AI Agents for Staffing &Recruiting Agencies in 2026

Most conversations about AI in staffing start with the model, which is the wrong end. Start instead with a question that has a checkable answer: what is the system of record, and who controls the write path into it? In a staffing or recruiting agency the answer is unusual, and it is the reason this industry is harder to automate than it looks. There are two systems of record, and you own only one of them.

Your applicant tracking system— Bullhorn, JobDiva, Avionté, Ceipal, Crelate and their peers — is your system of record. It holds candidates, submissions, activity and the placement record. You license it, you configure it, and within the vendor's terms you decide what gets written into it.

Your client's vendor management system— SAP Fieldglass, Beeline, Workday VNDLY, Coupa, Magnit, VectorVMS, Conexis and their peers — is your client's system of record. It holds the requisition, the submission of record, the approved timecard and the invoice. You do not own it. You did not choose it. You cannot change it, and when your client re-bids the program you may find yourself on a different one.

On enterprise accounts, supplier-side write-ups consistently describe the VMS as a mandatory gateway: submissions, timesheets and invoices flow through the client's system, and work arranged outside it does not reliably get paid. We are describing that as the observed commercial pattern in our own words rather than quoting anyone, because we did not locate a verbatim, fetchable supplier-side statement of it — and an article that manufactures a quotation to make a point it could have made plainly is not worth reading.

That structural split explains a specific and very common project failure. An agency builds an excellent agent against its ATS, demonstrates it beautifully, and then discovers that everything genuinely expensive — getting a submission accepted, getting a timecard approved, getting an invoice paid — happens in a system where the agency has no privileges at all. The build was not wrong. The scoping was. Nothing in this article is more valuable to you than working out, in week two, which side of that line each of your target workflows falls on.

Here is the genuinely good news, and it is a sharper contrast than anything else in this cluster of articles. On the ATS side, staffing has something the auto dealership and independent pharmacy worlds do not: a documented, publicly readable API.

Bullhorn publishes its REST API reference openly — entity operations, the OAuth 2.0 authorization flow, and documented error codes. And access is customer-gated rather than partner-gated, which is the part that matters commercially.

Bullhorn customers can obtain OAuth keys for developing applications with the Bullhorn REST API by creating a support ticket via the Bullhorn Resource Center.

— Bullhorn, Getting Started with REST

No partner agreement, no marketplace membership and no client sponsorship is stated as a prerequisite in that documentation. If you have read the pillar article in this cluster, that is rung one of the integration ladder, and it is the cleanest example of rung one anywhere in this batch of ten industries. Recognise it for what it is: your ATS vendor has made an architectural decision in your favour, and a great deal of what follows in this article is only possible because of it.

There is one caveat worth pricing. Bullhorn's documented error codes include a 429 Rate Limited response whose guidance is to wait one second and retry, repeating until successful — and we found no published request-per-minute quota. So you have a documented rate limit with no documented ceiling. Practically, that means you cannot capacity-plan a bulk operation from the documentation; you have to measure your own throughput empirically, build backoff and a queue from day one, and treat the limit as something that can move.

The VMS side is a different world, and the difference is not technical. SAP Fieldglass publishes an integration and connector library and a REST API, with configuration guides for S/4HANA, SAP Business Network, FMS and SuccessFactors Employee Central, and SAP runs a paid certification exam — SAP Certified Application Associate – SAP Fieldglass Services Procurement — covering configuration, administration, analytics and integration. On paper that looks like rung one with a rung-two certification layer bolted on.

But read the critical detail. Fieldglass connectors are enabled per company type — buyer, supplier or MSP. What a supplier can integrate is therefore a configuration that the buyer or the MSP controls, not the supplier. The documentation being public does not mean the capability is yours. It means the capability exists and somebody else decides whether you get it, per program, per client, potentially differently for two clients running the same platform.

Suppliers commonly report being left with manual portal entry and no API on many VMS programs. We looked for a neutral source establishing that as a general pattern and could not find one, so we will not state it as a fact — we will state it as what suppliers report, and note that it is exactly the kind of claim that is repeated everywhere and evidenced nowhere. What you should take from it is procedural, not statistical: ask per client, every time, and never assume an integration carries across accounts.

If either party will not answer in writing, that is itself an answer: you are designing for a lower rung than you hoped, and it is enormously cheaper to learn that in week two than in month five.

