Workday class action shows why AI hiring logs need to hold up in court

A judge certifies a class, and the logs become evidence

On 9 May 2025, a federal judge in California certified a class action lawsuit against Workday, alleging that its AI-powered screening tool had discriminated against job applicants over 40 and people with disabilities since at least January 2020 ^[1]. The plaintiffs claim the tool screened out millions of people unlawfully. Workday denies the allegations and says it will defend the case vigorously ^[2].

The certification means the case can proceed on behalf of a class, potentially covering a large number of applicants. What matters here is not whether Workday is guilty—that is for the court to decide—but what kind of evidence a case like this demands. When someone alleges that an AI system rejected them unfairly, the question is: what did the system actually do, and can you prove it?

What the AI Act will require

Under the EU AI Act, systems used to evaluate candidates for recruitment count as high-risk AI ^[3]. From 2 December 2027, they must technically allow for the automatic recording of events over their lifetime, under Article 12 ^[4]. The article says what to log—enough to trace what happened and support monitoring after the system is placed on the market—but it does not say how to protect the logs from being edited or deleted.

It is like being told to keep receipts without being told to put them in a drawer with a lock. The receipts exist, but so does the risk that someone quietly bins the awkward ones.

That distinction matters because logs are kept by the same organisation that runs the AI. An applicant who was rejected, or a regulator asking questions, has to trust that the log has not been changed. Courts and supervisors are used to that problem. Under Article 86, a person affected by a high-risk AI decision has the right to a clear explanation of the system's role ^[5]. The explanation only helps if the record behind it is reliable.

Disparate impact and the burden of proof

Under US law, disparate impact claims do not require proof of intent to discriminate. Instead, they ask whether a practice disproportionately harms a protected group, even if it looks neutral on its face ^[6]. If the plaintiff shows a disparity, the burden shifts to the employer to show that the practice was job-related and consistent with business necessity ^[6].

In a case about an AI hiring tool, that means showing what the model did: which features it weighted, how candidates were scored and who was screened out at each stage. Without reliable logs, that becomes a problem. If the company's own records can be quietly edited by someone with the right access, the other side will say so, and the court will listen.

The same logic applies under the General Data Protection Regulation. Article 22 gives people the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, unless an exception applies ^[7]. Where an exception does apply—for example, because the decision is necessary for a contract—the data controller must at least allow the person to obtain human intervention, express their view and contest the decision ^[7]. Contesting a decision is harder when the record of what the system did is controlled entirely by the other side.

What this means for you

If you use AI to screen job applications, ask these questions now:

• Could you show what your screening system did on a given day two years ago, if a regulator or a court asked?
• Who has access to the logs, and could someone with that access edit them without it showing?
• If an applicant alleges your AI rejected them unfairly, what record would you produce, and how would you show it has not been changed?

From 2 December 2027, high-risk AI systems used in recruitment will need to log events automatically. Deciding how to protect those logs is a separate question, and one worth settling early.

How a digital witness fits here

The thing to seal is each screening decision as it is written: the candidate reference, the model version, the features considered, the score and, if there was one, the human reviewer. Sealing takes a fingerprint of the record, not the record itself, so the decision and any personal data never leave your systems.

If a decision is challenged a year or two later, anyone you share the record with—an auditor, a regulator, a court or the applicant's lawyer—can check that the record is exactly what was written on the day. Change a single character and the fingerprint will not match.

A digital witness does not show that the decision was fair, lawful or free of bias. It does not make you compliant with the AI Act or employment law. What it does is give you a record that can be checked by someone who does not have to trust you.

You can seal records through WitniumChain using the REST API, the SDK or the MCP server. The content stays with you. The first 2,000 witnesses a month are free. Read the docs.

How it would work

1. Your recruitment system writes each screening decision to a log.
2. It sends a fingerprint of the decision record to WitniumChain and gets a witness ID back.
3. If the decision is questioned later, you calculate the fingerprint again and compare it with the sealed one. If it matches, the record has not changed.

What to watch

• 2 December 2027: High-risk requirements for AI systems listed in Annex III of the AI Act, including recruitment tools, apply ^[8].
• Case progress: The Workday class action is ongoing. Watch how courts handle evidence about what an AI hiring system did, and what records are considered reliable.

Sources

1. Order granting motion for class certification, Mobley et al. v. Workday, Inc., Case No. 3:23-cv-00770-WHO, United States District Court, Northern District of California, 9 May 2025. https://storage.courtlistener.com/recap/gov.uscourts.cand.413505/gov.uscourts.cand.413505.172.0.pdf
2. "Workday Statement on Certification Ruling", Workday, 12 May 2025. https://blog.workday.com/en-us/2025/workday-statement-certification-ruling.html
3. Regulation (EU) 2024/1689 (AI Act), Annex III, point 4: AI systems intended to be used for recruitment or selection of natural persons. https://ai-act-service-desk.ec.europa.eu/en/ai-act/annexes/annex-iii
4. Regulation (EU) 2024/1689 (AI Act), Article 12: Logging. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-12
5. Regulation (EU) 2024/1689 (AI Act), Article 86: Right to explanation of individual decision-making. https://eur-lex.europa.eu/eli/reg/2024/1689/oj
6. Griggs v. Duke Power Co., 401 U.S. 424 (1971), and subsequent case law on disparate impact under Title VII of the Civil Rights Act of 1964. https://supreme.justia.com/cases/federal/us/401/424/
7. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 22: Automated individual decision-making, including profiling. https://eur-lex.europa.eu/eli/reg/2016/679/oj
8. Timeline for implementation of the EU AI Act, European Commission AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act