How should a staffing agency evaluate AI?

Lead drafting, candidate search, matching, ranking, forecasting, scheduling suggestions, support summaries, and anomaly detection create different risks. Write the intended use in operational language. Identify whether the output informs recruiting, screening, assignment, pay, performance, discipline, or another employment action.

The U.S. Equal Employment Opportunity Commission explains that federal employment discrimination laws still apply when employers use AI and other automated systems. Buying a tool does not transfer the agency’s responsibility. If the team cannot describe the decision and the human owner, it is too early to approve the use.

Request the test design, sample definition, baseline, error measures, subgroup analysis, limitations, known failure modes, update date, and the person or organization that performed the review. A general accuracy number does not establish performance for the agency’s jobs or candidates.

The Federal Trade Commission has taken action over unsupported AI accuracy claims. Treat statements such as bias-free, fully compliant, or more accurate than people as claims that require competent evidence. Record what the evidence actually supports and what remains unknown.

Build a test set with clear job-related criteria and known outcomes. Include incomplete resumes, nontraditional experience, employment gaps, equivalent qualifications, common spelling variations, multiple languages, and assistive-technology paths. Compare the AI output with a documented manual review rather than an assumed perfect answer.

EEOC guidance on employment tests and selection procedures emphasizes job relevance and appropriate validation. The agency should review false positives, false negatives, ranking stability, and the reasons shown to recruiters. A match score is not a qualification decision by itself.

Separate data needed to provide the service from data used to train or improve a vendor model. Ask whether prompts, documents, candidate records, messages, timesheets, and client information leave the agency’s account or region. Confirm who can access the data and what happens after termination.

Canadian privacy regulators recommend necessity, proportionality, impact assessment, security, transparency, and challenge mechanisms for AI. Provincial and federal privacy rules can differ. The agency should obtain jurisdiction-specific advice for its facts instead of treating one national summary as a universal answer.

Define which actions the system may draft, recommend, queue, or execute. Keep qualification, assignment, pay, discipline, termination, and other consequential decisions under an accountable human process. The reviewer needs enough information to disagree, not a button that merely confirms the model output.

The NIST AI Risk Management Framework organizes work around Govern, Map, Measure, and Manage. Use that cycle to assign ownership, document risk, test the system, respond to incidents, and decide whether the use should continue.

The notice should explain what the tool does in plain language, what information it uses, how a person can request an accommodation, and how to challenge or correct an error. Test the process with screen readers, keyboard navigation, low vision, alternative formats, and candidates who cannot use the default assessment.

EEOC disability guidance warns that automated tools can screen out qualified people with disabilities when the process does not provide a reasonable accommodation. A vendor accessibility statement is useful evidence, but the staffing agency must test its complete candidate flow.

New York City regulates certain automated employment decision tools. California has employment regulations addressing automated systems. Illinois law includes employment AI provisions. Ontario has job-posting disclosure requirements for covered employers, and Quebec provides rights related to exclusively automated decisions.

Those examples are a starting point, not a complete legal answer. Identify where the employer, candidate, job, and data are located. Record the effective date and scope of each source, then have qualified counsel confirm the requirements that apply to the agency’s use.

Ask about encryption, access control, logs, vulnerability management, incident notice, subprocessors, data location, business continuity, manual fallback, export, deletion, and support. Define what happens when a model or material data source changes and whether the agency can retest before accepting the update.

NIST guidance for generative AI and cybersecurity supply chains supports setting requirements before acquisition and monitoring them after launch. Certifications can help the review, but they do not prove that a specific employment use is fair, accurate, accessible, or legally compliant.

Assign an owner and a review cadence before launch. Preserve the input, output, model or version, user, decision, override, reason, and final outcome when the record is legally and operationally appropriate. Watch for changes in jobs, applicant populations, markets, workflows, and vendor behavior.

Define thresholds that trigger investigation, suspension, retraining, process change, or termination. Production monitoring is not a dashboard that nobody owns. It is an operating decision with documented evidence and a safe manual path.

Hard stops include no relevant validation, undisclosed secondary data use, no accommodation path, no meaningful human review, no model-change notice, no decision-log export, no deletion process, and unsupported claims that the tool is bias-free or guarantees compliance. A promised future fix does not resolve a current acceptance requirement.

Document the reason for stopping and the evidence needed to reopen the review. The purpose is not to reject AI as a category. It is to prevent an agency from placing workers, candidates, clients, and its own records inside a system that cannot answer basic operating questions.