Consulting and recruiting
AI governance for staffing firms: what clients now ask you
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Clients now ask staffing firms which AI tools touch candidate and client data, where those tools score or filter candidates, who reviews the output, and how candidates are told. Staffing AI governance means answering in writing, with evidence. A firm with a short answer pack, kept current by a named owner, responds to supplier reviews faster and more consistently.
Key takeaways
- Clients ask about AI because they share the risk when a supplier's tools screen candidates unfairly or leak data.
- Many staffing firms already use AI through features built into the ATS, sourcing and texting tools.
- The most important answer is where a tool scores, ranks or filters candidates, and who can override it.
- An answer pack is a tool register, a funnel map, vendor documents, candidate notice text and a named owner.
- Rules on automated hiring tools may apply in some jurisdictions and are assessed with counsel.
Why clients ask staffing firms about AI#
Clients ask staffing firms about AI because the supplier's tools become part of the client's own hiring process. If an agency's screening tool filters candidates unfairly, or a recruiter pastes a confidential job description into a consumer chatbot, the client carries part of the consequence.
The questions arrive through supplier onboarding forms, security questionnaires, MSP program reviews and contract renewals. They tend to come with short deadlines, and a firm that answers from memory gives slightly different answers each time, which a careful client will notice.
Which laws apply to a given firm and client depends on where candidates and roles are located, and the rules are still changing, so the answer pack records facts while counsel decides what those facts require.
The ten questions clients ask, and what to document#
The ten questions below cover most of what clients and MSP programs ask. For each, the right column lists the document that answers it, so the answer can be attached rather than written fresh every time.
| Client question | What to document |
|---|---|
| Which AI tools do you use in recruiting? | A tool register with vendor, purpose, account type and the date each tool was reviewed |
| Does any tool screen, rank or reject candidates? | Each point where a tool scores or filters, and whether a recruiter can override it |
| Who makes the final submittal decision? | The recruiter review step and how overrides are captured in the ATS |
| Has the tool been checked for bias? | Vendor documentation, any audit or adverse impact review, and their dates |
| Are candidates told that AI is used? | Notice wording, where it appears and when it was added |
| Does our information go into vendor model training? | Vendor clauses on data use and training, and the opt-out settings you chose |
| Where is candidate and client data stored and processed? | Hosting regions, subprocessors and retention settings per tool |
| Can candidates ask for human review or opt out? | The process, the contact point and a log of requests |
| How is AI used in interviews, such as notetakers or video analysis? | Consent wording, recording settings and where transcripts are kept |
| Who in your firm is accountable for AI use? | A named owner, the current policy version and its review log |
How to build the answer pack#
An answer pack is a small folder of documents that answers the ten questions without fresh drafting. Build it once, assign an owner, and update it when tools change rather than when a questionnaire arrives.
- List every tool with AI features, including those built into the ATS, sourcing browser extensions, job board matching, texting and scheduling tools.
- Map where each tool sits in the funnel: sourcing, screening, scheduling, interviewing, submittal and offer.
- Collect vendor documentation on data use, training and bias testing, and file it by tool.
- Write candidate notice language and confirm where candidates see it.
- Define the recruiter review step and how overrides are recorded in the ATS.
- Name an owner and set review triggers, such as a new tool or a client question the pack could not answer.
What a strong answer looks like#
A strong answer is specific, dated and backed by an attachment. A weak answer is a reassurance that a client cannot verify, and reviewers in MSP programs tend to send it back with follow-up questions, which costs more time than answering properly the first time.
| Question | Weak answer | Strong answer |
|---|---|---|
| Do you use AI in recruiting? | We use some tools where helpful | The tools in the attached register, each with its purpose and last review date |
| Does AI reject candidates? | No, our recruiters decide | No tool rejects candidates; the attached funnel map shows the recruiter review step and how overrides are logged |
| Is our information used for model training? | We do not believe so | Vendor terms attached; training on our content is excluded under our plan, confirmed on the review date |
| Are candidates told about AI use? | It is covered in our privacy policy | Notice text attached, shown at application and in the first automated message |
AI you may be using without buying an AI tool#
Many staffing firms use AI without ever buying something sold as an AI tool. ATS vendors add candidate matching, résumé ranking and chat-based screening to existing plans; sourcing extensions score profiles; video interview platforms may offer analysis; and texting tools can run automated pre-screening conversations.
