; for HR tools, the settings that matter are the ones that move people above or below a line.

Evidence to request. The list of configurable settings that affect outcomes; the change log; the vendor’s guidance on when a configuration change needs a new audit.

Ask when: The organization or the vendor can configure scoring, weighting, thresholds or screening questions.

41. What notices, explanations and alternative processes does the tool support, and can a person with authority review and change an adverse decision?

Why it matters. Notice duties are in force or dated in several places. New York City requires notice to candidates and employees who live in the city at least ten business days before use, with instructions for requesting an alternative process or accommodation, although its rules do not require an alternative process to be provided. Illinois makes failing to notify employees of AI use in employment decisions a civil rights violation, and its July 2026 agenda anticipated a new notice-rule proposal around November 10, 2026. From January 1, 2027, California businesses using automated decision-making technology for significant decisions, including hiring, must give pre-use notice and an opt-out, with exceptions that include an appeal to a human reviewer who can overturn the decision. From July 1, 2027, a separate California law, SB 947, bars employers from relying solely on an automated decision system for discipline or termination, requires a human to corroborate any such decision that primarily relies on one, and requires a written notice to the employee afterward. Colorado’s law, from January 1, 2027, requires notice before use, an explanation after an adverse outcome, and, to the extent commercially reasonable, an opportunity for meaningful human review by someone with authority to change the decision. A federal court order in a lawsuit challenging Colorado’s earlier act bars the Attorney General from starting enforcement of that act, or legislation replacing or amending it, until 14 days after the court rules on a preliminary-injunction motion the plaintiff files after the implementing rules are final; those rules were not final in October 2026. In the EU, from December 2, 2027, deployers of high-risk systems in employment must inform the people affected that they are subject to the system. The Act also gives a person subject to a decision based on such a system’s output, where the decision has legal or similarly significant effects the person considers adverse, a right to an explanation of the system’s role and the main elements of the decision; when that right starts to apply to employment systems is a question for counsel. Employers must also inform workers’ representatives before putting such a system into service at work.

Evidence to request. Notice templates and where they appear in the candidate flow; how a candidate requests an alternative or accommodation; the explanation the tool can generate for an individual decision; the reviewer workflow and its audit trail.

Ask when: The tool is used on candidates or employees in New York City, Illinois, California, Colorado, Connecticut or the EU, or the organization wants a defensible review process anywhere.

42. How can a candidate with a disability take the assessment in an accessible format or request an alternative, and does speed, voice, video or a timed task affect the score?

Why it matters. The ADA defines discrimination to include failing to select and administer employment tests so that the results reflect the skill the test measures rather than an applicant’s sensory, manual or speaking impairment. The EEOC’s codified guidance says accessible formats or other accommodations, such as more time, should be available on advance request, unless the impaired skill is what the test measures. New Jersey’s rules warn that a screening tool that filters applicants on their schedule may have a disparate impact and must offer a way to request a reasonable accommodation. The EEOC’s 2022 technical assistance on AI and the ADA is no longer on its website; the statute and regulations remain.

Evidence to request. The accessibility conformance report; the accommodation request route and who handles it; which inputs (time, voice, video, typing) feed the score.

Ask when: The tool assesses, tests or interviews candidates or employees.

43. Does any feature infer emotion, personality or other traits from face, voice or video, or use biometric data? Can each such feature be switched off?

Why it matters. In the EU, AI systems that infer emotions of a person in the workplace, other than for medical or safety reasons, have been prohibited since February 2, 2025. Illinois’s Artificial Intelligence Video Interview Act requires notice, an explanation of how the AI works and what it evaluates, and consent before AI analysis of recorded video interviews, limits sharing, and requires deletion within 30 days of an applicant’s request. California’s privacy regulations, in effect since January 1, 2026, require a risk assessment before automated processing is used to infer an applicant’s or employee’s intelligence, ability, aptitude or performance from systematic observation; for such processing already under way on January 1, 2026, the assessment is due by December 31, 2027.

Evidence to request. A list of every inferred attribute and the inputs used; the consent and deletion workflow; a written confirmation of which features can be disabled for which jurisdictions.

Ask when: The tool records or analyzes video, audio or images of candidates or employees, or produces personality or trait scores.

44. What will you commit to in the contract to support our obligations: audit cooperation, documentation of intended use and limits, notice support, records, and cooperation if a decision is challenged?

Why it matters. Some laws now place duties on the developer as well. Colorado’s law requires developers of covered technology to give deployers documentation on intended uses, training data categories, known limitations and appropriate human review from January 1, 2027, subject to the same enforcement stay, and Connecticut requires developers to give deployers what they need for their notice duties, which apply from October 1, 2027. New Jersey’s rules require an employer whose practice has a disparate impact and relies on a vendor’s systems to take reasonable steps to ensure those systems are consistent with its anti-discrimination law. Use the contract to obtain the vendor cooperation needed for your obligations; a contract does not displace duties the law assigns to the employer. The AI contract terms guide covers the general clauses; this question covers the employment-specific ones.

Evidence to request. Proposed contract language for audit data access, documentation, notice support, record retention to the employer’s legal period, and litigation cooperation; the vendor’s description of its role (tool provider or agent making decisions on the employer’s behalf).

Ask when: Any of questions 37 to 43 applies.

Three gaps to resolve before rollout

• An audit that did not match the use. An audit’s results hold for the data, groups and configuration it tested. Asking question 37 for the full report, and question 40 for the settings, shows whether the audit describes the tool as the organization will run it.
• A vendor tool treated as the vendor’s problem. The New York City guidance, the ADA’s contractual-arrangement rule and California’s agent rule all keep the employer responsible. Question 38 gives the employer its own evidence.
• A trait-inference feature switched on by default. Emotion inference in the workplace is prohibited in the EU, and video analysis needs consent in Illinois. Question 43, asked before rollout, finds it.