What the Workday AI Hiring Lawsuit Means for Every ATS

Yes, an applicant tracking system vendor can now be sued for hiring discrimination. In Mobley v. Workday (N.D. Cal., Case No. 3:23-cv-00770-RFL), a federal court held that an AI hiring tool can be held directly liable as an “agent” of the employers who use it. The court has since certified a nationwide age-discrimination collective action that could reach hundreds of millions of applicants. The ruling does not just put Workday on trial. It puts a design pattern on trial: the opaque, automated, no-human-in-the-loop auto-discard pipeline that most AI screening tools run on.

This is the most important legal development for hiring software in a decade, and it changes how founders, heads of talent, and compliance leads should evaluate every ATS they touch. Below is what the case actually says, where the liability comes from, and what a defensible AI-native hiring stack looks like in practice.

This article is general information, not legal advice. Talk to employment counsel about your specific situation.

The lawsuit that put every ATS on notice

Mobley v. Workday is a federal lawsuit alleging that Workday’s AI-based applicant-recommendation system disproportionately screens out applicants by age, race, and disability. It matters to every hiring team because a court has now allowed the case to proceed against the software vendor itself, not only the employers.

The live hook for talent leaders right now is a deadline. A federal court authorized formal notice to potential collective members, with an opt-in deadline of March 7, 2026 for applicants 40 and older who were denied recommendations through Workday’s platform. That deadline is why the case is back in the news cycle, and why your candidates, your board, and your legal team may be asking what your own AI screening does.

The short version: the regulatory threat that hiring teams worried about for years has shifted shape. Federal agencies pulled back on enforcement in 2025, but private class and collective litigation picked up the slack. The exposure did not disappear. It moved from regulators to plaintiffs’ lawyers and state legislatures.

What is Mobley v. Workday?

Mobley v. Workday is a discrimination lawsuit filed in 2023 by Derek Mobley, who alleged that Workday’s AI screening tools rejected him from roughly 100 job applications, claiming a near-zero success rate getting past the initial automated screen. He sued under Title VII, the Americans with Disabilities Act (ADA), and the Age Discrimination in Employment Act (ADEA).

Two rulings made the case a landmark:

• July 12, 2024: the court let claims proceed that Workday, a software vendor and not the employer, can be held directly liable as an “agent” of its employer-customers.
• May 16, 2025: the court conditionally certified a nationwide ADEA collective action covering “all individuals aged 40 and over who, from September 24, 2020 through the present, applied for job opportunities using Workday’s job application platform and were denied employment recommendations.”

The scale is staggering. In court filings, Workday represented that 1.1 billion applications were rejected using its tools during the relevant period, and the court acknowledged the collective could reach “hundreds of millions” of people.

One critical caveat: Workday denies wrongdoing, and the case is at the collective-notice stage, not a finding of liability. Nothing here says Workday discriminated. What the court did was decide these claims are plausible enough to go forward, and that the vendor cannot hide behind “we just sell software.”

The “agent” theory: why your vendor can be liable

The legal core of the case is the “agent” theory, and it is the part every ATS buyer should understand. Federal anti-discrimination statutes reach not just employers but their “agents.” The question was whether a software vendor can be an agent. The court said yes, when the software makes or recommends the reject-or-advance decision.

Judge Rita Lin held that the complaint “plausibly alleges that Workday’s customers delegated their traditional function of rejecting candidates or advancing them to the interview stage to Workday.” The legal upshot is direct: when a vendor’s software performs the screening decision, the vendor steps into the employer’s shoes for discrimination liability.

How this differs from “it’s just a tool”

The court drew a sharp line between a passive tool and an active decision-maker. A spreadsheet that stores applicant data is a tool. Software that ranks candidates and recommends who to reject is something else. As the court put it, “Workday does qualify as an agent because its tools are alleged to perform a traditional hiring function of rejecting candidates at the screening stage and recommending who to advance.”

This is the design pattern on trial. The risk is not “using AI in hiring.” The risk is delegating the human judgment of who advances to a black box that nobody can explain, audit, or override. If your ATS auto-rejects applicants with no human review and no decision record, you have recreated the exact fact pattern the court found plausible enough to litigate, and your vendor may now share liability with you.

It’s not just Workday: Eightfold and the FCRA front

The Workday case opened the door, and other theories are walking through it. On July 7, 2025, the court expanded the Mobley collective to include applicants processed using Workday’s HiredScore AI features, and ordered Workday to identify customers who enabled them. The scope keeps widening.

A separate case opens an entirely new legal front. In Kistler et al. v. Eightfold AI Inc., filed January 20, 2026 in California and removed to federal court, plaintiffs allege Eightfold’s model scrapes “billions of data points” to produce hidden candidate “reports” and rankings. The claimed violation is not discrimination law at all. It is the Fair Credit Reporting Act (FCRA) and California’s ICRAA, the laws that govern consumer reports.

The framing is memorable: a candidate ranked on “likelihood of success” using scraped web and social data they never saw is, in effect, the subject of a hidden credit report. FCRA requires disclosure, consent, and a right to dispute. An AI screening tool that ranks people on data they cannot see or correct now faces a second, independent liability theory.

Lessons from EEOC v. iTutorGroup

None of this is hypothetical. In a consent decree approved in September 2023, iTutorGroup paid $365,000 to settle EEOC claims that its hiring software automatically rejected female applicants over 55 and male applicants over 60. It was widely called the EEOC’s first AI-hiring discrimination settlement.

