Buying HR AI: the vendor due-diligence checklist for ATS software

Short answer: AI that recruits, selects or assesses people is high-risk under the AI Act. As the buyer you usually become the deployer and inherit your own obligations — even though the vendor built the software. Due diligence before signing is therefore no formality: you must be able to show the system is compliant, and that is only possible if the vendor hands over the right documents. Below are the questions to ask and the safeguards the contract should contain.

Why this is high-risk

Annex III of the AI Act explicitly lists AI systems for recruitment, selection and employment decisions as high-risk: CV screening, candidate ranking, performance assessment, or steering promotions. The heaviest requirements after the outright ban therefore apply. What those requirements involve — risk management, data quality, transparency, human oversight — is set out in High-risk AI obligations: the overview. For the HR-specific angle, see AI in recruitment and selection.

The provider-versus-deployer line

The law gives the builder (provider) and the user (deployer) different duties. The provider handles the conformity assessment, technical documentation, CE marking and registration. The deployer — usually you as the employer — must use the system per the instructions, run human oversight, keep logs and inform workers. Watch the trap: if you substantially modify the system or put it on the market under your own name, you can become a provider yourself, with all the building duties that entails. So ask the vendor explicitly how they see the role split.

The procurement checklist: questions for the vendor

Ask these in writing and keep the answers:

• Is the system high-risk under Annex III? If not, on what ground?
• Has a conformity assessment been carried out and can it be produced?
• Does the system carry a CE marking and is it registered in the EU database?
• Can you inspect the technical documentation (Art. 11) and the instructions for use (Art. 13)?
• Are bias and non-discrimination test results available, with the datasets used and outcomes per group?
• How does logging work (Art. 12) — which events are recorded and for how long?
• How is human oversight supported — can a recruiter understand and override a decision?
• How was the system tested for accuracy and robustness, and what are the known limits?
• Which personal data is processed, where, and is there a processor agreement and DPIA support?

If the first questions get no clear answer, that is itself a red flag.

Contractual safeguards

Turn the answers into hard commitments. Record that the vendor warrants conformity and keeps supplying documentation on updates; that it informs you promptly of serious incidents and changes; that it cooperates with your duties (logs, transparency, audits); and that liability and indemnification are settled if the system turns out non-compliant. Add an exit and data-return clause so you are not locked into a non-compliant system.

Ongoing oversight after go-live

Due diligence does not stop at signing. As deployer you monitor operation, retain the logs, periodically review for bias and explainability, and keep human control genuinely alive — no rubber stamp. At every substantial update you repeat the test. This fits the broader frame of AI in the workplace, where the same governance discipline applies.

Good HR-AI procurement is not a price comparison but a compliance file. Whoever asks the right questions before signing does not buy in a risk they cannot carry afterwards.