What Mobley v. Workday Reveals About AI Hiring Liability in 2026

For three years, the most consequential rulemaking in AI hiring hasn't happened in a legislature or a regulatory agency. It has happened in a single federal courtroom in the Northern District of California, in a case most job seekers have never heard of: Mobley v. Workday. The newest ruling in that case, handed down this spring, tells vendors something uncomfortable — the bias audit a company runs on its own hiring algorithm may be the one piece of evidence that never has to see daylight, precisely because a lawyer was in the room when it was run.

How a dismissed complaint became a nationwide case

Derek Mobley, who is Black, over 40, and has anxiety and depression, says he submitted more than 100 job applications through companies that use Workday's applicant-screening tools and was rejected every time. He sued Workday itself in 2023 — not the employers, the vendor — arguing that Workday's AI-driven scoring and recommendation features functioned as the actual decision-maker in his rejections. The claim almost died in its first year: in January 2024, the court dismissed Mobley's theory that Workday operated as an "employment agency," since the statute defines an employment agency as one that procures candidates for employers, and Workday doesn't do that (Duane Morris).

What survived is the part that made the case matter. The court accepted a second theory — that Workday acted as an agent of the employers that deployed its tools. Judge Rita Lin reasoned that federal anti-discrimination law bars discrimination "not just by employers but also by agents of those employers," and that an employer can't escape liability for a traditional hiring function, like screening resumes, simply by outsourcing it to software. Critically, the court found Workday's tools don't just mechanically apply criteria an employer hands them — they participate in the decision itself, recommending who advances and who doesn't. That distinction is why the vendor, not just its customers, can be sued directly. The EEOC filed an amicus brief backing that reading of the law (Mondaq/Seyfarth).

From there the case grew. On May 16, 2025, the court granted conditional certification of a nationwide collective under the Age Discrimination in Employment Act — every applicant 40 or older who applied through Workday's platform going back to September 24, 2020 (HR Dive; Holland & Knight). That July, the court ordered Workday to expand the case's scope again, to cover applicants screened through its HiredScore AI features specifically, with a deadline to produce a customer list by August 20, 2025 (ppc.land). A case that started as one man's rejected applications is now, procedurally, a referendum on how an entire category of screening software is built.

The regulators left, and the courts didn't notice — or didn't care

The timing matters. Through 2023 and 2024, the assumption in HR tech was that federal agencies would eventually set the rules for algorithmic hiring: EEOC guidance, maybe a rulemaking. That assumption didn't survive 2025. A January 2025 executive order revoked the prior administration's AI policy and directed federal agencies to unwind actions taken under it; the EEOC and Department of Labor subsequently pulled AI-hiring guidance from their own websites, including recommendations on auditing tools for bias (Holland & Knight). A follow-on executive order in April 2025 went further, directing federal agencies to stop enforcing disparate-impact liability altogether — the legal theory that doesn't require proving intent, only a disproportionate effect, and the one nearly every algorithmic-bias claim depends on (Holland & Knight). The EEOC's own chair at the time, a vocal critic of unaudited hiring AI, was removed from her post (TechTarget).

None of that touched Mobley v. Workday, because disparate-impact liability under federal anti-discrimination statutes is created by Congress and interpreted by courts, not something an executive order can switch off case law. The practical effect is a split: the agency that used to set soft expectations in advance went quiet, while private litigation — slower, narrower, but immune to a change in administration — kept moving. If there is a rulebook for AI hiring vendors in the United States right now, it is being written docket entry by docket entry in San Francisco, not in a federal register notice.

2026: two different theories, one target

This year sharpened the picture in two ways. First, Mobley itself kept advancing on its original discrimination theory. A June 2026 ruling on Workday's motion to dismiss was a mixed verdict: the court let California Fair Employment and Housing Act claims and a disability-discrimination claim under the ADA proceed, while dismissing a newly added race-discrimination claim on procedural grounds — it had been raised without the court's permission, not because it lacked merit on the facts (Duane Morris; Bloomberg Law). Three years in, Workday still hasn't gotten the case thrown out.

Second, a different legal theory showed up against a different vendor. On January 20, 2026, a proposed class action — Kistler v. Eightfold AI — was filed in California state court against the AI hiring platform used by Microsoft, PayPal, Morgan Stanley, Starbucks and others. It doesn't allege Eightfold's scoring was biased. It alleges Eightfold scraped personal data on more than a billion workers, scored applicants on a zero-to-five scale, and discarded the low scorers before a human ever looked at their application — all without the disclosures the Fair Credit Reporting Act requires when a third party supplies information used in an employment decision. The claim, as one outlet summarized it, isn't that the algorithm was unfair. It's that the algorithm existed in secret (HR Executive; Jones Walker). Two cases, two statutes, two vendors — and the same underlying message to the industry: an AI hiring tool is now a legal target whether the complaint is about what it decided or simply about whether anyone was told it was deciding at all.

The twist nobody saw coming: the audit itself can be privileged

The most interesting development, though, is narrower and stranger than either headline. In May 2026, a magistrate judge ruled on the plaintiffs' request to see Workday's own internal bias-testing results for its screening tools — the audit a company would supposedly run to check whether its own system discriminates. The court denied that request. The reasoning: Workday's lawyers had curated the bias-testing data and used the results to provide legal advice, which made it protected attorney-client work product, not a discoverable business record (Duane Morris).

Sit with that for a second. The compliance advice an AI hiring vendor would reasonably follow — "have counsel oversee your bias audit so you get privileged legal guidance on what it means" — is the same structural choice that can keep the audit's actual results out of a courtroom later, whatever they show. That's not evidence of wrongdoing by Workday specifically; privilege protects guilty and innocent audits alike, and the ruling doesn't tell us what the underlying data says. But it does mean the one document most likely to resolve "was this tool actually biased" one way or the other may never be produced, in this case or the next one. An audit run the legally cautious way and an audit run to avoid ever finding anything out can look identical from the outside.

What this means if you build or buy hiring software

Pull the threads together and the operative question for 2026 isn't "which state's AI-hiring statute applies to us." It's narrower and harder to dodge: if a plaintiff's lawyer got discovery into exactly how your scoring logic decided a specific rejection, would it hold up as a reasoned process — or would it look like an opaque score nobody can walk through, row by row? Mobley v. Workday says a vendor can be sued directly as an "agent" for exactly that opacity. Kistler v. Eightfold says a vendor can be sued for not disclosing the scoring existed at all. And the privilege ruling says that even when you do audit yourself, the result of that audit might not be the thing that saves you in court — your own process design is.

That argues for a different default than "score an applicant and auto-reject below a threshold." NiceHire's hiring pipeline is built as a sequence of distinct, separately logged stages — resume vetting, an AI screening interview, a technical assessment, live human interviews — rather than one opaque pass/fail pass through a model. We say this narrowly and on purpose: a staged pipeline with visible checkpoints is a different design shape from a single black-box score — it says nothing about whether any particular decision inside it was fair, and nothing in this piece, or in how we built it, should be read as a claim that the pipeline is legally immune or beyond challenge. What the last three years of this litigation actually teach is more modest and more durable than any compliance checklist: the industry's real exposure isn't regulatory uncertainty. It's whether anyone, including a court, could ever see how the decision got made.

Sources: Duane Morris Class Action Defense Blog, Bloomberg Law, HR Dive, Holland & Knight, HR Executive, Jones Walker, TechTarget, ppc.land, and Mondaq / Seyfarth.