Sirius XM wins dismissal of AI hiring bias lawsuit over *iCIMS tracking system*

The case and the defence

Dwight Harper applied for a customer service job at Sirius XM in 2023 and didn't get it ^[1]. He then sued, alleging that the company's iCIMS applicant tracking system used AI to make race-based inferences from details like his name, postcode and where he went to school, and that those inferences affected his application. Sirius XM's defence was short: it doesn't use AI features in hiring ^[1].

On 8 January 2025, the US District Court for the Southern District of New York dismissed the case ^[2]. The court said Harper hadn't shown that Sirius XM actually used the AI features he was complaining about. Without that, there was no case to answer.

It's a bit like claiming the toaster burnt your bread because it has an AI setting, and the shop replying that nobody switched the setting on. If you can't show the setting was used, the claim falls apart.

The evidence problem

Harper's difficulty was proving what the system did. He didn't work there, so he didn't have access to the settings, the logs or the way the algorithm was configured. The court noted that he hadn't alleged enough facts to show that Sirius XM used the features he was worried about ^[2].

That's the central problem in algorithmic bias cases: the person affected doesn't control the records. They know what went in—name, address, application—and they know what came out: rejection. What happened in between is held by the employer, and in this case the employer said the AI features weren't switched on.

Without access to the system's workings, an applicant is left guessing.

What the AI Act requires from December 2027

Under the EU's AI Act, systems used in recruitment and employee management count as high-risk if they rank, filter or evaluate people ^[3]. That includes many applicant tracking systems.

From 2 December 2027, high-risk AI must technically allow for automatic recording of events over its lifetime ^[4]. That's Article 12: a rule about logging what the system does. It says what to log—input data, decisions, who reviewed them—but it doesn't say how to keep the logs safe from being quietly edited later.

Article 26 says users—the employers—must use the system according to instructions, monitor its operation and keep humans involved ^[5]. Article 86 gives affected people a right to a clear explanation of the AI system's role in decisions with legal or similar significant effects ^[6].

Those rights only help if the records exist and can be trusted. A log the employer can rewrite after the fact is easy to challenge. The Act asks for the logs; whether they hold up as evidence is another question.

GDPR already limits purely automated decisions

The Harper case was in the US, but if it had been in the EU, GDPR Article 22 would already apply ^[7]. That article says people have the right not to be subject to a decision based solely on automated processing, including profiling, when it has legal effects or similarly significant effects.

There are exceptions: if the decision is necessary for a contract, allowed by law or based on explicit consent. When those exceptions apply, the person still has the right to human involvement, to express their view and to contest the decision ^[7].

In practice, that means purely automated rejections in hiring—where no human reviews the output—are tightly restricted. Most employers put a human in the loop, partly to comply with Article 22 and partly because they want someone accountable.

But again, proving what the system did depends on records the applicant doesn't hold.

What this means for you

If you use AI in hiring, or plan to:

• Check whether your system counts as high-risk under Annex III of the AI Act. If it ranks or filters applicants, it probably does.
• The logging duty in Article 12 applies from 2 December 2027. Decide now what you'll log, where it will be kept and who can change it.
• Article 86 means affected people can ask for an explanation. Make sure you can give one, and that you have the logs to back it up.
• Under GDPR Article 22, purely automated decisions with significant effects require either a legal basis, necessity for a contract or explicit consent, and you must offer human review. Document how your human review works.
• Ask yourself: if someone questioned a decision six months from now, could you show exactly what the system did, and prove that the log hasn't been altered since?

A digital witness for hiring decisions

Here, the thing to seal is each decision record as it's written to the log: the applicant reference, the model version if there is one, the system's output, the human reviewer and the timestamp.

Sealing happens when the record is written. Your system sends a fingerprint of that record to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. The record itself stays in your systems.

When someone questions a decision later—an applicant, an auditor or a supervisor—anyone you share the log with can check that it's exactly what was written on the day. They calculate the fingerprint again and compare it with the sealed one. If it matches, nothing has changed. If it doesn't, something has.

It doesn't show that the decision was fair, lawful or free of bias. It doesn't make you compliant with the AI Act or GDPR. What it does is give you a record that stands up when questioned, because nobody—not even you—can quietly rewrite it.

The first 2,000 witnesses a month are free.

How it would work

1. Each time your system writes a hiring decision to the log, it sends a fingerprint of that record to WitniumChain.
2. WitniumChain seals the fingerprint and returns a witness ID, which you store alongside the log entry.
3. Months later, if the decision is questioned, you share the log entry and the witness ID. The person checking calculates the fingerprint again and sees whether it matches.

What to watch

• 2 December 2027: high-risk requirements under Annex III of the AI Act apply, including the logging duty in Article 12 and the right to explanation in Article 86.
• Guidance from the AI Office on what counts as sufficient logging for recruitment systems is expected in 2026.