Top 10 AI Agents for Recruiting FirmsRanked on What You Can Verify

Almost every published ranking of AI recruiting agents contains a product you cannot buy, and the correction most writers make to fix it is also wrong. That is the cleanest available demonstration of why a vendor list needs re-checking rather than copying, so it is where this article starts.

The product is Moonhub. Most lists still rank it, usually with the note "acquired by Salesforce." TechCrunch reported the deal on 2 June 2025 under a headline saying Salesforce "buys" the company — and then carried a same-day correction in the body, in which a Salesforce spokesperson stated that Moonhub "has not, in fact, been acquired (by the company's definition of the term)." What actually happened is that Moonhub was shutting down and only some of its team joined Salesforce, where they went on to work on Agentforce. Moonhub's own announcement, signed by founder and CEO Nancy Xu, said the team was joining Salesforce; it contained no wind-down date, no customer-continuity statement and no statement about the product's future. Salesforce was already both a customer and an investor. The company had raised $14.4M.

So a writer who notices the product is gone and "corrects" the entry to "acquired by Salesforce" has published a characterisation the acquirer publicly denied. The only accurate framing is the narrow one: the team was absorbed into Salesforce Agentforce while the company wound down, and Salesforce disputed the description of it as an acquisition. The domain still resolves, which is how it keeps surviving in listicles — but it is a frozen shell, with a banner about the team joining Salesforce, a login, some demo calls-to-action, no pricing, and a footer reading "© Moonhub 2025." It does not go in the table.

In In the Matter of Presto Automation Inc., an administrative proceeding instituted on 14 January 2025 and believed to be the SEC's first AI-washing enforcement action against a public company, a drive-thru voice AI vendor had told investors its product delivered "over 94% accuracy even in noisy environments" and 95% to 99% "automated order completion." The SEC found the product "lacked the capability to take orders on their own and required substantial human involvement," with "human order takers located abroad (primarily in the Philippines and India), who processed the vast majority of drive-thru orders." An internal message quoted in the order put it more directly: the company was "telling investors Presto AI is running 95%+ accuracy without disclosing AI is doing NONE of the work and all orders are processed by humans."

Three framing points that must travel with that citation: Presto consented to the order without admitting or denying the findings; the remedy was a cease-and-desist order with no civil penalty, so it was not a fine; and the findings run against Presto only — the order's "Supplier A" is a different company against which the SEC made no findings at all. The relevance here is narrow and useful: this is what happened the one time a regulator audited a vendor's published AI performance metrics. It is why the table below scores only the things you can go and check yourself, and why the section immediately after this one is a list of what we refused to score.

If you want the cross-industry version of this argument — the same methodology applied to agent vendors in eight other verticals — it lives in our general ranking of the top AI agents in 2026. This article narrows it to one reader: the owner or principal of a staffing firm, executive search firm or agency recruiting desk. Not a corporate talent acquisition team. That distinction changes which products are even relevant, and it disqualifies several that dominate the generic lists.

We scored four things, all of which you can re-check yourself in an afternoon: whether a named independent auditor has published a dated bias audit of the product, what security attestations the vendor actually publishes on its own trust page, which staffing applicant tracking systems appear in its current public integration documentation, and whether it publishes real prices. Every cell in the table carries either a checkable fact or the literal words "not publicly disclosed." We never estimated a price.

No independent benchmark of these products exists. That is not a rhetorical flourish; it is a finding, and it separates recruiting from several adjacent markets where genuine third-party evaluation does exist. Two benchmarks circulate in this category and each is run by a party that wins it. PeopleSearchBench, an arXiv preprint evaluating several people-search tools, was authored by the LessieAI research team, and Lessie ranks itself first on every metric it reports. The Exa People Search Benchmark, published in December 2025, is run by Exa, which is itself a vendor in the space. A third vendor's top score is self-reported on that vendor's own blog. None of that is fraud, and none of it is evidence.

