What should a staffing agency ask an AI voice vendor before signing?

The short answer

Before signing, ask the vendor to prove one complete worker-call journey: what the caller hears, which facts the system collects, when it stops, who receives the case and what happens if the integration fails. Then inspect the data path, human controls, monitoring and exit terms. A polished demo is useful, but it is not evidence that the service will work at 04:40 when a worker calls from a noisy bus about a shift at the wrong branch.

Give every vendor the same operating brief

Write a one-page brief before the first sales call. Name the worker groups, languages, opening hours, issue types and systems in scope. Show who owns sickness, transport, housing, payroll and safety cases. State which actions the service may complete and which actions always go to an authorised person.

This keeps the comparison honest. Without a fixed brief, one vendor may demonstrate a friendly conversation while another shows a deep ATS connection. Both can look convincing, but you are not comparing the same job. Ask each supplier to respond against the same scope, exceptions and expected case format.

Test the handoff, not the happy-path conversation

Use a small pack of calls drawn from real branch work. Include a sickness report shortly before a shift, a worker who reaches the wrong branch, background noise, a mixed-language answer and a transport problem affecting several people. Do not tell the vendor exactly where each call becomes difficult.

Score the result that reaches the team. Is the worker and assignment identified? Are the original facts separated from the system's summary? Did the correct owner receive the case? Could the caller reach a person when the answer was unclear? Keep the recording, transcript and created ticket together during the review so coordinators can find confident mistakes as well as obvious failures.

Follow the data from the phone call to deletion

Ask for a data map in plain language. It should show what is captured, where audio and transcripts are processed, which suppliers receive them, where records are stored and when each copy is deleted. The contract should state the purpose, data categories, retention, security measures, subprocessor process, incident route and what happens to data at the end of the service.

Do not accept 'GDPR compliant' as a complete answer. Your agency still needs its own lawful basis, notices, access controls and retention choices. A Data Protection Impact Assessment may be required when the planned processing is likely to create a high risk to people's rights and freedoms. Make that assessment before launch and revisit it when the use changes.

Check the legal boundary of the intended use

The EU AI Act's Article 50 transparency obligations started applying on 2 August 2026. For an interactive AI service, require a clear opening disclosure so workers know they are dealing with AI. Also ask the vendor to document its intended purpose, limitations and the responsibilities it assigns to the provider and customer.

Classification depends on what the system is intended to do. A service that records an operational absence report is not the same use as a system that evaluates candidates or influences employment decisions. If the proposed workflow crosses into recruitment, worker management or access to work, obtain a specific legal assessment instead of relying on the vendor's general label.

Write the human boundary into the workflow

AI can collect approved facts, repeat them for confirmation, answer controlled questions and route a case. It should not decide whether sickness is genuine, make a medical judgment, select a replacement worker, impose discipline, change pay, decide eligibility for work or promise an outcome to a client or worker.

Ask to see the low-confidence route, the manual override and the log of what the system did. The responsible employee needs enough information and authority to change the outcome. Workflow or model changes that could alter questions, routing or summaries should have a review process, not arrive silently in a routine software update.

Make the integration fail during the test

A successful API call in a demo proves very little. Disconnect the test endpoint or reject a required field. The service should show a delivery failure, avoid duplicate cases, retry safely and alert a named owner. Ask how the team can replay or export a case without waiting for the vendor's engineers.

Map every field into the ATS or CRM before launch. Confirm which system owns identity, assignment, urgency, case status and the final outcome. The AI call layer should not become a second record that coordinators must reconcile each morning.

Score the evidence and protect the exit

One workable scorecard gives 30 points to operational fit, 25 to human control and safe handling, 20 to data protection and security, 15 to integration and recovery, and 10 to commercial and exit terms. Set minimum scores for human control and data protection so a low price cannot compensate for an unsafe design.

Before signature, agree how you will export cases, recordings, configuration and audit history. Set deletion deadlines and evidence requirements. Record what happens to phone numbers and integrations during transition. A buyer should be able to leave without losing the operational history needed to support workers or reconstruct an incident.