Home › Guides › Vendor question bank

Current as of November 2, 2026. Laws evolve — verify against current sources and consult licensed counsel.

The Vendor Question Bank: What to Ask, Stage by Stage, and Which Answers End the Conversation

Every regime in this directory lands on the same fact: the employer answers for the tool. Procurement is therefore a compliance act. These questions are organized by the stage at which they are cheapest to ask — a question that costs nothing before signature can cost a remediation program after deployment.

Stage 1 — Before the demo ends: what is this thing?

1. Which decisions does the tool make, assist, or rank — in your words, recorded in the contract exhibits?
2. Does any feature create facial templates or analyze video, voice, or facial movements? (Maryland and Illinois turn on this — see the Maryland and Illinois guides.) Can those features be disabled, and is the disablement auditable?
3. What personal data does it ingest, from where, and what does it infer that we did not supply?
4. Which jurisdictions do you claim it complies with, and will you name the specific duties — audit, notice, explanation — you are claiming?

Stage 2 — Validation and adverse impact: show the work

5. What validation evidence links this tool to performance in our job family — not your average customer’s?
6. Have you run adverse-impact analyses? On whose data, over what period, with what group sizes and impact ratios?
7. Will you share the methodology and summary results under NDA before signature?
8. Has an independent auditor — not you — audited this tool? May we contact them?
9. What is your process when a customer’s deployment shows a sub-0.80 impact ratio: threshold change, feature removal, or a brochure?
10. Do you test intersectional groups, or only headline categories?

Answers that should worry you: “Our tool is bias-free”; “We can’t share any results, even under NDA”; “Our customers handle compliance.” Each is a reason the audit you will eventually need cannot start from vendor evidence.

Stage 3 — Notice, explanation, and candidate rights: can we operate the duties?

11. Can the product deliver or trigger the pre-use notices each regime requires, timestamped, per tool?
12. For an adverse decision, can you supply the principal reasons, the tool’s role, and the types and sources of data used — per individual, on demand? (Connecticut requires exactly this shape of answer.)
13. Can an individual examine and correct data you hold about them? What is the turnaround?
14. Does the workflow support an alternative or human-only path for a candidate who opts out or needs an accommodation?
15. What logs exist of human review — who saw the output, what they decided, what they overrode?

Stage 4 — Change control: the tool you audited is the tool you must keep

16. How are model updates versioned, and how much notice do we get before one reaches our deployment?
17. Can we pin a version, or test an update against our own historical data before it goes live?
18. What change triggers your own re-testing for adverse impact?
19. Will you contractually commit to notifying us of changes that could affect outcomes — the commitment Connecticut’s guide treats as standard?

Stage 5 — Contract terms: allocate what cannot be delegated

20. Who owns bias-testing duties for our deployment, in writing — and do we receive the results, or a summary of a summary?
21. Do we get audit and data-access rights sufficient for our statutory explanations and our own auditor?
22. What indemnification applies if the tool produces a discriminatory outcome, and what are its caps and carve-outs?
23. What happens to our candidate data, logs, and audit records at termination — export format, retention, deletion certification?
24. Will you sign our security and privacy addenda, and disclose subprocessors?

Stage 6 — After signature: the standing cadence

24. Quarterly: any model, data-source, or subprocessor changes since last review?
25. Annually: fresh adverse-impact results on our deployment data; audit summary refreshed; notices still matching the configured tool?
26. Immediately: incident, complaint, or regulator inquiry touching the tool — who calls whom, within what hours?

Pair this bank with the directory shortlists: HR Technology Vendors for the tools themselves, AI Governance Consultants for program help, and Employment Law Firms — AI Hiring when a contract is headed for signature.

What to do next

1. Inventory your AI tools. List every system that screens, scores, ranks, schedules, or evaluates workers — vendor, purpose, data inputs, deployment date.
2. Map each tool to each regime. Use the AI hiring law tracker — a tool can be unregulated in one jurisdiction and regulated in another.
3. Get the right help. Browse AI Bias Auditors for testing and Employment Law Firms — AI Hiring for legal review.

Connecticut employers: get the Compliance Kit