What to actually ask your AI hiring vendor

Edition 02. A reading time of about 5 minutes.

The hook

Last edition you built the inventory: the list of tools in your hiring stack that screen, rank, score, or monitor people. This edition is what to do with that list, one tool at a time.

For each tool with AI in it, a short set of questions separates a vendor who will help you comply from one who will quietly leave you holding the risk. And here is the part that surprises people: the questions matter more than the answers. Asking them in writing, and keeping the replies, is itself the first page of your defense.

What this means

Three things make the vendor conversation a compliance step, not just procurement.

The obligations that depend on the vendor are yours. When your company uses a hiring AI tool, you are the deployer, and deployers carry their own duties under the Act (AI Act, Article 26). Several of those duties, genuine human oversight, monitoring, keeping records, are impossible to perform on a black box. You need information from whoever built the tool, and a vendor who will not give it is a vendor who makes your obligations unmeetable.

You are entitled to that information; it is not a favor. The Act requires providers of high-risk systems to supply deployers with instructions for use and the information needed to operate the system properly (AI Act, Article 13). So when you ask for documentation, you are asking for something the law already puts on the provider's side of the table. The question simply reveals whether they are ready to hand it over.

The cheapest moment to ask is before you sign or renew. After signature you keep all of the liability and lose most of the leverage. A hiring tool is high-risk by name, including the ranking feature bundled inside an applicant tracking system (AI Act, Annex III, point 4), so this applies to the ordinary HR software too, not only to the product that markets itself as "AI."

What to do with this

For every AI tool on your inventory, send the provider the same short list, and file the replies. Six questions cover it.

1. Do you classify this system as high-risk under the EU AI Act? If they say no, ask them to put the reasoning in writing. A confident "no" with no explanation is the answer you most need to keep.
2. Will you provide the instructions for use and technical documentation I need as a deployer? This is your Article 13 entitlement, not a special request.
3. How does the system support human oversight? Specifically: what can a person see, what can they review, and what can they override?
4. What data does the system use, and how do you test for and reduce biased or discriminatory outcomes? Hiring is exactly where this gets scrutinized.
5. What is your plan for the revised AI Act timeline? The high-risk obligations for employment apply from 2 August 2026 under the Act as published, with a provisional move to 2 December 2027 under an agreement not yet final in the Official Journal. Ask whether they will be ready ahead of it.
6. What logs and audit trail can I access, and for how long are they kept? Your evidence trail depends on theirs.

A vendor who answers these crisply is doing your compliance homework alongside you, and is worth keeping. A vendor who stalls, deflects, or insists they are out of scope without explaining why is telling you something useful now, while it is still cheaper to act on. Either way, the written exchange goes into the evidence file, the one a regulator or your own legal team will eventually ask to see. You are not building a paper trail for its own sake; you are making sure that when the question comes, the answer already exists.

This is educational material and a starting point, not legal advice. The EU AI Act is still being amended, and the high-risk timeline rests on an agreement that is not yet final law. For how these rules apply to your specific tools, contracts, and vendor relationships, consult a qualified lawyer. Signato is not a law firm and does not certify compliance.

AI that drafts at scale can also send the wrong thing at scale. See the Signato chamber block a forbidden send before it happens: run the free local trial, no card, nothing leaves your machine.