G2, Capterra and Gartner Peer Insights are user-review aggregators, not evaluations. They measure who asked their customers to leave a review. Citing a Peer Insights position as independent validation of an agent's performance is a category error, and it is one of the more common ways a vendor deck looks better sourced than it is.

There is one genuinely independent, peer-reviewed study worth knowing, and it is important to scope it honestly. Kyra Wilson and Aylin Caliskan of the University of Washington Information School presented work at the AAAI/ACM Conference on AI, Ethics and Society on 22 October 2024 testing three open-source large language models on resume screening, using more than 550 real resumes against more than 500 job listings across nine occupations, generating over three million comparisons. They found white-associated names preferred 85% of the time against 9% for Black-associated names, and male-associated names preferred 52% against 11% for female-associated names; the systems never favoured Black male-associated names over white male-associated names. That study tests open-source models used for resume screening. It is not evidence about any named commercial product in this ranking. It is evidence that the risk is real, measurable, and large enough that a vendor who has never measured it on their own system is asking you to take it on faith.

Which brings us to the axis this ranking actually turns on. Bias auditing is the one attribute in this market where a vendor either has a named third party, a date, a sample size and published results, or it does not. It is binary, it is checkable from a public URL, and it maps onto a legal duty you carry. So it is weighted heaviest — with one gate in front of it. A tool your desk cannot connect to Bullhorn, JobDiva, Ceipal, Avionté or Tracker is not a candidate for an agency desk no matter how well audited it is, so integration coverage functions as a qualifier rather than a tiebreaker.

One honest caveat about the auditors themselves, because it changes how much weight a badge deserves. Warden AI, which produces the strongest artefacts in this market, is paid by the vendors it audits. It is independent of their engineering teams, which is the thing that matters most, and its dashboards are public and specific in a way vendor self-reports never are. But it is a commercial assurance relationship, not a disinterested regulator, and the honest description of a Warden dashboard is "continuous third-party assurance," not "certified fair."

Ten products, four verifiable columns, checked on 23 August 2026. The bias-audit column is the one that separates this market, and it is deliberately written to record what was published rather than what was claimed. Where a vendor claims an audit but does not publish the auditor, the date and the results, the cell says so.

Read the bias-audit column carefully, because the four states in it are genuinely different. A public, dated, named audit with a sample size is evidence. An audit run on the auditor's own synthetic dataset with a demonstration disclaimer is evidence about the model, not about your hiring outcomes. A claimed audit behind a form is not evidence at all until you have the report. And a product feature that flags biased language in a job description is not an audit in any sense — it is a spellchecker for bias, and two vendors in the broader market present it as though it were the same thing.

Two of the names that appear on nearly every list of AI recruiting tools are not tools a staffing firm buys. They are businesses competing for the same revenue your desk is competing for, and no competing ranking makes the distinction.

The rest of the excluded set, with the reason in each case. Several of these are good products that are simply the wrong shape for an agency desk, and saying so is more useful than padding a top ten.

Each entry states what the product does, what is verifiable, what the vendor does not disclose, who it fits, who it does not, and who owns it. Where the only source for a claim is the vendor, it is attributed to the vendor in the text.

A staffing firm is not downstream of AI hiring law — it is named in it. New York City's Local Law 144 writes every operative obligation as applying to an employer or employment agency. California's FEHA regulations define an employment agency to include anyone who, for compensation, procures job applicants or opportunities to work "including persons undertaking these services through the use of an automated-decision system," and separately provide that an agent of an employer is also an employer for purposes of the Act. The audit, notice and recordkeeping duties land on your desk, not only on your client's. That single fact reorders the buying decision.

Local Law 144, precisely. A covered tool must have had an independent bias audit within the past year, a summary of the results must be published, and candidates must get notice at least ten business days before use. The notice must explain how to request an alternative selection process or a reasonable accommodation under other laws, if available — and the rules add, in terms, that nothing in the law requires an employer or employment agency to provide an alternative selection process. It is widely misreported as an opt-out right. It is not one.

