When AI screening *rejects qualified candidates*, the evidence question is who can prove what

The allegation

In November 2024, a class action lawsuit was filed in California against Workday, a large HR software provider ^[1]. The suit alleges that Workday's AI-powered screening and assessment tools helped employers reject thousands of qualified job applicants based on protected characteristics including race, age and disability. The plaintiffs say the systems screened out candidates who should have progressed, and that the AI's recommendations were unlawfully discriminatory.

Workday has said the claims are without merit ^[1]. The case is at an early stage. What matters for anyone using AI in hiring is the evidence question it raises: if someone challenges a decision your system made six months ago, can you show what it actually did?

Why recruitment AI is high-risk

Under the AI Act, AI systems used to recruit, select candidates or make decisions about promotion and termination count as high-risk ^[2]. That means the provider must have risk management, data governance, technical documentation, human oversight and a quality management system in place. The system must also allow for automatic logging of events over its lifetime.

For Annex III systems, the high-risk requirements apply from 2 December 2027 ^[2]. For users, Article 26 says you must use the system according to the provider's instructions, keep a human in the loop and inform people affected by decisions ^[4].

Think of it like hiring through a recruitment agency. The agency has to follow certain rules, and so do you. If a candidate later says they were unfairly rejected, you need to be able to explain what happened and who decided what. When the agency is an AI, the question is whether you kept a record that still holds up.

GDPR and automated decisions

GDPR Article 22 has applied since May 2018 ^[3]. It says people have the right not to be subject to a decision based solely on automated processing, including profiling, when that decision has legal effects or similarly significant effects on them.

There are exceptions: when the decision is necessary for a contract, allowed by law or based on explicit consent. Even then, the organisation must at least give the person the right to human intervention, to express their view and to contest the decision.

A recruitment decision that rules someone out, especially in a way that has knock-on effects on their career or income, is likely to count as significantly affecting them. That means the organisation needs to be able to show that a human reviewed the AI's output, or that one of the exceptions applied.

In a dispute, the question becomes: can you show what the AI recommended, when the human reviewed it and what the human decided?

What Article 12 asks for

Article 12 of the AI Act says high-risk systems must technically allow for the automatic recording of events (logs) over their lifetime ^[5]. It lists what to log: the period each version was in use, the reference database against which input data was checked, the input data for which a search was initiated, and the people who accessed or modified the system.

Notice what it doesn't say: how to protect the logs.

Logs are like receipts. Nobody cares about them until there's a dispute, and then they decide who pays. A log you can quietly edit is easier to challenge. The person questioning it will ask: how do I know this is what was actually recorded on the day?

What this means for you

If you use AI to screen, rank or recommend candidates:

• Can you show which model version ran when a particular candidate was assessed?
• Do you log the AI's output and the human reviewer's decision, for each candidate?
• Can you prove that log hasn't been edited since?
• If a candidate asks for an explanation under Article 86, or challenges the decision under GDPR Article 22, do you have the records to back up your answer?

The lawsuit against Workday is a US case, but the questions it raises apply anywhere AI makes decisions about people. In the EU, the high-risk rules are less than a year away.

How a digital witness would work in recruitment

Here, the thing to seal is each screening decision as it's written to the log: the candidate reference, the model version that ran, the AI's output (for example a score or ranking), and the reviewer's decision. Sealing takes a fingerprint of that record, not the data itself, so the candidate's personal information never leaves your systems.

If a decision is challenged six months later, anyone you share the record with (an auditor, a lawyer, the candidate's representative) can check that it's exactly what was written on the day. You calculate the fingerprint again and compare it with the sealed one. If they match, nothing has changed. Change a single character and they won't match.

Seal the records as they are written, through WitniumChain, using the REST API, the SDK or the MCP server. The first 2,000 witnesses a month are free. Read the docs.

A digital witness doesn't show that the decision was fair, lawful or free of bias. It shows that the record of what the system did, and when, hasn't been rewritten. In a dispute where someone's questioning your logs, that's the difference between a short conversation and a long one.

How it would work

1. As each candidate is screened, your system writes the decision record and seals it with one API call.
2. You keep the log; the witness keeps a fingerprint and a timestamp.
3. Months later, if the decision is challenged, you (or an auditor, or the candidate's lawyer) can check that the record still matches what was sealed.

What to watch

The AI Act's high-risk requirements for recruitment and employment AI apply from 2 December 2027 ^[2]. Users must inform trade union representatives and employees before deploying high-risk AI at work (Article 26.7), and must inform people affected by decisions (Article 26.11) ^[4].

Under Article 86, people affected by high-risk AI decisions in areas covered by Annex III have the right to a clear explanation of the AI system's role and the main elements of the decision ^[6]. That right also applies from 2 December 2027.

GDPR Article 22 already applies. If your AI is making decisions about candidates without meaningful human review, and those decisions have significant effects, you're likely in scope now ^[3].