Vendor Liability Under FEHA's ADS Rules: Why Buying an AI Tool Doesn't Shield You
FEHA / EEO Defense
There's a specific assumption that gets a lot of California employers in trouble: "we outsourced hiring to a vendor's AI tool, so if it discriminates, that's the vendor's problem." AI vendor liability under FEHA doesn't work that way. The California Supreme Court has held that certain third-party business agents performing FEHA-regulated employment functions may be sued directly alongside the employer.
Understand the actual legal mechanism, and why your indemnification clause is protecting your wallet rather than your legal position.
Key Takeaways
Raines v. U.S. Healthworks Medical Group (2023) established that business-entity agents with five or more employees, performing FEHA-regulated functions on an employer's behalf, can be directly liable as "employers" under FEHA.
The California Supreme Court explicitly described this ruling as increasing the number of possible defendants rather than reducing the employer's liability.
Indemnification is a private, post-liability cost-allocation agreement between you and your vendor. It has no bearing on whether an applicant can sue you or whether a court finds you liable.
Indemnification is only as valuable as your vendor's solvency and willingness to honor it. A clause with an insolvent or uncooperative vendor behind it protects nothing.
Your own independent compliance posture, vendor diligence, manager training, and documented oversight matter regardless of how strong your vendor contract is.
The Case That Settled This: Raines v. U.S. Healthworks Medical Group
In Raines v. U.S. Healthworks Medical Group (2023), the California Supreme Court answered a question the Ninth Circuit had certified up to it: can a third-party business agent, not the employer itself, be held directly liable under FEHA (Fair Employment and Housing Act)?
The plaintiffs had received conditional job offers and were then required to complete pre-employment medical screenings through a third-party vendor. They sued both the prospective employers and the screening company. The Court answered yes, with a specific test: a business-entity agent with five or more employees that performs FEHA-regulated activity on an employer's behalf can be held directly liable as an employer under FEHA.
The reasoning is increasingly relevant to vendors that perform employment functions on an employer's behalf, including certain AI screening tools. Whether a particular AI vendor qualifies will depend on the facts and the role it performs.
What Indemnification Protects (and What It Doesn't)
Here's where the Court's reasoning becomes especially useful for employers. In explaining why it was comfortable holding vendors directly liable, the Court noted that business agents have real bargaining power with employers, sufficient to negotiate indemnification provisions, including indemnification against FEHA liability.
The Court assumed that indemnification would exist and held the vendors liable anyway. Indemnification was never a reason to let vendors off the hook. It's a separate, private arrangement about who ultimately pays, decided after liability is established, between the parties who agreed to it.
It has no bearing on:
Whether the applicant can sue you.
They can, regardless of what your vendor contract says. FEHA liability runs directly to the employer; a contract between you and a third party doesn't change that.
Whether a court finds you liable.
The underlying discrimination claim is assessed on its own facts. Your indemnification clause isn't evidence in that analysis.
Whether your vendor can actually pay.
Indemnification is only as good as the vendor's ability and willingness to honor it. An early-stage AI vendor that folds, gets acquired, or disputes the claim leaves you holding the liability regardless of what the contract says.
What indemnification does protect is the cost allocation between you and your vendor, assuming the vendor is solvent, the clause actually covers the specific claim, and it survives a dispute over its own terms. That can provide meaningful financial protection.
Why "It's the Vendor's Algorithm" Isn't a Defense
The practical consequence of Raines is that a discrimination claim tied to an AI hiring tool can now name both you and your vendor as co-defendants, and each of you has to defend your own conduct independently. This connects directly to how these claims tend to scale.
Once a tool's output is challenged for one applicant, the same output pattern likely affected others in the same applicant pool, which is exactly the dynamic behind how employment class actions build in California. A single AI screening pattern, if discriminatory, doesn't stay a single-plaintiff problem for long.
Two things follow from this that most employers underweight:
1.
"We didn't build the algorithm" isn't a defense to your own liability.
You chose to deploy it, you controlled how it was used in your hiring process, and FEHA doesn't require you to have written the code to be liable for the outcome.
2.
Your vendor being liable too doesn't cap what you owe.
Co-defendants generally don't share a single damages pool that gets split evenly. Each defendant may face its own potential liability depending on the claims, applicable statutes, contractual rights, comparative fault principles, and the court's ultimately allocation of responsibility.
If you're unclear about how FEHA liability works more broadly, our foundational guide to FEHA is worth reading alongside this piece, since the Raines agent theory sits atop that broader framework rather than replacing it.
Practical Steps Employers Should Take Before Buying AI Hiring Software
Given that indemnification is a secondary protection rather than a primary one, here are some things to take care of that will help reduce your exposure:
Treat vendor selection as a compliance decision, not just a procurement one. A lower-cost tool with weaker bias-testing practices isn't a bargain if it increases your own direct exposure.
Don't rely on your vendor's compliance as a substitute for your own. Request their bias-testing documentation, but also conduct your own review of outcomes in your specific applicant pool. Their testing on their broader client base doesn't necessarily reflect your results.
Confirm your vendor's actual solvency and claims history, not just their contract language. An indemnification clause from a vendor that can't pay is a promise backed by no value.
Train your hiring managers on what the tool is actually doing, not just how to use its interface. If a manager can't explain why a candidate was screened out, that's a gap regardless of whose algorithm made the call.
Document your own oversight of the tool: review cadence, questions asked of the vendor, and any concerns raised. This is what shows you weren't simply deploying the tool unthinkingly and assuming the vendor's compliance would satisfy your own legal obligations.
Our FEHA / EEO Defense team reviews exactly this: the gap between what your vendor contract promises and what your own compliance posture actually looks like independent of that contract.
And if you're building out the internal training your managers need to spot these gaps before they become claims, our guide on supervisor training that reduces FEHA lawsuits covers what that training needs to include.
Conclusion
The California Supreme Court's ruling in Raines v. U.S. Healthworks Medical Group established that AI vendors and other third-party agents performing employment functions can be held directly liable under FEHA. The Court explicitly noted this "increases the number of defendants," not decreases the employer's own exposure.
An indemnification clause with your vendor is a private arrangement about who ultimately pays, decided after liability is found. It does not affect whether an applicant can sue you, whether a court finds you liable, or how strong your own compliance record needs to be.
If you're facing a discrimination claim involving an AI vendor or third-party hiring tool, DefendMyBiz offers a free 15-minute consultation. Book a call with our employer defense team today.
Frequently Asked Questions
Can my AI vendor be sued directly for discrimination?
Does having an indemnification clause with my vendor protect me from being sued?
If my vendor is also liable, does that reduce what I owe?
Is "we didn't build the algorithm" a valid defense?
What actually protects me if indemnification doesn't guarantee protection?
Disclaimer: The above content is for informational purposes only. This is not legal or tax advice. Laws, IRS guidance, and withholding requirements can change, and outcomes depend on specific facts. You are advised to contact a qualified attorney for any legal advice.
