A US judge says Workday must show its AI hiring tools didn't discriminate

What happened

Derek Mobley, a man over 40 with disabilities, applied for more than 100 positions through companies using Workday's applicant tracking and hiring system ^[1]. He alleges that Workday's AI-powered screening rejected him before a human recruiter ever saw his application. In January 2025, US District Judge Beth Labson Freeman ruled that his case could proceed as a class action under the Age Discrimination in Employment Act ^[2].

The claim is that Workday's system has a disparate impact on applicants over 40. Disparate impact means a practice that looks neutral but disproportionately harms a protected group. The legal test, set by the US Supreme Court in Griggs v. Duke Power Co. in 1971, asks whether the employer can show the practice is job-related and consistent with business necessity ^[3].

Workday has said its tools are designed to promote fairness and that it will defend itself vigorously. The lawsuit is at an early stage, so there has been no finding yet on whether discrimination occurred.

Why it matters for AI hiring

Hiring algorithms are used by thousands of employers. They rank CVs, screen video interviews and predict which candidates will stay. The promise is efficiency: fewer hours spent sorting applications and a faster route to the shortlist.

The risk is that the algorithm bakes in the bias. If a model learns from historical hiring data, and that data reflects past discrimination, the model can reproduce it at scale. It's like giving someone a recipe and then being surprised when the cake tastes the same every time.

Under US law, if a tool has a disparate impact on a protected group, the burden shifts to the employer to justify it. That means showing what the tool measured, how it related to the job and why it was necessary. If the employer can't do that, the practice is unlawful even if nobody intended to discriminate.

In the EU, recruitment AI is explicitly high-risk under Annex III of the AI Act ^[4]. From 2 December 2027, providers must have risk management, data governance, technical documentation and automatic logging, and users must tell employees and their representatives before a high-risk system is used at work ^[5].

The evidence question

The legal question in the Workday case is what the system did and whether it can be justified. To answer that, someone needs a record of how decisions were made: which candidates were screened, what the model scored them on, which version of the model was running and who, if anyone, reviewed the results.

That's where logs come in. Article 12 of the AI Act requires high-risk AI systems to allow for automatic recording of events over their lifetime, for traceability ^[6]. The rule says what to log. It doesn't say how to keep the log safe.

A log the organisation keeps can also be edited by the organisation. That makes it easier to question in a dispute. If the log shows something awkward, how does the employer prove it hasn't been tidied up since the lawsuit started?

The same problem turns up in other high-risk uses. A bank's credit model logs a lending decision. A hospital's triage system logs a referral. An insurer's pricing model logs a quote. Months or years later, someone challenges the decision, and the question is whether the log can be trusted.

How a digital witness fits here

In a recruitment system, the thing to seal is each screening decision as it is written to the log: the candidate reference, the model version, the score and, if there was one, the human reviewer. Sealing takes a fingerprint of the record, not the record itself, so the decision never leaves your systems.

The fingerprint is sealed on WitniumChain, where any later change would show, even one made by us. If a decision is questioned a year later, anyone you share the record with can check that the fingerprint still matches. Change a single character in the log and it won't.

That's what the witness shows: the record is exactly what was written on the day. It doesn't show that the decision was fair, lawful or justified, or that the log is complete. It just makes it harder to argue that the log was rewritten when it became inconvenient.

How it would work

1. Your system sends a fingerprint of each decision record to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back.
2. To check, anyone you share the record with calculates the fingerprint again and compares it with the sealed one.
3. If it matches, the record hasn't changed since sealing. If it doesn't, something has.

The content stays with you. The first 2,000 witnesses a month are free. Read the docs.

What this means for you

If you use or build AI hiring tools, here are three questions worth asking now:

1. Could you show, a year from now, which version of your model screened a particular candidate and what it scored them on?
2. If someone alleges your tool has a disparate impact, what records would you rely on to justify it?
3. Who in your organisation can edit those records, and would an auditor or a court take your word that nobody did?

The answer to the third question is what a digital witness changes. It doesn't replace access control, monitoring or a fair hiring process. It just means the log you keep today is provably the same log you show tomorrow.

What to watch

The Workday case will take years to resolve, but the legal question is already clear: if an AI tool has a disparate impact, the organisation using it must be able to justify it with evidence.

In the EU, from 2 December 2027, high-risk AI systems must log events ^[6]. How those logs are protected is not specified in the Act, but the question of whether they hold up in a dispute is the same on both sides of the Atlantic.

Article 26 of the AI Act requires users to inform employees and their representatives before high-risk AI is used at work ^[5]. That deadline is the same: 2 December 2027. The right to an explanation of decisions made with high-risk AI, under Article 86, applies from the same date ^[7].

If you make recruitment decisions with AI, decide now who keeps the record and how you will show it hasn't changed.