Two consequences from the city's own published FAQ decide how you should shop. First, on responsibility: "Employers and employment agencies are responsible for ensuring they do not use an AEDT unless a bias audit was done. The vendor that created the AEDT is not responsible for a bias audit of the tool." A vendor may commission an audit, and the ones that do make your life much cheaper — but the duty does not transfer. Second, on auditors: DCWP does not maintain a list of approved independent auditors, and the law does not require auditors to be approved. So "audited" is not a status you can look up. You have to check who audited, and against three disqualifiers: they cannot work for you or for the vendor, cannot have been involved in using, developing or distributing the tool, and cannot hold a direct or material indirect financial interest in either party.

"We're not in New York" is not a defence.The law reaches use "in the city," which the rules define to include a job located at a New York City office even part time, a fully remote job whose associated location is a New York City office, or an employment agency located in New York City. A firm headquartered anywhere in the country is covered the moment it screens applicants for a remote role tied to a Manhattan office. This is the most commonly missed trigger on agency desks.

And the enforcement record is close to nil — which is a reason to be honest, not relaxed.The New York State Comptroller audited DCWP's enforcement in Report 2024-N-6, issued 2 December 2025, covering July 2023 to June 2025. DCWP received only two AEDT-related complaints in two years. The audit identified no formal investigations and no enforcement actions. DCWP surveyed 32 company websites and their bias audits and found one non-compliance issue; the Comptroller reviewing the same companies found at least 17 instances of potential non-compliance. The report's finding is that DCWP's complaint process "is ineffective in ensuring that all complaints related to non-compliance with LL144 are routed to DCWP." Law-firm commentary now predicts a tougher posture because the agency accepted the recommendations; a prediction is not a fact. The honest statement to a principal is this: your realistic exposure here is a client indemnity demand or a private plaintiff, not a city inspector.

Illinois changed on 1 January 2026, and it bites on matching models.Public Act 103-0804 makes it a civil rights violation for an employer to use artificial intelligence "that has the effect of subjecting employees to discrimination on the basis of protected classes... or to use zip codes as a proxy for protected classes," across recruitment, hiring, promotion, renewal, training selection, discharge, discipline, tenure and terms of employment — plus a separate violation for failing to give notice that AI is being used for those purposes. "Has the effect of" is a disparate-impact standard written into state statute, so intent is irrelevant. And the zip-code clause reaches any model that weights commutability, radius or market fit, which is most sourcing and matching products. The Act directs the Department of Human Rights to adopt rules on the circumstances, timing and means of notice; we could not verify whether final rules exist as of 23 August 2026, so check the Department's current status before you lock a notice format.

Illinois has had a second law since 2020 that is more immediately operational. The Artificial Intelligence Video Interview Act requires an employer, before a video interview, to notify the applicant that AI may be used to analyse it, to provide information explaining how the AI works and what general types of characteristics it uses to evaluate applicants, and to obtain consent — and an applicant who has not consented may not be evaluated. It limits sharing of applicant videos to persons whose expertise or technology is necessary to evaluate fitness, which constrains sub-processors and third-party model APIs. It requires deletion within 30 days of an applicant's request, including all electronically generated backup copies. The purchasing test that falls out of this is the sharpest one in the article:the duty to explain what the model evaluates falls on you, but only the vendor can supply the explanation. A vendor that will not give you a written, plain-language description of what its interview model evaluates cannot be used lawfully in Illinois. Ask for it on the demo call. Also note there is no 2025 or 2026 amendment to this Act adding an "explicit written consent" requirement, despite that claim circulating widely — its amendment history runs to 2022.

