Artificial intelligence is rapidly transforming human resources operations, from resume screening platforms to onboarding tools and performance management systems that predict employee attrition.
Employers are increasingly relying on third-party vendors whose products are built on or enabled by AI, including identity verification solutions using biometrics and platforms administering ERISA-governed benefit plans.
For labour and employment lawyers, this shift demands a fresh look at how vendor agreements are negotiated and structured to protect employers from mounting legal risk.
While most states have not yet enacted AI-specific employment legislation, a patchwork of state laws is emerging, and federal agencies are actively extending existing frameworks to AI-powered tools.
Vendor agreements should clearly define the services provided, capturing not only products explicitly marketed as AI but also any service that incorporates or is enabled by artificial intelligence, including generative and agentic AI systems.
HR data is among the most sensitive information an organisation holds, and agreements should unambiguously establish employer ownership of all inputs, prompts, and AI-generated outputs or derivative works.
Critically, the agreement should expressly prohibit the vendor from using employer data to train, retrain, or improve its AI models without explicit approval from the employer.
Algorithmic bias remains the headline issue for AI-driven decision making, particularly in employment, where a growing number of jurisdictions are imposing affirmative obligations on employers who deploy these tools.
New York City’s Automated Employment Decision Tool law requires employers to ensure an independent bias audit was conducted within the past year before using such a tool for hiring or promotion decisions.
California’s Civil Rights Department regulations recognise that evidence of anti-bias testing or similar proactive efforts to avoid unlawful discrimination is relevant to defending a discrimination claim.
Employers should negotiate the right to request documentation of a vendor’s bias testing methodology, frequency, and results, alongside contractual obligations for the vendor to maintain governance standards and validation procedures.
Before onboarding any AI vendor that processes confidential or personal information, employers should conduct a thorough cybersecurity assessment, particularly where biometric data or health information is involved.
AI models are not static and are regularly updated, retrained, or fundamentally altered, meaning a performance management tool that worked as expected one quarter may behave differently after a model update.
Many vendors do not build their AI models in-house but instead integrate third-party AI models, APIs, and subprocessors, all of which require disclosure and clear liability allocation within the agreement.
Colorado’s AI Act provides that liability in discrimination actions involving AI shall be “allocated based on relative fault” between developers and deployers, offering an instructive framework for contract negotiations.
Notably, the Colorado law shields a developer from liability when its covered AI tool is used by a deployer in a manner that was not intended, documented, marketed, advertised, configured, or contracted for by the developer.
Colorado’s AI Act also requires deployers to “maintain records to demonstrate compliance” for at least three years after the date of a consequential decision, including version identifiers and change logs.
Connecticut’s new AI law takes effect in October 2027 and will require employers to provide disclosures covering the purpose of the technology, the categories of personal data analysed, and the data sources used.
California’s CCPA automated decision-making regulations carry a compliance deadline of January 1, 2027, and will require pre-use notices, opt-out mechanisms, and risk assessments from employers deploying such tools.
Taking the time to negotiate comprehensive, AI-specific vendor terms today will pay dividends when, not if, the regulatory and litigation landscape catches up with the pace of AI adoption in HR.