Artificial intelligence is rapidly transforming human resources operations. From AI-powered recruiting platforms that screen résumés and rank candidates, to onboarding tools that personalize new-hire experiences, performance management systems that predict attrition, identity verification solutions using biometrics, and platforms administering ERISA-governed benefit plans, employers are increasingly relying on third-party vendors whose products are built on or enabled by AI. For labor and employment lawyers, this shift demands a fresh look at how we negotiate and structure vendor agreements.

While most states have not yet enacted AI-specific employment legislation, all employers deploying such technologies should pay careful attention to the terms in their AI vendor agreements. A patchwork of state laws is emerging across the country, federal agencies are actively extending existing frameworks to AI, and even a vendor’s home-state obligations can shape the contractual landscape. This article offers a high-level overview of several key issues practitioners should consider when negotiating agreements with HR technology vendors that use AI.

Define What You’re Buying

Vendor agreements should clearly define service provided under the agreement, capturing not only products explicitly marketed as AI but also any service that includes, incorporates, or is based upon or enabled by artificial intelligence, including generative AI, and agentic AI systems that autonomously act and make decisions in response to prompts and other actions.

Equally important is defining the vendor’s obligation to disclose the nature and extent of its use of AI. Require that the vendor mark or otherwise identify for Customer in writing all deliverables that incorporate or derive from AI, and provide upon request, a full disclosure of the use of AI services in connection with the preparation of any deliverables. Similarly, consider requiring the vendor to notify the employer of a new AI use case, particularly when the current services do not involve AI. Without this transparency, employers cannot assess their own compliance obligations under emerging state and federal laws.

Data Ownership and Restrictions on Training

HR data is among the most sensitive information an organization holds. Vendor agreements should unambiguously establish employer ownership of all content, prompts, inputs, and—critically—all generated output, meaning results or derivative works created by the AI using the employer’s data. Perhaps most important, the agreement should expressly prohibit the vendor from using employer data to train, retrain, or improve its AI models without approval. This is not a theoretical concern—HR data used to train a general-purpose model could expose the employer to claims under data privacy laws and compromise confidential workforce information.

Bias Testing and Anti-Discrimination Protections

The risk of algorithmic bias is the headline issue for AI-driven decision making, particularly in certain areas including health care, housing, financing, and, of course, employment. A growing number of jurisdictions are imposing affirmative obligations on employers who deploy these tools.

New York City’s Automated Employment Decision Tool (AEDT) law, for example, requires employers to ensure an independent bias audit was conducted within the past year before using an AEDT for hiring or promotion decisions, and to publish a summary of the audit results. California’s Civil Rights Department regulations do not have an express bias audit requirement, but recognize that evidence of anti-bias testing or similar proactive efforts to avoid unlawful discrimination is relevant to defending a claim. A similar rule is present in Connecticut’s new AI law.

Because of these regulatory developments, and considering the extent to which organizations rely on vendors for these technologies, employers should negotiate the right to request and receive documentation of the vendor’s bias testing methodology, frequency, and results, and include contractual obligations for the vendor to maintain governance standards and validation procedures.

Cybersecurity Assessment and AI Incident Response

Before onboarding any AI vendor (or, really, any vendor that processes confidential or personal information), employers should conduct a thorough cybersecurity assessment, particularly where the vendor will process biometric data, health information, or other sensitive employee data. The agreement should require the vendor to maintain a written information security program that includes, without limitation, administrative, physical, technical, and organizational safeguards. The agreement also should establish a robust AI incident response protocol, requiring the vendor to notify the employer promptly in writing of any AI incident, and to take corrective action to remediate the issue and prevent recurrence.

Change Management

AI models are not static, they are updated, retrained, and sometimes fundamentally altered. A performance management tool that worked as expected last quarter may behave differently after a model update. Vendor agreements should require advance written notice of material changes to AI services, with enough lead time for the employer to assess potential impacts. The agreement should also grant the employer the right to test and validate changes prior to implementation and require the vendor to maintain appropriate version control, monitoring, and change management procedures throughout the lifecycle of the AI services.

Subcontractors and Third-Party AI Providers

Many vendors do not build their AI models in-house; they integrate third-party AI models or systems, APIs, and/or subprocessors. The agreement should require the vendor to disclose all third-party AI providers, including the nature and scope of their access to employer data. And, liability for those downstream risks to data should be made clear. Preferably, the vendors should remain liable for all acts and omissions of its subcontractors to the same extent as if the acts or omissions were those of the vendor.

Record Retention

Emerging AI laws are creating new recordkeeping obligations. Colorado’s AI Act, for instance, requires deployers to “maintain records to demonstrate compliance” for at least three years after the date of a consequential decision, which may include version identifiers, change logs, and documentation of mitigation changes. Vendor agreements should include record retention obligations that align with these requirements and ensure that the employer has access to the records it needs to demonstrate compliance.

Liability Allocation: Lessons from Colorado and Beyond

Liability allocation is where vendor negotiations often get most contentious. Colorado’s AI Act offers an instructive framework: it provides that liability in discrimination actions involving AI shall be “allocated based on relative fault” between developers and deployers. Colo. Rev. Stat. § 6-1-1707(2). Notably, the Colorado law:

shields a developer from liability when the developer’s covered AI tool is used by the deployer in the manner that was not intended, documented, marketed, advertised, configured, or contracted for by the developer.

In other words, if an employer repurposes an AI tool for a use the vendor never intended or contracted for, the employer may not shift liability to the vendor. For the deployer, managing the use of the tool to align with the services agreement (i.e., governance) will be critical.

This statutory framework underscores the importance of clearly defining the permitted use of AI services in the vendor agreement and having the governance structure to abide by those provisions. A strong indemnification clause should cover claims arising from allegations that the AI service or its output infringes third-party intellectual property rights, privacy and security has been breached, and breaches of AI-specific obligations.

Looking Ahead

The regulatory landscape for AI in employment is evolving rapidly. Connecticut’s new AI law takes effect in October 2027 and will require employers to provide certain disclosures, including the purpose of the technology, the categories of personal data analyzed, and the data sources used. California’s CCPA automated decisionmaking regulations, with a compliance deadline of January 1, 2027, will require pre-use notices, opt-out mechanisms, and risk assessments. 

For employers, the message is clear: the critical role vendors play in AI deployment, together with the combination of multi-state compliance obligations, federal agency guidance, the risk to personal information, and the sheer pace of AI adoption in HR, means that vendor agreements are a foundational component of compliance and risk management. Taking the time to negotiate comprehensive, AI-specific terms today will pay dividends when, not if, the regulatory and litigation landscape catches up.