The pillar article in this cluster defines a five-rung ladder — documented public API, certified partner program, EDI or batch file, screen scraping or RPA, and no path at all — and the point of the ladder is that you are on exactly one rung, whatever your architecture diagram says. Staffing is the one industry in this batch where you are honestly on two at once, and where the two are far apart.

It is worth seeing what disclosure looks like at rung two elsewhere, because it calibrates what you should expect to be told. In property management, Yardi publishes its partner terms outright: "Participation in the Yardi Interfaces Program requires an annual license fee per interface. The annual fee varies per interface type and, in some cases, is based on a per-transactional model." The amount is not published, but the shape is — annual, per interface, sometimes per transaction. In healthcare, Epic publishes the two-tier logic plainly: "Enrolled vendors also can access an expanded API specifications catalog to enable their data exchange where industry-standard APIs may not yet exist or fully meet the needs of a specific use case." The standards-mandated tier gets you read access; the commercial tier gets you the long tail.

The same pattern shows up in the payroll and HR world you touch through your back office: ADP's marketplace is an application-only partner program, reported to seek partners with a substantial number of shared clients — the same prior-traction gate — with partners tracking revenue-share payments to ADP, though the percentage is not published anywhere we could find. Do not confuse it with ADP's publicly advertised accountant referral program, which is a different thing entirely. And one rung down, X12 publishes its licence tiers — commercial, internal, developer, subscription — and publishes no prices. Licensed, priced on application.

The fragility of rung one is worth naming, because it is easy to over-trust. A documented public API is not a promise. Its terms are the vendor's to set. The cleanest public illustration is Amazon's selling-partner API: Amazon announced in November 2025 a fee structure for third-party developers — a $1,400 annual subscription from January 31, 2026, plus monthly usage fees on GET call volume from April 30, 2026 — and then, as reported by the trade press in May 2026, said it would not move forward with those fees at this time, before any were collected. Access stayed free for sellers using it for their own business throughout. We have not read Amazon's own words on the reversal; the announcement page returned a 404 on fetch, so this is the reporting, not the primary. The reversal does not undercut the point. It proves it: the terms were always Amazon's to set, and they moved twice in six months.

On rung four, the honest treatment.Screen automation against a client's VMS portal is technically possible almost everywhere and is sometimes the only thing on offer — how often, we could not establish, and we say so in the limitations section rather than guessing. It is also contractually exposed and structurally fragile, and both halves have to be said out loud. You are consuming a presentation layer somebody else is free to change without notice or versioning, behind a login governed by terms your agency accepted as a condition of being on the program.

The case people cite for scraping's legality does not say what they think it says. In hiQ Labs v. LinkedIn the Ninth Circuit was reviewing a preliminary injunction under a sliding-scale standard, and concluded in its own words that "HiQ has therefore raised serious questions about whether LinkedIn may invoke the CFAA to preempt hiQ's possibly meritorious tortious interference claim." A serious question is not a holding that scraping is lawful. hiQ then lost in the district court on contract, in a November 2022 summary judgment finding it had breached LinkedIn's user agreement, and the matter ended in a December 2022 stipulated consent judgment of $500,000 plus a permanent injunction to cease scraping and destroy derived source code and data.

And on the federal computer-crime statute itself, Van Buren v. United States expressly left the relevant question open: "For present purposes, we need not address whether this inquiry turns only on technological (or 'code-based') limitations on access, or instead also looks to limits contained in contracts or policies."Say "Ninth Circuit," not "US law" — other circuits are not bound — and treat contract exposure as the live risk, because contract is the claim that actually bit. For a staffing agency the exposure is worse than for a random scraper, because the terms you would be breaching belong to a client whose program you want to renew.

One more thing that belongs here, because it is the most common architectural misunderstanding of 2026. Wrapping an integration in an MCP server does not change your rung. The Model Context Protocol standardises how a tool is described and called; it does not decide whether your agent may issue a write into someone else's system of record. If a client program has not enabled supplier integration, an MCP server does not enable it. It also brings its own churn: the current specification, dated 2026-07-28, describes MCP as transforming from a bidirectional stateful protocol into a request/response stateless protocol — a breaking change roughly eight months after the previous stable specification. Build on it if you like the ergonomics. Do not put it in a business case as if it were access.

In every other industry in this cluster, the binding constraint on agent autonomy is a vendor contract. In staffing it is a statute — several of them, in different jurisdictions, on different triggers, with different remedies. This is the section to read twice, because it does not just tell you what to disclose. It tells you what to build.