California is the heaviest lift, and it is already in force. The Civil Rights Council's automated-decision system regulations took effect on 1 October 2025. Beyond the employment-agency and agent definitions above, three provisions change vendor selection outright. The trigger is a system that "makes a decision or facilitates human decision making regarding an employment benefit" — materially wider than New York's "substantially assist," so the human-in-the-loop argument that keeps a tool outside Local Law 144 does not keep it outside California. Anti-bias testing is now evidentially relevant: it is unlawful to use a system that discriminates, "subject to any available defense," and relevant to any such claim or defence is "evidence, or the lack of evidence, of anti-bias testing or similar proactive efforts... including the quality, efficacy, recency, and scope of such effort, the results of such testing or other effort, and the response to the results." California made not testing legally relevant. And records retention moved from two years to four, expressly including automated-decision system data — the inputs, the scores and the outcomes.

Colorado, stated as a chronology rather than a headline.SB 24-205, the first US state AI act, was signed 17 May 2024 with obligations from 1 February 2026. SB 25B-004, signed 28 August 2025, moved that date to 30 June 2026. SB 26-189, signed 14 May 2026, repeals and reenacts the regime as an automated decision-making technology statute; its own text says the act takes effect January 1, 2027 and applies to consequential decisions made on or after January 1, 2027. Anyone citing "effective May 14, 2026" has read the legislature's banner, which reflects the act's safety clause, not the bill. Employment is expressly covered. Enforcement is exclusively by the Attorney General with a 60-day right to cure, and the act states that nothing in it creates a new private right of action. The most useful thing in it for a firm operating nowhere near Colorado is its definition of meaningful human review: an individual designated by the deployer with authority to approve, modify or override the decision, who considers relevant available primary evidence and is trained to conduct the review. That is a better internal standard than anything a vendor will hand you.

Mobley v. Workday, with the posture stated exactly. This is the leading AI-hiring case in the United States and it is misdescribed constantly. In July 2024 the Northern District of California dismissed the Title VII, ADEA and ADA claims brought on an employment agency theory without leave to amend — so nobody has held that AI vendors are employment agencies; the opposite was decided. What survives runs on an agenttheory plus disparate impact. On 16 May 2025 the court granted preliminary certification of a collective defined in the order as "[a]ll individuals aged 40 and over who, from September 24, 2020, through the present, [] applied for job opportunities using Workday, Inc.'s job application platform and were denied employment recommendations." The same order records that the standard at this stage is "loosely akin to a plausibility standard," that the "sole consequence" of preliminary certification is court-approved notice to workers who may wish to join, and that Workday may later seek decertification. That is an opt-in age-discrimination collective, not a Rule 23 class, and there is no merits ruling and no finding of liability. A 22 June 2026 order dismissed one plaintiff's disparate-impact race claim and the direct-employer claims with no further leave to amend, denied the motion as to another plaintiff's ADA claim, and otherwise denied dismissal of the FEHA claims.

Why a staffing principal should care about a case against a software company: the surviving theory is that a tool providercan be liable as the employer's agent for screening it performs on the employer's behalf. That is precisely the position your firm occupies relative to your clients. There is also a consolidation point worth raising in diligence rather than in outrage — Workday acquired HiredScore, whose scoring features caused the preliminary collective to be expanded in July 2025, and completed its acquisition of Paradox on 1 October 2025 with terms undisclosed. A firm evaluating Paradox in 2026 is buying from the defendant in that case. There has been no finding of liability, no merits ruling, and Workday denies the claims. The point is only that consolidation moves litigation risk into a suite a buyer may not realise they are joining.

Federal enforcement went quiet; federal liability did not. The EEOC's AI technical assistance documents from 2022 and 2023 are no longer published — we checked, and those URLs return 404 — while the Department of Justice's guidance on algorithms, AI and disability discrimination in hiring is still live. Executive Order 14281, signed 23 April 2025, directs agencies to deprioritise enforcement of statutes and regulations involving disparate-impact liability. It amends no statute. Disparate-impact liability under Title VII comes from the statute, from Griggs v. Duke Power Co. and from the 1991 Civil Rights Act codification, and private plaintiffs retain a private right of action — which is why Mobley survived a motion to dismiss and had a collective preliminarily certified after that order issued, why Illinois wrote an effects test into state law, and why California made the absence of testing evidentially relevant. Any vendor telling you the EEOC dropped the AI rules so this is fine now is selling you a misreading.

