Can an employer blame the AI vendor for a discriminatory hiring decision?

A lawsuit over who is responsible

Derek Mobley applied for jobs at companies using Workday's applicant tracking and screening tools. He didn't get past the initial stage. In 2023, he sued Workday, arguing that its AI-powered tools discriminated against him and other Black, older and disabled applicants ^[1]. Workday moved to dismiss, saying it had simply sold software to employers, who made their own hiring decisions. In October 2024, a federal judge in California ruled that most of the claims could go forward ^[2].

The ruling is narrow: it doesn't say Workday is liable, only that Mobley has alleged enough to survive a motion to dismiss. But the reasoning is worth reading. The judge found that Workday's alleged involvement went beyond selling a passive tool. According to the complaint, Workday helped clients configure the system, trained it on data sets it selected and marketed the tools as delivering specific hiring outcomes ^[2]. If that's true, the judge wrote, Workday could be considered more than a vendor.

It's like hiring a builder who not only sells you the bricks but also draws the plans, picks the foundation and promises the house will stand. If it falls down, you can't simply say the bricks were fine.

What Workday argued

Workday's position was that it provided software, and employers decided how to use it. The company pointed out that its agreements make clear that clients control hiring decisions and that Workday acts as a service provider, not an employer or an employment agency ^[3]. Under US law, liability for employment discrimination generally rests with the employer, not with third-party vendors.

The judge agreed that some of Mobley's claims, such as negligence, should be dismissed, because economic loss alone isn't enough under California law. But claims under civil rights statutes, including disparate impact under Title VII and the Americans with Disabilities Act, survived ^[2].

The role of the tool

Mobley alleges that Workday's screening system uses algorithms to score and rank applicants, and that these tools disproportionately reject Black applicants, older workers and people with disabilities, even when they are qualified ^[1]. He also claims the system lacks transparency, so applicants can't tell why they were screened out.

Workday denies the allegations and says its tools are designed to help employers make fair and efficient hiring decisions ^[3]. The case is ongoing, so neither the facts nor Workday's liability have been established. But the legal question is already interesting: if an AI tool's provider helps deploy it and markets its predictive power, does that provider share responsibility when the tool produces biased outcomes?

What the EU AI Act says

In the EU, recruitment AI that screens or ranks applicants is high-risk under Annex III of the AI Act ^[4]. From 2 December 2027, providers must meet a long list of requirements before placing such a system on the market: risk management, data governance, technical documentation, automatic logging and a conformity assessment ^[5].

Users—the employers—have their own duties under Article 26. They must use the system according to instructions, monitor it in operation, ensure human oversight of decisions and inform trade union representatives and affected staff before a high-risk AI system is used in the workplace ^[6]. Applicants must also be told when they are subject to a decision made with high-risk AI ^[6].

Unlike the US case, the AI Act doesn't ask courts to work out where responsibility sits. It assigns duties to both sides and makes each answerable for their part. The provider builds a system that meets the requirements. The user deploys it properly, monitors it and keeps the records.

The evidence gap

Hiring decisions are questioned months or years later: in discrimination complaints, employment tribunals and audits. The employer needs to show what happened. Which model version was running? What inputs did it receive? What score did it produce, and who reviewed it?

Article 12 of the AI Act requires high-risk systems to log events automatically over their lifetime ^[7]. It says what to log. It doesn't say how to keep the logs trustworthy, and it doesn't require the provider to do it for the user. If the user keeps the logs in a system the user controls, an applicant's lawyer will ask the obvious question: could the log have been edited after the complaint was filed?

That's the evidence question. The law asks for the logs. Whether they hold up under scrutiny is another matter.

How a digital witness would work here

The thing to seal is each screening decision as it's written: the applicant reference, the model version, the inputs, the score and the name of the person who reviewed it. Sealing takes a fingerprint of that record, not the content itself, so the decision stays in the employer's systems and never leaves.

The fingerprint is sent to WitniumChain through the REST API, the SDK or the MCP server, and stored on a chain where any later change would show, even one made by us. When a decision is questioned a year later, anyone the employer shares the record with—an auditor, a tribunal, the applicant's representative—can calculate the fingerprint again and check that it matches the sealed one. Change a single character in the log and it won't match.

Who can check it? Anyone you give the record to. They don't need to trust you or us; they can verify it themselves.

What it shows: that the record is exactly what was written on the day of the decision.

What it doesn't show: that the decision was fair, that the model was unbiased or that the log is complete. It doesn't make anyone compliant, and it doesn't say whether the AI or the employer is at fault. It just gives the employer a record that can be checked, rather than one that has to be taken on trust.

How it would work

1. The screening system writes a decision record (inputs, model version, score, reviewer).
2. Your integration sends a fingerprint of that record to the witness.
3. Months later, when the decision is questioned, you share the record and anyone can check the fingerprint.

What this means for you

If you provide or use AI in hiring, ask these questions now:

• Can you show, a year from now, which model version made a particular recommendation?
• Can you show what inputs it received and what score it produced?
• Can you show that the log of decisions hasn't been altered since the hiring round closed?
• Have you told applicants and staff, as Article 26 requires, that a high-risk AI system is in use?
• If an applicant asks for an explanation under Article 86, do you have the records to give one?

The AI Act gives providers and users separate duties. Meeting yours doesn't depend on what the other side does, and it doesn't wait for a lawsuit.

What to watch

The Mobley case will clarify US law on vendor liability, but the judgment is likely months away. In the EU, 2 December 2027 is the date when high-risk duties under Annex III take effect ^[8]. Employers using AI in recruitment should prepare their logging, monitoring and transparency processes now, and providers should be ready to show that their systems meet the technical requirements.

Article 86, which gives affected individuals the right to an explanation of AI-supported decisions with legal or similarly significant effects, also applies from that date ^[9]. The explanation must be clear and meaningful, and it presupposes that the records exist.