Start with New York City, because it is both the oldest of these laws and the best-documented. Local Law 144 of 2021, codified at Administrative Code sections 20-870 and following, applies to employers and to employment agencies using an automated employment decision tool to substantially assist or replace discretionary decision making for hiring or promotion. Three coverage triggers are reported: the job is in a New York City office at least part-time; or the job is fully remote but tied to a New York City office; or the employment agency using the tool is itself located in New York City. That third trigger is the one staffing firms miss, and it is the one that most often applies to them — the candidate can be anywhere, the client can be anywhere, and you are still covered because of where you sit.

The requirements are three: an independent bias audit within the past year; public posting of a summary of the audit results; and at least ten business days' notice to candidates and employees before the tool is used. Final rules were adopted by DCWP on April 6, 2023, and enforcement began July 5, 2023. Penalties under Administrative Code section 20-872 run to $500 for a first violation and each additional violation on the same day, and $500 to $1,500 for each subsequent violation — per day.

Now the part everyone gets wrong in both directions. Enforcement to date has been weak, and unusually, there is a state audit that documents exactly how weak. The New York State Comptroller published Enforcement of Local Law 144 – Automated Employment Decision Tools on December 2, 2025, covering July 2023 through June 2025. Its findings are specific:

• Two complaints in two years: DCWP received only two AEDT complaints across the entire audit period, and did not test whether its own complaint intake actually worked.
• One issue found across 32 companies: DCWP reviewed 32 company websites and bias audits and identified one non-compliance issue.
• The Comptroller reviewed the same companies and found far more: In the audit's own words, at least 17 instances of potential non-compliance under LL144.
• Established enforcement procedures went unused: DCWP did not use the formal enforcement procedures it had established with the Office of Technology and Innovation.
• A capability gap, not just a will gap: DCWP officials lacked technical expertise and did not consult available technical resources.
• No penalties indicated: No civil penalties are indicated as having been issued during the audit period.

DCWP's AEDT complaint process is ineffective in ensuring that all complaints related to non-compliance with LL144 are routed to DCWP.

— New York State Comptroller, Enforcement of Local Law 144 – Automated Employment Decision Tools (December 2, 2025)

Illinois has two separate laws and they are constantly conflated. The first is the Artificial Intelligence Video Interview Act, 820 ILCS 42, which itself has two effective dates. Since January 1, 2020 (Public Act 101-260), before using AI to analyse a video interview an employer must notify the applicant that AI may be used and may consider their fitness for the position, explain how the AI works and the general types of characteristics it uses, and obtain written consent. Videos may be shared only with persons whose expertise or technology is necessary to evaluate the applicant, and on request all copies must be deleted within 30 days, with other holders instructed to delete.

Since January 1, 2022, added by Public Act 102-47 (HB 53, signed July 9, 2021), employers who rely solely on AI to decide whether an applicant gets an in-person interview must collect demographic data — the race and ethnicity of applicants afforded and not afforded interviews, and of those hired. Get the deadline right, because the one usually quoted is the wrong one.

The demographic data collected under subsection (a) must be reported to the Department of Commerce and Economic Opportunity annually by December 31.

— 820 ILCS 42, Artificial Intelligence Video Interview Act

That is the employer's deadline — December 31 each year, for the twelve months ending November 30. The July 1date circulating in compliance write-ups is the Department's own obligation to analyse the data and report to the Governor and General Assembly. If you plan around July 1 you will be seven months late.

The second Illinois law is HB 3773, amending the Illinois Human Rights Act, in force since January 1, 2026. It prohibits employers from using AI that has the effect of subjecting employees to discrimination on a protected basis with respect to recruitment, hiring, promotion, renewal, selection for training or apprenticeship, discharge, discipline, tenure, or terms, privileges and conditions of employment. It expressly prohibits using zip code as a proxy for a protected class, and it requires notice to applicants and employees when AI is used for those purposes. Effect, not intent, controls — there is no good-faith defence in an effects test. One status caveat: the Illinois Department of Human Rights withdrew its proposed implementing rules, so while the statutory obligations have been in force since January 1, 2026, the detailed notice timing and means remain unsettled.