The framework underneath all of it is still the 1978 Uniform Guidelines on Employee Selection Procedures. Its four-fifths rule says a selection rate for any race, sex or ethnic group below four-fifths of the highest group's rate "will generally be regarded by the Federal enforcement agencies as evidence of adverse impact" — and, in the same paragraph, that "smaller differences in selection rate may nevertheless constitute adverse impact, where they are significant in both statistical and practical terms." It is a rule of administrative convenience, not a safe harbour, and a vendor marketing "we pass the four-fifths rule" is quoting a screening heuristic as a clean bill of health. The Guidelines also provide that where a user has not maintained adverse-impact data, the enforcement agencies may draw an inference of adverse impact from that failure. Not measuring is not neutral.

Two more that catch agency desks. On background and reference checking: the CFPB's Circular 2024-06, which said third parties assembling or evaluating worker information including algorithmic scoring developers may be consumer reporting agencies, was withdrawn on 12 May 2025 — many 2026 articles still cite it as operative. The Fair Credit Reporting Act itself is untouched. Checkr, Inc. appears on the CFPB's own list of consumer reporting companies under employment screening, which makes your firm a user of consumer reportswith the full disclosure, authorisation, pre-adverse-action and adverse-action stack. Ask any reference or credential vendor in writing whether it operates as a CRA and will support FCRA adverse action. On Europe: Regulation (EU) 2026/1744 deferred the Annex III high-risk obligations, which cover employment, to 2 December 2027. The "August 2026" date still printed in a great deal of content is the pre-Omnibus timeline and is wrong.

Not one of the sourcing vendors in this ranking has a verified LinkedIn partnership, and the reason is structural rather than sinister. Recruiter System Connect is the official mechanism, it is restricted to LinkedIn-approved developers under a signed API agreement with data restrictions, and it is built for applicant tracking system partners rather than sourcing tools. That is why Bullhorn is in it and the sourcing vendors are not. Reporting also suggests approval takes months and that new partner applications were not being accepted in 2026, though that last point is secondary and should be treated as such. What Recruiter System Connect actually delivers is narrow — rediscovered candidates, an in-ATS indicator, one-click export, a profile widget, InMail history and stub profiles. It is not a licence to bulk-export profiles.

So when a vendor says "LinkedIn integration," ask which programme. In this research the honest answers were: a browser extension that enriches LinkedIn profile pages in the browser, which is not an API partnership; outreach sequencing that sends messages through LinkedIn; job-board posting, which is not Recruiter API access; or a documented dependency on LinkedIn-sourced profile data with no partnership evidenced anywhere. Those are four different things and only one vendor in the set survives verification as a named partner.

"75% of resumes are never seen by a human" should never appear in a document your firm signs its name to.Its earliest attributable publication is a Computerworld article of 4 March 2012, which said applicant tracking systems "kill 75% of candidates' chances of landing an interview as soon as they submit their resumes, according to job search services provider Preptel." Read what that actually claims: it is about chances of an interview, sourced to a vendor, with no study behind it. The modern form — the ATS rejects three quarters of resumes before a human sees them — asserts something the original never said. Preptel sold resume-optimisation software; it was selling the cure for the fear it manufactured. It shut down on 30 August 2013, telling customers that after running three years in the red it had to close. It never published a study, a dataset, a sample size or a methodology. The company has been dead for thirteen years and the number is still circulating on pages dated 2026.

And the debunkers' replacement figure is equally unusable, which is the part almost everyone gets wrong.The widely quoted counter-statistic — that 92% of recruiters say their systems do not auto-reject resumes — comes from a commercial AI resume-builder, a company with exactly the same commercial interest in ATS anxiety that Preptel had, arguing the other direction. Its own methodology note says the findings are based on 25 in-depth interviews and that they "represent consistent themes across recruiters rather than nationally representative statistics." The 92% is 23 people. The 8% who reportedly do auto-reject is two people. The direction of the debunk is well supported — an ATS organises and ranks, humans reject — but swapping one vendor's unrepresentative number for another's is not a correction. Make the argument without a statistic.