These features are sometimes switched on by default or enabled by a single administrator. Check release notes and admin settings for every system in the funnel, and turn off anything that has not been reviewed. A client asking whether you screen candidates with AI deserves an answer that reflects the actual configuration, not the original purchase.
Which laws and rules may apply#
Several layers of law may apply to AI in recruiting, and they overlap. Anti-discrimination law applies to hiring decisions whatever tool is involved, so a screening step that disadvantages a protected group is a problem whether software or a person caused it.
Some US jurisdictions have adopted rules aimed specifically at automated tools used in employment decisions, with requirements that can include notices or bias audits, and those rules keep moving. Colorado's AI Act is an example: its start date was pushed back in 2025, and in May 2026 the state repealed and reenacted it in narrower form, effective January 1, 2027.
Privacy law adds another layer. California's CCPA has covered applicant data held by covered businesses since January 1, 2023, and the state's privacy agency started preliminary rulemaking on employee and applicant data in April 2026. For roles or candidates in the EU, GDPR and the EU AI Act may be relevant.
Responsibilities between agency and client depend on who operates the tool and what the contract says. Record that allocation in the client agreement rather than assuming it, and review it with counsel.
Illustrative: a light industrial staffing firm answers an MSP review#
Illustrative: a fictional light industrial staffing firm received an AI questionnaire from a manufacturing client's MSP program. The owner's first instinct was to answer that the firm did not use AI.
A quick review showed otherwise. The ATS had a matching feature switched on, and a texting tool ran a pre-screening conversation that automatically marked candidates as not qualified when they answered one shift question a certain way, with no recruiter review.
The firm changed the texting flow to collect answers only, so recruiters made every screening decision, added a candidate notice about automated messaging, and documented both tools in a register. The questionnaire went back with the register, the funnel map and the notice text attached, and the same pack served later client reviews with small updates.
Governance records and data licensing#
Governance records also matter if a staffing firm ever considers licensing de-identified workflow records. The tool register shows which systems shaped the records, the notice history shows what candidates were told, and the funnel map shows where decisions were made by people.
SourceX draws on that material in the Rights and Preparation steps of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. Candidate profiles and résumés are not licensed, and the permitted use recorded in the SourceX Evidence Packet can exclude uses that would screen or rank people.
Frequently asked questions
Do small staffing firms need a formal AI policy?
Yes, though it can be short. Clients ask the same questions regardless of a supplier's size, and a short policy with a tool register answers most of them. Smaller firms often have fewer tools to document, which makes the work quicker rather than unnecessary.
Is résumé parsing considered AI use?
Parsing extracts fields from a résumé, which most clients see as low risk. Scoring, ranking or filtering candidates based on parsed content is where client attention focuses. Describe both accurately if asked, and be clear about whether any parsed field feeds an automated decision.
Who is responsible when a client's own AI tool screens our candidates?
The client generally governs its own tools, but your candidates are affected and your contract may allocate duties. Know which client tools your submittals pass through, note them in your records, and make sure candidate notices do not promise anything the client's process contradicts.
Should we share vendor bias audits with clients?
Share them if the vendor allows it, usually under a confidentiality agreement, or share a summary with the audit date and scope. Never present a vendor's general audit as a review of your own configuration, since settings and candidate pools differ between customers.
How do we answer if we genuinely use no AI?
Confirm it in writing, but only after checking for AI features embedded in your ATS, sourcing, texting and interview tools. Record the date of that check and the systems reviewed, so the answer is defensible if a feature is later found switched on.
Sources
- Colorado SB 25B-004, signed August 28, 2025, delayed the Colorado AI Act's effective date, and on May 14, 2026 Governor Polis signed SB 26-189, which repealed and reenacted the law in a narrower form effective January 1, 2027. Source
- The CCPA employee and business-to-business personal information exemptions expired on January 1, 2023 after the California legislature did not extend them. Source
- The California Privacy Protection Agency initiated preliminary rulemaking on April 20, 2026 focused on how the CCPA applies to personal information of employees, job applicants and independent contractors. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.