Vendor Indemnification Does Not Move Employer Liability. It Moves Who Pays.

What does an indemnity actually cover?

A defined set of third-party claims, and the money attached to them. A typical clause says the vendor will defend and pay claims brought by someone else arising from the tool, subject to exclusions and a cap. That is an allocation of cost between two contracting parties. Statutory duties are not property, so nothing in it transfers your obligations under an employment discrimination law.

Notice who the promise runs to. The vendor promises you, and the candidate is a stranger to the contract. A charge is filed against the employer named in the rejection, and the indemnity then becomes a second matter you pursue against the vendor, usually while the first one is still live.

The exclusions are where the clause narrows, and they tend to describe exactly what you did. Your configuration, your thresholds, your job requirements, your data, and any use outside the documented scope are all common carve-outs. So is a failure to tender the claim within a stated window, which is a live risk when a charge lands with HR and reaches procurement three weeks later.

Then check the ceiling and the source of funds. An indemnity capped at fees paid in the prior twelve months is a discount, not a defense budget, and it sits behind whatever the vendor can actually pay. Ask for the insurance behind the promise, the limits, and whether the policy names discrimination claims at all. A well-drafted clause from a company that folds is worth what the company is worth.

Who can a candidate name?

You, and sometimes the vendor as well. In the Title VII technical assistance it issued in May 2023, the EEOC answered whether an employer is responsible for a tool designed or administered by someone else with "in many cases, yes," and added that if the vendor is wrong about its own tool the employer could still be liable ¹. That document came off the agency's site in January 2025, so read it as the agency's 2023 position, not current guidance.

State law has since said something firmer. California's FEHA regulations covering automated-decision systems took effect October 1, 2025, and an agent acting for an employer, including a vendor operating the system, is itself an employer under the Act ²⁵. Illinois went to an effects standard: from January 1, 2026 it is a civil rights violation to use AI that has the effect of discriminating on a protected basis, with no requirement to prove intent ³.

None of that turns on what you knew. An effects standard asks what the tool did. An agency relationship attaches because the vendor acted for you, and good-faith reliance on a vendor's assurance does not work as a defense.

The litigation runs the same direction. In Mobley v. Workday, an order in July 2024 let disparate-impact claims proceed against the vendor on an agent theory, and in May 2025 the court granted preliminary certification of an ADEA collective ⁴. Nothing there is a finding that anyone discriminated, preliminary certification is a low bar that only permits notice, and it is an age case. What it demonstrates is the shape of the exposure: a claim that names both of you, with the employer still holding the decision.

Which clauses decide whether you can defend the decision?

The data clauses, not the indemnity. A discrimination defense runs on records you have to produce: applications and selections by stage, the tool's output at the time of the decision, the version that produced it, and the vendor's own testing. If the contract does not give you those on demand and after termination, the indemnity pays for a defense you cannot mount.

Four asks, in the order they get refused:

• Your candidates' stage-level records, exported on request, in a documented format, during the term and for a defined window afterwards.
• A version stamp on every output, so a score, list or recommendation can be tied to the ruleset that produced it.
• Written notice before a model, ruleset or threshold change, because a change restarts the audit clock and invalidates the analysis you already ran.
• The testing data behind the certificate. A summary states a conclusion. Ask for the counts underneath it.

That last one has a wrinkle worth raising with counsel early. A vendor's own bias testing may be protected work product in the vendor's hands, which means the number you would most want may be the number nobody produces. Plan the analysis you can run yourself, from data you hold, and make what you need from a vendor to survive an EEOC inquiry a procurement requirement, written into the contract. What you keep afterwards is a records question with its own rules.

Ask for these five things before signing

Bring the list to the vendor before the pricing conversation closes, because after signature every item on it is a change order. None of it is exotic, and all of it is refused often enough that a refusal is itself information about how the tool is built and how much the vendor knows about its own outputs.

1. Named scope. The indemnity covers discrimination and civil rights claims explicitly, not only intellectual property and confidentiality. 2. A separate cap. Discrimination claims sit outside the general liability cap, or above it. 3. Defense participation. You approve counsel, and no settlement characterizes your hiring practice without your consent. 4. Data rights. Export, retention and version stamping, with survival past termination. 5. Audit cooperation. The vendor supports your own analysis and any bias audit you owe, at a stated cost, within a stated time.

One caution about sequence. Diligence on the tool is a different exercise from diligence on the paper, and the paper cannot fix an instrument that does not hold up: work through what to ask a vendor claiming it is bias tested first, then negotiate. A strong indemnity attached to a weak tool buys a well-funded loss. Put the same five items on the renewal checklist, because the tool you signed for two years ago is not the tool running today.

Read the evidence >