Three more that fail provenance."The average corporate job posting receives 250 applications" traces to a Glassdoor for Employers marketing listicle from 20 January 2015 with no citation, no footnote, no linked study, no date range, no sample and no definition of a corporate job opening; the "242" variant now circulating traces through a chain of blogs to an unmethodologised attribution. "Recruiters spend six seconds on a resume" comes from a 2012 press release by a paid job board that sold resume-writing services, with methodology stated only as eye-tracking of "dozens" of recruiters; the 2018 update to 7.4 seconds discloses no sample size, duration or protocol at all. And "a bad hire costs at least 30% of first-year earnings, per the US Department of Labor" is a fabricated attribution — no such DOL publication exists, and the dates given for it range across two decades.

What you can cite instead, correctly attributed. SHRM's benchmarking, on data collected April to November 2021 from a random sample of members, put mean cost-per-hire at $4,683 and the medianat $1,244. The circulating "$4,700" is that mean, rounded, and it describes almost no employer — the average is dragged by a long right tail, and executive cost-per-hire in the same table has a median of $8,750 against a mean of $28,329. SHRM itself has since abandoned the mean, writing that its analyses use median values to avoid the influence of extreme outliers; its 2025 report puts median cost-per-hire at $1,200 for non-executive roles and $10,625 for executive roles. On time-to-fill, "42 days" is unprintable — no SHRM publication stating it could be found — while SHRM's actual published medians are 44 days in the 2021 data, 44 days in 2025 and 39 calendar days in 2026, measured from requisition opening to offer acceptance including weekends and holidays. If you want a rigorous vacancy-duration series instead, be aware the one that existed was discontinued, with its last observation in April 2018.

The AI side is repeating the same pattern one generation later.The cluster of numbers propagating through every AI-recruiting content page — cost per screen reduced 75%, turnover down 35%, revenue per employee up 4%, 23 hours saved per hire, 70% reduction in time to fill — traces to a single resume-screening vendor's marketing page, with no hyperlinks, no footnotes, no sample, no dates and no definition of the "early adopter companies" it describes. That vendor's domain no longer resolves. In 2012 it was Preptel's 75%; in 2026 it is a defunct AI vendor's 35%. Same shape, same absence of method, same dead company. And there is a structural reason no vendor can have measured a quality-of-hire improvement across a customer base: SHRM's own benchmarking shows the share of organisations using quality-of-hire measures at 23% in 2017, 27% in 2022 and 20% in 2025, with SHRM writing that fewer than a quarter of organisations assess the value their new hires provide. Roughly four in five employers cannot detect a change in quality of hire. That retires every claim to have improved it.

This is an illustrative scenario, not a client result — we will not print an invented outcome in an article whose whole argument is that unsourced numbers should not travel. The arithmetic below uses only prices the vendors publish themselves.

Consider an 18-recruiter light-industrial contract staffing firm on Bullhorn, running roughly 900 phone screens a month across warehousing and driver roles, with a candidate database of about 180,000 records of which perhaps a fifth have been touched in two years. Two jobs are worth automating: the first-pass screen, and the reactivation pass over the dormant database. Nothing else on that desk is a good first candidate.

The screening maths, using published rates.At Ribbon's Business tier, $999 a month covers 400 interviews with $3.00 per interview after that — so 900 interviews costs $999 plus 500 × $3.00, or $2,499 a month. The Scale tier at $1,999 covers 1,000 interviews outright. At this volume Scale is $500 a month cheaper than Business, which is exactly the sort of thing a demo will not tell you and a pricing page will. That is $23,988 a year for the screening layer, on published pricing, with no negotiation. Compare that to the platform decision underneath it: 18 seats of Loxo Professional at $199 is $3,582 a month, or $42,984 a year, and it replaces your ATS. Eighteen seats of Bullhorn Core at $165 is $2,970 a month — but Amplify Digital Workers require the Max tier, which is not priced publicly, so that comparison cannot be completed from public information. Neither can a comparison against HeyMilo, Findem, Alex or Sense, none of which publishes pricing.