California is where a staffing agency can be the defendant rather than the tool supplier. The Civil Rights Council's FEHA regulations on automated-decision systems took effect October 1, 2025, applying to employers with five or more employees in California. They reach a computational process that makes a decision or facilitates human decision making regarding an employment benefit — note the second half, which captures tools that only assist. Use of such a system violates FEHA if it discriminates directly or by disparate impact, and records including automated-decision-system data, machine-learning data, selection criteria and applicant-flow logs must be retained at least four years.

Then there is Raines v. U.S. Healthworks Medical Group, S273630, decided by the California Supreme Court on August 21, 2023. FEHA's definition of employer includes any person acting as an agent of an employer, and the court held that a business entity acting as an employer's agent, with five or more employees, carrying out FEHA-regulated activities on the employer's behalf, can be held directly liable for employment discrimination. The court left open whether agents with fewer than five employees can be. For a staffing firm screening on a client's behalf in California, that is the sharpest fact in this entire article: you cannot outsource the decision, and you cannot be shielded by the fact that it was your client's vacancy.

California also has pending legislative activity worth tracking without over-reading. SB 7, the "No Robo Bosses Act," passed both chambers and was vetoed by Governor Newsom on October 13, 2025, on grounds that it was overbroad and duplicative and that its notification requirements swept in businesses using innocuous tools. On February 2, 2026, Senator McNerney reintroduced a narrowed version as SB 947— post-use notice only, with clearer prohibited scenarios covering predictive behaviour analysis and compensation decisions. We did not verify SB 947's status as of August 2026, so that is where our account stops.

Texas enacted TRAIGA, the Texas Responsible Artificial Intelligence Governance Act (HB 149), effective January 1, 2026, with broad disclosure requirements and discrimination prohibitions and tiered civil penalties. You will read in many places that TRAIGA requires discriminatory intent and therefore excludes disparate impact. That claim is plausible and frequently repeated, and we could not confirm it against the statute — so we do not assert it, and neither should your compliance memo until somebody has read the enrolled text.

Colorado deserves its own section because almost every version of this story you will encounter is wrong in a way a compliance reader will catch instantly. Here is the accurate account, and each element matters.

SB 24-205, the 2024 Colorado AI Act, took effect on June 30, 2026 by its own terms, after an earlier delay from February 1, 2026. It is live law. What happened next is not that it was struck down.

In xAI LLC v. Weiser, No. 1:26-cv-01515 in the District of Colorado, assigned to District Judge Daniel D. Domenico, xAI filed on April 9, 2026 challenging SB 24-205. The United States intervened — reported as the first federal intervention in a challenge to a state AI-governance law. Then, on April 27, 2026, Magistrate Judge Cyrus Y. Chung granted a joint motion filed by xAI, the United States and Attorney General Weiser together, staying enforcement of SB 24-205 and of any legislation replacing or amending it, until fourteen days after the court rules on xAI's forthcoming preliminary-injunction motion.

That replacement is SB 26-189, "Automated Decision-Making Technology" — prime sponsors Senators Rodriguez and Coleman and Representatives Duran and Bacon — signed by Governor Polis on May 14, 2026. It repeals and reenacts the 2024 Act and takes effect January 1, 2027, with developer documentation duties and the Attorney General's implementing rules pegged to the same date. You may see an earlier, different effective date quoted for this act. It comes from a site-wide legislative banner about bills enacted without a safety clause, and it does not apply here: that banner's own text ends "unless otherwise specified," and this act otherwise specifies. We could not retrieve the enrolled act to verify its internal section numbering, so we state the effective date and cite no section numbers for it.

What SB 26-189 requires is consistent across the practitioner analyses we reviewed. It governs automated decision-making technology — broadly, technology that processes personal data and uses computation to generate outputs such as predictions, recommendations, classifications, rankings or scores, used to make, guide or assist a decision about an individual. A consequential decision expressly covers employment, alongside education, housing, financial services, insurance, healthcare and government benefits. On the employment side, that means decisions that deny, reduce or limit access to employment opportunities, make applicants ineligible, lower compensation, or impose worse terms than comparable applicants receive.

Consumers also get correction rights over their personal data and the human-review right. Exemptions include FDA-regulated devices, FERPA schools, state-regulated insurers, creditors following sector-specific rules, and most HIPAA entities — though notably not for employment and financial-assistance decisions, which is precisely the carve-back that catches healthcare staffing.

