Reviewing an AI vendor's terms for a recruitment agency

An AI recruitment tool makes decisions about candidates in the agency's name, and the vendor's terms usually disclaim the thing the agency most needs: that the tool is fair, explainable and lawful to use. The review reads the terms for what the tool does, what documentation the vendor provides, whether it acts as the agency's processor, what it says about bias and explainability, whether the product supports the safeguards the law requires, what its sourcing features do on the professional networks, and who carries a discrimination claim. A fixed £595 covers the review of the AI supplier's terms for the business, delivered in five working days with a note on what they permit, reserve and leave open to ask for.

Who this is for

Recruitment agencies, outsourcers and employers in England and Wales buying or using AI tools for sourcing, screening, ranking or assessment.

What matters in a recruitment tool vendor's terms

What the tool does and the documentation the vendor must provide

The review establishes from the terms, the documentation and the vendor's answers what the tool does to a candidate's prospects (parses, matches, ranks, scores, screens, rejects, analyses video or voice, generates messages), what data it uses and infers, and whether it decides or recommends, because the agency's obligations follow those facts; the note reports what documentation the vendor provides (model cards, data sheets, bias testing reports, explanations of scoring) and what it refuses to, and a vendor that will not say what its tool uses should not be deployed on candidates.

The processor terms and the candidates' data in the tool

personal data put into an AI tool is processed under the UK GDPR like any other, requiring a lawful basis, a notice to the people concerned, a data processing agreement with the provider under Article 28 and an impact assessment under Article 35 where individuals are affected, and the review checks the vendor's data processing addendum for the Article 28 terms, for the vendor's own purposes (benchmarking across customers, improving its models, building talent pools it sells to others, each of which takes the vendor outside the processor role and needs the candidates' notice), for the retention of candidate data and the deletion on termination, for the sub-processors and the transfers under Article 46, and for the position of special category data (health, disability, equality monitoring) that the tool should not be scoring on; whether the provider trains on inputs, and how long it keeps them, depends on its terms, which on business tiers generally exclude training and on consumer tiers generally do not.

Bias testing, explainability and the warranty the vendor will not give

Vendors' terms disclaim warranties that the tool's outputs are accurate, fair or compliant with employment law and place responsibility for hiring decisions on the customer, and the review reports what the vendor does commit to (testing for disparate impact across protected characteristics, the frequency, the methodology, the results it will share; the explainability of scores; the exclusion of proxies for protected characteristics; notification of model changes) and what it will not; the agency is liable under the Equality Act 2010 for the tool's discrimination whatever the terms say, so the note states whether the vendor's commitments are enough for the agency to show it took reasonable steps, and what to ask for where they are not.

Automated decisions, human review and the safeguards the product must support

decisions with legal or similarly significant effects taken solely by an AI tool fall under Article 22 of the UK GDPR as amended by the Data (Use and Access) Act 2025, which allows them outside special category data only where the safeguards (information, representations, human intervention, contest) are in place, and the review checks whether the product can be configured so that no candidate is rejected without a person's review, whether it provides the explanation a candidate is entitled to under Article 13(2)(f), whether it logs decisions and the human review, whether it supports a candidate's challenge, and whether its default settings are ones the agency can lawfully use; a product that cannot support the safeguards can be used only for recommendations.

The sourcing features, the networks' terms and the scraping the tool does for you

Sourcing features that find candidates on professional networks, job boards and the open web do so under the networks' terms (which usually prohibit automated collection and may suspend the agency's accounts), and the review reports what the tool's terms say about the lawfulness of its sourcing (usually that the customer is responsible), what the tool collects and infers, whether the agency can give the Article 14 notice to the people found within the tool, and the retention of sourced profiles; the policy bars confidential information, trade secrets and clients' data from tools whose terms allow the provider to retain inputs or train on them, since the reasonable-steps test in the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's confidentiality duties both look at what was done to protect the information, and the clients' vacancies, salary bands and shortlists the agency enters are confidential.

Liability, discrimination claims and the indemnity to ask for

The vendor's terms cap its liability low, exclude indirect loss and require the agency to indemnify the vendor, and the review reports the exposure the agency carries (a discrimination claim by a candidate, a regulatory investigation, a client's claim under the agency's service agreement) and what to ask for: an indemnity for discrimination claims caused by the tool's design, a higher cap for data protection breaches, the bias documentation as a contractual commitment, notification of model changes, the right to stop using the tool without penalty where outcomes cannot be explained, and a data processing addendum that confines the vendor's purposes; the note also lists the updates the agency needs in its candidate notice, its impact assessment and its client terms, and the AI use policy for a recruitment agency in this series is the internal document that goes with them.

What it costs

AI supplier review, £595. You are buying an AI product and want to know what you are agreeing to. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

The vendor says it is not responsible for our hiring decisions. Is that right?

As between you and the candidate, yes: you are liable under the Equality Act and the UK GDPR. The review reports what the vendor commits to on bias testing and explainability and what to ask for, including an indemnity for discrimination caused by the tool's design.

Can we use the tool to auto-reject candidates?

Only if the product supports the Article 22 safeguards and you provide them, or if you configure it so that a person reviews rejections. The review checks whether the product can be configured lawfully and what its defaults do.

The tool sources candidates from professional networks. Is that our risk?

Usually, under the tool's terms: the networks prohibit automated collection and may suspend your accounts, and the people found need the Article 14 notice. The review reports what the tool does and what the terms leave with you.

Related guidance and services

• AI contracts and AI use policies, £595, the service this page describes
• SaaS and technology contracts, £995
• Data protection agreements and privacy terms, £795
• AI in hiring decisions and automated decision-making
• AI use policy for a recruitment agency

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.