When an AI hiring system gets sued, and the *logs are missing*

What happened

In February 2023, Derek Mobley filed a lawsuit against Workday in the US District Court for the Northern District of California ^[1]. Mobley, who is Black and over 40, applied for more than 100 jobs through Workday's AI-powered applicant tracking system. He claimed the system screened him out based on race, age and disability, in breach of civil rights laws ^[1].

Workday moved to dismiss the case. In December 2024, the court denied the motion ^[2]. The judge found Mobley's claims plausible and allowed the case to proceed to discovery, where both sides exchange evidence.

The striking detail is what Workday allegedly could not produce. According to the complaint, the company was unable to provide records showing what its AI system did, which factors it weighed, or how it reached its decisions ^[1]. For a case turning on whether the system discriminated, that is a problem.

The evidence question

Think of it like a security camera. If someone claims they were in the office at midnight and the recording shows nothing, the first question is whether the camera was working. The second is whether anyone could have edited the footage.

Here, the question is not just whether Workday kept logs. It is whether those logs can be shown to be what they say they are: unchanged records of what the AI actually did at the time.

When the logs are missing, incomplete or open to challenge, the company starts the case on the back foot. The applicant's version of events becomes harder to disprove.

What US and EU law say

Under US civil rights law, including Title VII of the Civil Rights Act of 1964 and the Americans with Disabilities Act, employers must not discriminate in hiring ^[3]. When an AI system is part of the hiring process, the question is whether that system had a discriminatory effect, and whether the employer can show it did not.

In the EU, the AI Act sets out rules for high-risk AI, and recruitment systems are explicitly listed in Annex III ^[4]. From 2 December 2027, such systems must meet a set of requirements, including Article 12: automatic logging of events over the system's lifetime ^[5].

Article 12 says what to log. It does not say how to protect the logs from being changed, deleted or questioned later. That is the gap this case illustrates.

Under Article 26, a company using high-risk AI must inform trade union representatives and employees before the system is used at work (26.7), and inform people affected by decisions (26.11) ^[6]. Article 86 gives anyone affected by a high-risk AI decision the right to a clear explanation of the AI's role and the main elements of the decision ^[7].

None of those rights mean much if the records of what the AI did are missing or disputable.

What this means for you

If your organisation uses AI in recruitment, the questions to ask now are:

• Do we log what the AI does at each step: which candidates it screens, which factors it weighs, and which decisions it makes?
• Can we show, in a way that would hold up in a dispute, that those logs have not been changed since they were written?
• Who in the organisation could edit the logs, and would a change show?
• If an applicant or a regulator asked for an explanation six months after a decision, could we produce one?

In the EU, the logging duty applies from 2 December 2027 for systems under Annex III, which includes recruitment. In the US, there is no specific logging requirement, but the absence of records makes discrimination claims harder to defend.

How a digital witness fits here

This is a case where a digital witness fits well. The thing to seal is each screening decision as it is written to the log: the candidate reference, the model version, the factors considered, the output and, if there was one, the reviewer.

Sealing happens when the record is written. Your system sends a fingerprint of the record, not the record itself, to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. The content stays in your systems.

Months or years later, if the decision is questioned, anyone you share the record with can check that it is exactly what was written on the day. They calculate the fingerprint again and compare it with the sealed one. If it matches, nothing has changed. Change a single character and it will not match.

Who can check it? Auditors, supervisors, the person affected and, if it comes to it, a court.

What it shows: that the record is exactly what was written at that time.

What it does not show: that the decision was right, fair or lawful, or that the log is complete. A sealed log does not make a discriminatory decision lawful. What it does is give you a record that can be checked, rather than one that has to be taken on trust.

How it would work

1. Your recruitment system writes a decision record to the log.
2. It sends a fingerprint of that record to WitniumChain and gets a witness ID back.
3. When the decision is questioned, you share the record and the witness ID with whoever needs to see it, and they check that the fingerprint matches.

The first 2,000 witnesses a month are free. Read the docs or get access now.

What to watch

The Workday case is now in discovery. How it proceeds will depend on what records, if any, Workday can produce, and whether they stand up to scrutiny.

In the EU, 2 December 2027 is the date to mark. That is when the high-risk requirements, including logging under Article 12, apply to AI systems listed in Annex III ^[8]. Recruitment systems are on that list.

Between now and then, the question for any organisation using AI in hiring is whether you can show what your system did, and whether that record would hold up if challenged. This case shows what happens when the answer is no.