There is one more piece of national context, and it should be stated as contested rather than settled. On December 11, 2025 an executive order titled "Ensuring a National Policy Framework for Artificial Intelligence" directed the Department of Justice to stand up an AI Litigation Task Force by January 10, 2026, directed publication of a list of "onerous" state AI laws by March 11, 2026, and directed Commerce to condition $42 billion in BEAD broadband funds on repeal of such laws. Legal commentators are consistent that an executive order cannot itself preempt state law — preemption requires a statute or a valid federal regulation, and courts decide. State AI laws have not been preempted. Build to them.

A great many staffing firms concluded in 2025 that federal AI-hiring risk had gone away. That reading is understandable and wrong, and the distinction is worth ten minutes of your time.

On January 27, 2025 the EEOC removed its AI guidance from eeoc.gov, including the Artificial Intelligence and Algorithmic Fairness Initiative page and the associated technical-assistance documents — the May 2023 Title VII adverse-impact material and the ADA guidance. OFCCP's AI and EEO guidance for federal contractors was also removed. Executive Order 14281 of April 23, 2025 directs agencies to de-prioritise disparate-impact enforcement.

Which brings us to the case that should change how you read a software contract. Mobley v. Workday, in the Northern District of California before Judge Rita Lin, advances a theory that matters structurally: that Workday's AI recommendation system scores, sorts, ranks or screens applicants across many employers — a unified policy — which makes the vendor a proper defendant rather than only the employers using it.

• May 16, 2025 — conditional certification: The court granted preliminary certification of an ADEA collective.
• The collective's scope: Applicants aged 40 and over who applied for a job through the Workday platform from September 24, 2020 to the present, with an opt-in deadline of March 7, 2026.
• March 6, 2026 — applicants are covered: The court rejected Workday's argument that ADEA disparate-impact protection covers only current employees, confirming that applicants aged 40 and over can challenge AI screening tools.
• Through 2026 — discovery fights over bias testing: Further rulings addressed the limits of AI bias-testing discovery and applicant-data disclosure, including privilege questions around bias-testing data.
• What has NOT happened: There is no liability finding, no damages award and no class-wide merits ruling. Anyone telling you Workday lost is telling you something that is not in the record.

The procurement lesson is direct. If a screening vendor can be a defendant on a unified-policy theory, then the vendor's bias-testing practice, its documentation, and its willingness to put both in your contract are not nice-to-haves. They are the substance of your diligence. And note the discovery angle: bias-testing data has been the subject of privilege fights, which means the question "do you test, and can I see it?" is one your vendor has almost certainly thought about before you asked.

One federal rule that does apply directly to your outbound operations: on February 8, 2024 the FCC adopted a declaratory ruling holding that an AI-generated voice is an artificial or prerecorded voice under the TCPA, effective on adoption. Calls using one require prior express consent, and prior express written consent if the content is marketing. There is a healthcare exemption in this area, but it is scoped to HIPAA-covered entities and their business associates delivering healthcare messages — do not assume it reaches a staffing agency's candidate outreach. Separately, the FCC's "revoke-all" consent-revocation rule has slipped repeatedly: due April 11, 2025, delayed a year in April 2025, and extended again in January 2026 to January 31, 2027. Build the opt-out architecture now; the deadline moving is not a reason to defer it.

Everything above resolves into one operational question: at each step from requisition to placement, what may an agent do? Here is the flow with the lane marked, built from the legal constraints rather than from what is technically feasible — because in this industry the technical ceiling is far above the legal one.

The single most important row in that table is screening and ranking, and it is the one most vendors handle badly. The instinctive defence — "we only ranked, a human decided" — does not exit Local Law 144, because the statute attaches where a tool substantially assistsdiscretionary decision making. Assisting is enough. The same logic runs through California's regulations, which reach a process that facilitates human decision making, and through Colorado's framework, which answers with notice, explanation and meaningful human review rather than with an exemption for human-in-the-loop.

There is a second reason to keep the agent out of the judgement steps, and it has nothing to do with compliance. Requisition text, resumes and candidate messages are untrusted external content. An agent that reads untrusted content, holds a credential into a system of record, and can act without a human seeing the result first has all three elements of what Simon Willison named the lethal trifecta: access to private data, exposure to untrusted content, and the ability to externally communicate in a way that could be used to steal data. On whether that is fixable, he is direct: "we still don't know how to 100% reliably prevent this from happening."