The costs the pricing page does not show.If any of those 900 screens relates to a role tied to a New York City office — including a fully remote one — you are inside Local Law 144 and you own the audit, the published summary and the ten-business-day notice, whatever your vendor's badge says. If any candidate is in California, you owe four years of retention on the scoring data, which is a contractual conversation with the vendor before signature rather than a discovery after exit. If any interview is in Illinois, you owe a plain-language written explanation of what the model evaluates, and only the vendor can write it. Budget for a compliance workstream, not just a licence. In our experience the notice, the retention clause and the accommodation path are the three items that stall a rollout, and all three are cheap to solve in week one and expensive to retrofit in month nine.

Where the reactivation pass actually pays.The honest framing is that reactivation is not an AI achievement, it is a database achievement that AI makes affordable. Nobody was going to call 36,000 dormant records. An agent that re-engages them by text and email, updates availability and location, and hands a recruiter a ranked list of people who replied is doing work that previously did not happen at all — which means the comparison is not "agent versus recruiter," it is "agent versus nothing." That is also why this workflow sits outside Local Law 144: those people have not applied for a specific position. The moment one of them applies and the same system ranks them, you are inside it.

The failure that matters is rarely the model being wrong. It is the agent being confidently right about something it should never have acted on. Here is what actually goes wrong on recruiting desks, what the early signal looks like, and how you roll it back.

On prompt injection, be honest with yourself: it is unsolved. A recruiting agent reads the most adversarial input in business software — documents written by people with a direct incentive to influence the outcome. Candidates already embed hidden instructions in resumes. Nothing on the market prevents this; the realistic objective is blast-radius reduction. Give the agent read-only credentials wherever the workflow allows, scope every write to a single named object, require approval before any outbound message or status change, log every action alongside the input that triggered it, and make sure it cannot reach systems it does not need. The best design pattern we found in this market is Ashby's: agent actions run as the operating user, so every read and write respects that user's existing job, team and object-level permissions. We work through the attack classes and the mitigations in detail in our guide to prompt injection and the OWASP LLM Top 10.

Write this table into your own operating procedure and hold vendors to it, rather than accepting whatever autonomy their marketing asserts. Colorado supplies the standard for what the review has to be: a named individual designated by your firm, with authority to approve, modify or override the decision, who considers relevant available primary evidence and is trained to conduct the review. Not a rubber stamp, and not a queue nobody reads.

Buy first. For most staffing firms the right answer is a published-price product wired properly into the ATS you already run, and the ranking above exists to help you pick one. Building is the right answer in a narrower set of cases: when your workflow is genuinely unusual — VMS tiers, credentialing, redeployment logic, pay and bill reconciliation — when no vendor integrates with the system your desk actually lives in, or when the compliance artefacts you need for client audits do not exist in any product you can buy. We work through that decision in detail in our build versus buy analysis for AI agents.

Senior-led engineering runs $150–$225/hr, retainers run $2,500–$9,500/month, and every build carries a 30-day post-launch warranty. We return a fixed-price phased proposal within 5 business days of a discovery call. Full source-code and IP ownership transfers to you — which matters more than usual here, because the audit trail and the retention architecture are the parts you will still need in four years when a client's counsel asks for them. Frenchy Digital is a senior-led, Black-owned agency in Los Angeles; you can reach us on +1 (424) 272-5601 or book directly at calendly.com/frenchydigital/discovery-call.

Every item below appeared in this research, in public, on a vendor's own pages. None of them requires you to be technical to catch.

