When an AI screens your CV, *who keeps the record of what it said?*

The case

In February 2024, Derek Mobley and other plaintiffs filed a class action in the Northern District of California against Workday Inc., alleging that the company's AI-powered applicant-screening tools discriminated against older applicants, Black applicants and people with disabilities ^[1]. The case is still making its way through court, and Workday has said the claims are without merit. In December 2024, the court ordered Workday to provide a list of customers who used the AI features at issue, specifically a tool called HiredScore ^[4].

The facts matter less than the questions the case raises. When hiring turns on an algorithm, who keeps the record of what it did, and can they show it hasn't changed?

Why logs matter in hiring

Think of a log like a receipt. When you buy something, the shop gives you one and keeps one. If there's a question later, you compare them. Hiring is trickier: the candidate rarely gets a copy of what the system recorded, so the employer's log is the only receipt. If the employer could quietly edit it, the receipt isn't worth much.

AI hiring tools promise efficiency. A system can screen hundreds of CVs in minutes, score candidates and rank them for interview. That's useful when you're trying to fill ten roles from a hundred applications. The trouble starts when someone asks what the system actually did six months ago: which version ran, what it saw in their CV, what score it gave and whether a human reviewed it.

Under the EU's AI Act, recruitment AI that filters or ranks candidates is high-risk ^[2]. From 2 December 2027, systems used for that purpose must log events automatically over their lifetime, for traceability. Article 12 says what to log. It doesn't say the logs must be tamper-proof, immutable or independently verifiable. It just says the system must be able to log.

That sounds like a technical detail until you're in front of a tribunal and the other side questions whether your log is the one you wrote on the day.

What the law asks of you

If you use high-risk AI for hiring after 2 December 2027, Article 26 says you must inform employees and their representatives before the system is switched on ^[3]. Article 86 gives people affected by a decision the right to a clear explanation of the AI's role and the main elements of the decision ^[3]. And Article 12 requires automatic logging, so you can trace what happened.

That's three duties: tell people in advance, explain the decision if asked, and keep a log. The first two are about transparency. The third is about proving it.

The risk isn't that you'll lose the log. The risk is that someone will claim you changed it, and you'll have no neutral way to show you didn't.

The evidence question

Mobley v. Workday hasn't reached a verdict, so it hasn't tested what counts as good evidence of what an AI hiring tool did. But the claim itself shows the pattern: a candidate applies, the system screens them, they don't get the job, and months later they allege discrimination. The employer says the decision was fair. The candidate doubts the record.

In disputes, the side with the clearer record tends to do better. If the candidate has a screenshot of their application and the employer has a log that could have been edited by anyone with database access, the argument gets harder.

Article 22 of the GDPR already restricts fully automated decisions with legal or similarly significant effects, and gives people a right to human involvement in certain cases ^[5]. The AI Act layers logging, explanation and notification duties on top. Together, they mean hiring AI comes with a paper trail, and that trail will be questioned.

Here's where a digital witness fits

The thing to seal is each screening decision as it's written to the log: the candidate reference, the model version that ran, the score or ranking it gave, and the name of any human reviewer. Sealing takes a fingerprint of that record, not the data itself, so the candidate's details never leave your systems.

You seal the record when it's written, through WitniumChain using the REST API, the SDK or the MCP server. If the decision is questioned six months later, you share the record with the candidate or their lawyer, and they can check the fingerprint. If it matches, the record is the one you wrote on the day. Change a single character and it won't match.

Anyone you give the record to can check it, without needing to trust you or ask a third party. Internal audit can check it. A tribunal can check it. The candidate can check it.

A digital witness doesn't show that the decision was fair, lawful or free of bias. It doesn't prove the log is complete. It just shows that this record, the one you're presenting now, is exactly what was written at the time you say it was.

That's a narrower claim than saying your hiring was fair, but it's one you can back up with something other than your word.

How it would work

1. Your applicant-tracking system writes a decision record to the database.
2. At the same moment, it sends a fingerprint of that record to WitniumChain and gets a witness ID back.
3. When someone questions the decision, you give them the record and the witness ID, and they check the fingerprint themselves.

The first 2,000 witnesses a month are free. Read the docs or get access to try it.

What this means for you

If you screen candidates with AI, here are three questions worth asking now:

• Can you show, months later, which version of the model ran and what score it gave a specific candidate?
• If a candidate disputes your log, do you have anything beyond your own database to prove it hasn't changed?
• When Article 26 requires you to inform employees before using high-risk AI, how will you document that you did?

The answers don't all need technology. Some are about process: who sees the logs, who can change them, and how you record that someone was told. But the part about proving a log hasn't changed is harder to solve with policy alone.

What to watch

Mobley v. Workday is ongoing, so the court hasn't yet ruled on what evidence of an AI hiring decision should look like. But the pattern is clear: when AI makes decisions about people, someone will eventually ask what it did, and a log you can't prove is easy to challenge.

The AI Act's high-risk requirements for recruitment AI apply from 2 December 2027. The logging duty is in Article 12, the user's information duty in Article 26.7, and the right to explanation in Article 86 ^[2][3]. All three assume you'll have a record when someone asks. Whether that record holds up is a separate question, and one you can answer before the dispute starts.