So treat prompt injection as a blast-radius problem, never as a solved one. Remove any one leg of the trifecta and the exposure collapses: give the reading agent no write credential, keep untrusted content out of any session that holds one, and put a human on the step that commits. The OWASP GenAI LLM Top 10 for 2026, published August 4, 2026, is a useful checklist here — for agents with tool access to production systems the priority pair is LLM03:2026 Excessive Agency and LLM10:2026 Improper Output Handling, alongside LLM01:2026 Prompt Injection itself, with mitigations for excessive agency that are exactly what you would expect: least privilege, confirmation for high-impact actions, and tool-usage logging.

On identity, the honest position is that the controls are real inside one vendor's estate and immature across estates. Microsoft's Entra Agent ID documentation names the two modes cleanly — "Autonomous access. Agents can act autonomously, using access rights given directly to the agent identity" and "Delegated access. Agents can act on behalf of human users, using access rights given to the user. The user has control over which rights are delegated" — and explains why a service principal is the wrong primitive, since application identities carry an expectation of long-term stability and managed lifecycle whereas an agent may exist for minutes. Note the licensing shape: the identity is available to all Entra customers, but extending Entra security features to agents requires Microsoft Agent 365. The identity is free; the controls are the upsell. Across vendors there is no settled answer: the leading standards effort for carrying delegated authority between trust domains, the Identity Assertion JWT Authorization Grant, is an Internet-Draft at revision -04 dated May 21, 2026, in the state "I-D Exists." It is not an RFC. Do not design as though it were.

If the front of the funnel is where the legal risk concentrates, the back of it is where the money and the safe wins are. Redeployment, timesheet chasing, reconciliation and back-office hygiene are high-volume, largely administrative, and — critically — mostly live in systems you control.

Redeployment is the highest-margin work in staffing and the most consistently under-served, because it depends on somebody noticing an assignment ending while there is still time to act. That is precisely what an agent is good at: watch assignment end dates in the ATS, surface the ending assignments, and put objectively matching open requisitions in front of the recruiter. One caution that people miss: a redeployment shortlist is still a shortlist. If you rank redeployment candidates against a req, you have built a ranking, and every analysis in the section above applies. Keep the output factual — availability, licence and certification currency, geography, verified skill match — and let the recruiter do the comparing.

Timesheets and invoices are where duplicate writes hurt, and this is an engineering problem with a known shape.The reference implementation is Stripe's, and it is worth reading even if you never touch payments. Stripe's idempotency works by saving the resulting status code and body of the first request made for a given key, regardless of whether it succeeded or failed, so subsequent requests with the same key return the same result — including 500 errors. The client generates the key. Keys may be pruned after at least 24 hours, and Stripe's own documentation is explicit that it generates a new request if a key is reused after the original is pruned.

That last detail is the one that produces real duplicate-invoice incidents: idempotency has an expiry, and a retry a week later is a new write. And there is no standard to fall back on — the IETF's draft Idempotency-Key headersits at revision -07, dated October 15, 2025, in the state Expired. It is not an RFC. The de-facto convention is Stripe's, which is why every vendor's semantics differ slightly and why you must read each one.

There is a pleasant corollary for the batch and file rungs. If a client program exchanges timesheets or invoices as files rather than API calls, the file is the reconciliation checkpoint — you get for free the thing you would otherwise have to engineer. Do not treat a batch interface as a downgrade. For an agent it is frequently the safest write path available, because a batch has a natural point at which somebody compares what was sent with what was received.

Finally, prefer reversible writes everywhere in the back office. A draft invoice beats a posted invoice. A staged payroll file beats a submitted one. A flagged exception beats an automatic adjustment. Reversibility is the cheapest blast-radius control available, it composes with every other control in this article, and in a business where the product is trust with both a client and a worker, it is the difference between an incident and an embarrassment.

Every article in this cluster asks what the vendor contract actually permits and what it costs. In staffing the answer has an unusual twist: the largest integration-adjacent cost in your business is a fee your client's program charges you, and it is deducted from your bill rate rather than invoiced to you.

The VMS and MSP world largely runs on a supplier-fundedmodel. The program fee comes out of the bill rate, which means the staffing agency pays for the client's program. Providers in that market publish typical ranges themselves, and those ranges are what we can honestly report — with the caveat that every source is a participant writing about its own market rather than an independent auditor.