The proof was almost comically clean. An applicant submitted two identical applications that differed only by birth date, and got an interview offer only with the younger date. That is what automated age discrimination looks like in practice: not malice, just a rule baked into software that nobody reviewed.

The bias is real, and it’s measurable

The legal theories rest on a factual claim: that AI screening tools produce biased outcomes. The strongest evidence is not anecdotal. It is experimental.

A 2025 Brookings study tested AI resume screening across three large language model embedding systems, comparing roughly 554 resumes against 571 job descriptions, generating about 40,000 comparisons per model. The results were stark:

• White-associated names were preferred 85.1% of the time, versus 8.6% for Black-associated names.
• Men’s names were favored 51.9% of the time, versus 11.1% for women’s names.
• In the harshest intersectional comparison, Black men’s resumes were selected 0% as often as white men’s.

The point of a name-swap study is that the only thing changing is the name. The bias lives in the model, not the user. Which means an employer who trusts an unaudited AI screen is not removing human bias. They are scaling a different bias and stripping out the human judgment that might have caught it.

The regulatory squeeze: EU AI Act and the US state patchwork

Even as federal US enforcement softened, the law tightened elsewhere. Hiring teams now face a patchwork that varies by where their applicants live, not just where the company is headquartered.

The EU AI Act classifies recruitment and candidate-selection AI as high-risk. High-risk obligations include risk assessment, documentation, bias testing, human oversight, and transparency, with fines up to EUR 15 million or 3% of global turnover. It applies extraterritorially to anyone whose AI output affects people in the EU. (A proposed AI Digital Omnibus would defer some high-risk obligations from August 2026 to December 2027; treat that timeline as in flux.)

US states are not waiting. As of mid-2026, the map includes:

Federal rollback is not a safe harbor

It is tempting to read the 2025 federal pullback as permission. The EEOC removed its AI guidance documents in January 2025, and Executive Order 14281 directed agencies to deprioritize disparate-impact enforcement that April. But removing guidance does not repeal the statutes. Title VII, the ADA, and the ADEA still create private rights of action, and those private suits are exactly the engine driving Mobley. The risk shifted from regulators to litigants and the states. It did not go away.

Opaque auto-discard vs. a defensible AI hiring stack

Here is the reframe that matters: AI in hiring is not the liability. Opaque, unaccountable AI in hiring is the liability. The Workday and Eightfold pattern, the auto-discard pipeline with no human and no record, is what courts are scrutinizing. The defensible alternative is an AI-native ATS that is explainable, human-in-the-loop, logged, and disclosed by design.

Six design principles separate the two:

1. Explainable scoring. Candidates are scored against named, human-defined criteria, not a hidden model. You can show your work.
2. Human-in-the-loop. A person makes the reject-or-advance call. AI assists; it does not decide.
3. Decision logging. Every rejection captures a reason. Overrides require a structured justification. You build a defensible trail as you go.
4. Reversibility and cool-off. Rejections are not instant and irreversible. There is a window to catch mistakes.
5. Disclosure. Candidates are told AI assists in screening, in line with NYC Local Law 144 and EU AI Act transparency.
6. Bias testing. Scoring outputs can be exported and checked for adverse impact, periodically, not just when you get sued.

If you are evaluating an AI-native ATS, these six principles are your checklist. Ask any vendor to demonstrate each one. The ones that cannot are selling you the design pattern that is currently on trial.

How Kit is built for the defensible side

Kit is an AI-native ATS, which puts it squarely in the category under scrutiny. That is exactly why it is built the defensible way. Each legal risk from the case maps to a concrete architectural choice.

The thread running through all of it is the same principle the court drew a line on: a human, not a model, performs the traditional hiring function of deciding who advances. That is also why teams pair Kit’s screening with AI assistants that manage the pipeline through MCP, where the assistant prepares and recommends but the recruiter decides. To be clear about the honesty guardrail: these are design principles that make compliance achievable. They are not a legal guarantee, an EU AI Act conformity certificate, or a substitute for your own counsel and your own bias audits.

A practical checklist for any AI-native ATS

Whatever tool you use, you can reduce your exposure today. Run your current stack against this list:

• Explainable scoring. Can you produce, for any candidate, the criteria and scores that drove the decision? If the answer is “the model decided,” that is the problem.
• Human-in-the-loop at the reject gate. Does a person review before anyone is auto-rejected? Auto-advance is far less risky than auto-reject.
• Decision logs. Is there a durable record of why each candidate was rejected, including any override?
• Cool-off and reversibility. Can you catch and reverse a mistaken rejection before it reaches the candidate?
• Disclosure. Do you tell candidates that AI assists in screening, where the law requires it?
• Periodic bias testing. Can you export scoring data and run an adverse-impact check by age, race, and gender?
• Vendor terms. Does your contract address who is liable if the tool produces biased outcomes?

Fair, structured evaluation is not only a legal posture. It is also a better hiring process, the same reason structured code assignments beat gut-feel interviews and why ethical, candidate-respecting recruiting wins better candidates.

The takeaway

Mobley v. Workday did not outlaw AI in hiring. It made one thing clear: if your software decides who gets rejected, and nobody can explain or override that decision, your vendor and your company share the exposure. The defensible path is not to abandon AI. It is to keep a human accountable, make the scoring explainable, log the decisions, and disclose the tooling. The bias is real and measurable, the regulatory squeeze is tightening across the EU and the states, and the federal rollback is not a safe harbor.

Build the auditability in from the start, and AI becomes an asset in your hiring, not a liability waiting for a subpoena.

If you want to see what human-in-the-loop, explainable hiring looks like in software, start a free trial of Kit and walk a candidate through the pipeline yourself.