• A bias-audit badge with no auditor named, no date and no impact ratios — or a report behind a lead-capture form. The rules require the summary to be publicly available; a gated PDF does not satisfy that, and you are the one who has to publish it.
• "Compliance is covered." It is not. The city's own FAQ says the employer or employment agency is responsible for ensuring a bias audit was done. A vendor that tells you otherwise has either not read the rule or is hoping you have not.
• A cloud provider's certifications presented as the vendor's own. "Hosted on AWS, which is compliant with SOC 1/2/3 and PCI DSS" is a sentence every company on AWS can write and tells you nothing about the vendor's controls.
• "Compliant with" a standard rather than "certified to" it, and "aligned with" rather than either. All three appear in this market and all three mean different things. Read the exact verb.
• A SOC 2 date three years old on a 2026 page. SOC 2 Type II covers an observation window and recurs; a stale date is a disclosure finding in itself.
• "SOC 2" with no Type stated. Type I tests design at a point in time; Type II tests operation over a period. Do not upgrade it for them.
• A homepage badge line with no trust page, no security page, no auditor and no report request flow. If a vendor holds the report, producing it under NDA takes a day.
• "Autonomous" agents with no human-approval, escalation or review language anywhere on the page — especially where one of them sends candidate outreach automatically.
• Classic ATS automation relabelled as agents: rules-based messaging, keyword matching and timesheet OCR renamed without changing what they do.
• "LinkedIn integration" that turns out to be a browser extension, job-board posting or outreach sequencing rather than a named partner programme.
• Any accuracy, time-to-fill, quality-of-hire or ROI figure offered as neutral fact. There is no independent benchmark of these products; the figure is the seller's.
• "The EEOC dropped the AI rules, so this is fine now." Federal enforcement priorities changed. Title VII, the ADEA, the ADA and the private right of action did not.
• A retention default of 30, 60 or 90 days sold to a firm with California candidates, where four years of automated-decision system data must be preserved.
• A G2, Capterra or Gartner Peer Insights position offered as independent validation. Those are user-review aggregators, not evaluations.

Naming the gaps is part of the method, not an apology for it. As of 23 August 2026, here is what this ranking does not know.

• Several vendor trust pages could not be fetched: one trust portal returned 403 to an automated request, and the security paths for three vendors returned 404. Absence of a fetchable page is not proof a control does not exist — but it is proof the disclosure is not public, which is what we scored.
• Mercor's compliance posture was not researched at all, because it is not a product a staffing firm buys and it is not in the ranking.
• Legal entity names are not published for several vendors, which matters when you are signing rather than shortlisting.
• The Bullhorn Marketplace index is JavaScript-paginated and could not be enumerated. One vendor's dedicated listing does resolve directly, so treat absence from our reading of the index as a fetch limitation rather than evidence of absence.
• Whether the Illinois Department of Human Rights has adopted final notice rules under the 2026 statute could not be confirmed either way. We do not assert that rules exist, and we do not assert that they do not.
• New York City penalty amounts and the underlying code section numbers were not independently confirmed against the code text, so they are omitted rather than approximated.
• The Colorado Attorney General's current enforcement posture could not be verified from a primary source, so this article states the statutory chronology and nothing about enforcement intent.
• Texas, Utah, Virginia, Maryland's broader AI provisions, New Jersey and New York State AI employment measures were not verified and are therefore not described here at all.
• Pricing is genuinely unknown for five of the ten ranked products. We did not estimate any of them, and a comparison table that fills those cells with a guess is doing you harm rather than a favour.
• Bias-audit results are reported as published. We did not re-run any auditor's analysis, and we could not, because the underlying data is not public.

Employers and employment agencies are responsible for ensuring they do not use an AEDT unless a bias audit was done. The vendor that created the AEDT is not responsible for a bias audit of the tool.

— NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools FAQ

That sentence is the whole article in miniature. The tooling is improving quickly, three vendors now publish genuinely independent and current bias audits, and pricing transparency in this category is better than in most. But the duty does not move when you buy software, the market has no independent benchmark to appeal to, and the roster changes faster than the content written about it. Re-check the table before you act on it — that is what we did to write it.