Two planning consequences follow. First, your automation business case has to clear a fee you did not set and cannot reprice. If a workflow saves less than the friction it removes from a program you fund at two or three per cent of spend, the honest answer is that you should be negotiating the program, not building software. Second, the fee is attached to a contract between your client and its MSP — which means it can change without you being at the table, and it typically changes at re-bid, which is also when your integration surface changes.

On the ATS side the picture is unusually clean. We found no published fee presented as a prerequisite for customer API access in Bullhorn's documentation — the process described is a support ticket for OAuth keys. That is worth naming as a genuine positive, because in most of the industries in this cluster the equivalent sentence is "the vendor routes you to sales and publishes nothing." What we could not find anywhere is a published per-interface fee schedule for supplier integration into a VMS program. Treat that absence as the finding, and get the number in writing before you design around it.

This is the artefact to produce before any code exists, and to have signed by whoever carries the compliance risk in your business. It is not a policy document. It is a capability specification: the right way to enforce most of these rows is that the agent lacks the credential to do the thing, not that it has been told not to.

Two supporting practices make the boundary auditable rather than merely stated. First, a separate identity per agent — never a shared service account — with least-privilege scoping, credential rotation and per-action audit logging, plus step-up authorisation for anything privileged. Second, record the tool version, the inputs, the output and the reviewing human together. California requires automated-decision-system data, machine-learning data, selection criteria and applicant-flow logs to be retained at least four years; Colorado requires three-year records from January 1, 2027. Configure retention to the longest requirement that applies to you and stop thinking about it.

Integrations in this sector do not usually fail loudly. They fail quietly, on somebody else's change, and the first symptom is often a number that stops moving. Here is the failure catalogue for staffing specifically, with the detection signal and the rollback.

Notice the pattern: the top three entries are all commercial events, not technical ones. A client re-bidding its MSP, an acquisition in the VMS layer — Workday is reported to have acquired VNDLY and Magnit to have consolidated PRO Unlimited, and the layer keeps consolidating — and your own ATS shipping the feature you paid to build. None of those are prevented by better engineering. They are managed by keeping the integration layer thin and replaceable, so that when the commercial ground moves you are rewriting an adapter rather than a platform.

We should say clearly what we could not establish here. We did not verify any specific VMS API deprecation or version-pinning incident with dates, and we are not going to invent one to make the section feel more concrete. The version-pinning discipline is still correct — assert the schema and version at runtime, fail closed on mismatch, alert a named owner — but we are recommending it on principle and on the evidence from adjacent industries, not on a documented staffing incident we can point you to.

One more control that is worth its cost in this sector specifically. Because so much of your inbound content is untrusted — resumes, requisition text, candidate messages, client emails — run the reading agent and the writing agent as separate identities with separate credentials. The MCP specification's own security document is instructive on why: it is entirely composed of blast-radius controls, including a requirement that servers must not accept tokens that were not explicitly issued for them, and a scope-minimisation section that names expanded blast radius, privilege chaining and audit noise as the risks of omnibus scopes. None of those controls prevent prompt injection. They constrain what a successfully injected agent can reach — which is the whole practical discipline, and the fact that a standards body's security guidance is 100% blast radius and 0% prevention is the tell.

This is the part most articles replace with a list of benefits. Here is an actual sequence, with owners, entry and exit criteria, and what to do when a phase fails — because the phases that fail are the ones that save you money, provided they fail early.

Two things about that sequence are deliberate and worth defending. Phase 1 puts legal before engineering, which in most industries would be over-cautious and in this one is simply correct: the determination of whether your tool is an automated employment decision tool in New York City, an automated-decision system in California, and covered technology in Colorado from January 1, 2027 changes what you build, not merely what you disclose. And Phase 5 goes client by client, because VMS integration is a per-program configuration owned by somebody else. There is no version of this where you integrate "the VMS" once.

Engagements are senior-led at $150–$225 per hour, with ongoing support on retainer at $2,500–$9,500 per month. Every build carries a 30-day post-launch warranty, and you receive a written fixed-price phased proposal within 5 business days of the discovery call. Full source-code and IP ownership transfers to the client — which matters more than usual in this sector, because your integration adapters encode hard-won knowledge about specific client programs that you should never have to re-license.

Frenchy Digital is a senior-led, Black-owned agency in Los Angeles. You can book a discovery call at calendly.com/frenchydigital/discovery-call or call +1 (424) 272-5601.

You will be pitched constantly, and some of what you are pitched will be genuinely good. This is the list we would run any staffing AI proposal against, and most of it can be checked in an hour without technical help.

The same discipline applies to the headline failure statistics that circulate in every AI board deck — the widely repeated claims that some very large percentage of GenAI pilots fail, or that AI projects never reach production, or that a given share of agentic projects will be cancelled by a particular year. We do not print those figures. When we chased them, they resolved into survey questions that measured something else, or into numbers with no published methodology at all. A statistic nobody can source is worth less to you than this sentence saying so.

And on accuracy specifically: there is no independent benchmark for staffing AI. Every accuracy, match-quality, deflection and containment figure in this market is vendor-published, without methodology, sample or audit. We exclude accuracy from vendor evaluation by design, and we would encourage you to do the same — not because accuracy does not matter, but because the published numbers do not measure it. The same is true of security claims. As Simon Willison observed of the products sold as prompt-injection defences, they "almost always carry confident claims that they capture '95% of attacks' or similar" — and in web application security, "95% is very much a failing grade."

A research note that reports only what it found is not a research note. Here is what we chased and could not establish, stated plainly so you can weigh everything above accordingly.

• Whether VMS platforms generally deny suppliers API access: Suppliers commonly report being left with manual portal entry on most programs. It is widely asserted in staffing trade writing and we found no neutral source establishing it. We report it as what suppliers say, not as a fact about the market.
• Any verbatim supplier-side statement that the VMS is a mandatory gateway: We hold no fetched, quotable sentence from any supplier-side source on this point, so we describe the commercial pattern in our own words and put no quotation marks around it. An earlier draft of the underlying research carried a sentence in quotation marks that did not appear at the cited source; it was removed, and we mention it because the failure mode is instructive.
• Any published per-interface fee schedule for VMS supplier integration: We could not locate one. The MSP and VMS percentage ranges we do report are published by participants about their own market and are not audited by anyone independent.
• A published request-per-minute quota for the Bullhorn REST API: The documented error codes include a 429 with a retry instruction; we found no published quota. Measure your own ceiling and build backoff.
• Any documented VMS API deprecation or version-pinning incident with dates: None found. We recommend version assertions and canary transactions on principle and on evidence from adjacent industries, not on a staffing incident we can cite.
• The internal section numbering of Colorado SB 26-189: The enrolled act's paths returned 404 on every attempt. The January 1, 2027 effective date is solid and independently confirmed across practitioner analyses; the section-level citation is not, so we print no section numbers for it.
• Whether TRAIGA requires discriminatory intent: Frequently written, plausible, and unconfirmed against the statute. We do not assert it, and a compliance memo should not either until somebody reads the enrolled text.
• The status of California SB 947 as of August 2026: It was reintroduced on February 2, 2026 as a narrowed successor to the vetoed SB 7. That is where our account stops.
• The NYC DCWP AEDT FAQ, directly: The DCWP FAQ and AEDT pages returned HTTP 403 to our fetcher, so the Local Law 144 mechanics above come from practitioner summaries. The State Comptroller audit, which is the load-bearing item in that section, we did read.
• Any independent measurement of agent integration success or failure rates: None found, in this sector or any other. Anyone quoting a headline failure percentage for AI projects is quoting something that does not survive a citation check.
• Any vendor-neutral accuracy benchmark for staffing AI: There is none. Every published figure is the seller's, which is why accuracy is excluded from our evaluation framework rather than weighted lightly within it.
• Amazon's own words on the SP-API fee reversal: The announcement page returned a 404 on fetch. We describe the episode as reported by the trade press, we give the month rather than a specific day because secondary reports disagree on the day, and we quote nobody.

None of this argues against building. It argues for building the way the constraints actually permit: one workflow at a time, read-first, with the legal determination made before the architecture, with the boundary signed by whoever carries the risk, and with the idempotency and reconciliation discipline in place before the first invoice is ever raised by software.

And it argues for holding the line that makes the whole programme defensible. Your ATS is yours and it is unusually open. Your client's VMS is not yours and never will be. The law in between is moving, it is jurisdictional, and it attaches at assisting rather than at deciding. Inside all of that, an agent can still parse and normalise, deduplicate, check hard eligibility, schedule, chase documents and timesheets, reconcile hours across two systems, surface redeployments and draft the submittal — which is a great deal of real, billable, margin-protecting work, honestly done. What it may never do is decide who gets the job. A human does that, personally, every time, and can say why.