The Algorithm on Trial: How the Workday AI Hiring Lawsuit Rewrites Employer Liability Under US and UK Law

Superadmin
Jun 30, 2026

The Algorithm on Trial: How the Workday AI Hiring Lawsuit Rewrites Employer Liability Under US and UK Law

The traditional hiring funnel, once dominated by human resource professionals sorting through paper resumes—has been fundamentally re-engineered. Today, artificial intelligence (AI) serves as the primary gatekeeper to employment. Algorithms screen resumes, conduct initial video assessments, rank applicant suitability, and issue rejections before a human manager ever sees a candidate's name.

While automated screening tools promise unprecedented efficiency and cost reductions, they also introduce systemic legal risks. The ongoing class-action lawsuit Mobley v. Workday, Inc. in the United States has reached a critical milestone. A California federal district judge issued a preliminary order allowing the case to proceed].

This litigation shatters the assumption that employers can shield themselves from liability by outsourcing recruitment to third-party tech vendors. The legal ramifications cross the Atlantic, establishing a precedent that directly mirrors the strict compliance mandates of the United Kingdom’s Equality Act 2010 and the UK General Data Protection Regulation (UK GDPR). For businesses operating globally, relying blindly on automated platforms is no longer a viable legal defense.

1. Anatomy of the Lawsuit: Mobley v. Workday, Inc.

The Core Allegations

The lawsuit was initiated by Derek Mobley, who filed a claim against the human resources software giant Workday, Inc.. Mobley alleges that Workday’s automated applicant screening tools systematically and unfairly filtered out his applications for employment. He claims this automated exclusion was based on protected characteristics, specifically:

Age (over 40)
Race (African American)
Disability (mental health conditions)

Mobley applied to over 100 positions with companies utilizing Workday’s recruitment platform. Despite possessing the requisite qualifications, degree certifications, and professional experience, his applications were met with near-instantaneous, automated rejections.

The lawsuit evolved when four additional plaintiffs joined, asserting similar age-related discrimination claims. The plaintiffs argue that Workday’s proprietary algorithms do not operate as neutral administrative pipelines. Instead, they allege the tools incorporate historical, systemic biases that disproportionately screen out candidates belonging to protected classes.

The Disparate Impact Theory of Liability

A pivotal element of Mobley v. Workday is its reliance on the legal doctrine of disparate impact. Under US employment law (Title VII of the Civil Rights Act, the Age Discrimination in Employment Act, and the Americans with Disabilities Act), discrimination claims generally fall into two categories:

Disparate Treatment: Requiring explicit proof that an employer intentionally discriminated against an individual based on a protected trait.
Disparate Impact: Involving practices or policies that are facially neutral but disproportionately exclude members of a protected group without a business necessity.

Disparate Impact Framework:
[Facially Neutral AI Policy/Algorithm] 
                  ?
                  ?
[Disproportionate Exclusion of Protected Group] 
                  ?
                  ?
[Liability Arises (Even Without Intent to Discriminate)]

The plaintiffs in the Workday case do not argue that Workday or the hiring employers intentionally coded software to reject Black, older, or disabled candidates. Instead, they argue that the screening mechanisms create an illegal disparate impact.

This frequently occurs when an AI model is trained on historical data. If a company's past hiring decisions favored a specific demographic, the algorithm flags those traits as indicators of success. The AI then systematically downgrades resumes lacking those correlated characteristics, replicating and scaling historical human biases under the guise of objective data analytics.

2. The US Legal Landscape: Shifting the Liability Frontier

The Workday litigation represents a major departure from prior employment lawsuits by targeting the tech vendor directly, alongside the employer. This shift introduces two critical legal concepts: agency liability and changing federal enforcement.

The "Agent" Doctrine: Piercing the Vendor Shield

Historically, third-party software providers argued they were mere software vendors, exempt from direct liability under federal anti-discrimination laws. They claimed that the ultimate hiring decision rested with the employer, who configured and deployed the tool.

The federal court rejected this defense in Mobley v. Workday. The judge ruled that an AI software vendor can be classified as an "agent" of the employer under Title VII and other anti-discrimination statutes. If an employer delegates its traditional sourcing, screening, and qualification assessment functions to an automated tool, the entity controling that tool steps into the legal shoes of an employer's agent.

This ruling creates dual exposure. While vendors face direct liability for the software they build, employers remain liable for the actions of their agents. An employer cannot escape its statutory obligations under anti-discrimination laws by delegating candidate evaluation to a third-party algorithm.

Federal Regulatory Overhaul and Presidential Executive Orders

The litigation comes amid a broader regulatory focus on automated systems. In April 2025, the legal landscape saw a shift with the issuance of Executive Order 14281, Restoring Equality of Opportunity and Meritocracy. This executive order directed federal agencies to curtail reliance on disparate impact theories where permitted by law, aiming to reduce regulatory burdens on businesses.

However, this executive order did not eliminate the disparate impact framework in employment law. As explicitly noted in legal analyses of the Workday decision, disparate impact claims remain statutory law under Title VII of the Civil Rights Act.

Concurrently, independent agencies like the Equal Employment Opportunity Commission (EEOC) and the Department of Justice (DOJ) have maintained guidance focused on AI tools. The EEOC's Artificial Intelligence and Algorithmic Fairness Initiative states that employers using automated tools to screen applicants must actively monitor those tools for adverse impact. If a vendor tool results in a selection rate for a protected group that is substantially lower than the rate for another group, the employer is prima facie liable for discrimination, regardless of executive directives targeting broader agency policies.

3. The UK Paradigm: The Equality Act 2010 and Strict Liability

While the Workday case proceeds through the US federal court system, its underlying principles translate directly into the UK legal framework. In many respects, statutory law in the United Kingdom imposes an even stricter standard of accountability on employers using automated hiring software.

????????????????????????????????????????????????????????????????????????????
?                          UK LIABILITY COMPARISON                         ?
????????????????????????????????????????????????????????????????????????????
?         US (Title VII / ADEA)       ?       UK (Equality Act 2010)       ?
????????????????????????????????????????????????????????????????????????????
? • Disparate Impact Theory           ? • Indirect Discrimination (s.19)   ?
? • Vendor can be held as an "Agent"  ? • Strict liability for principal   ?
? • Intent is not required            ? • Non-delegable statutory duty     ?
????????????????????????????????????????????????????????????????????????????

Section 19: Indirect Discrimination Explained

Under Section 19 of the Equality Act 2010, indirect discrimination occurs when an employer applies a "provision, criterion, or practice" (PCP) that is neutral on its face but puts individuals sharing a protected characteristic at a particular disadvantage compared with others.

In automated recruitment, the deployment of an AI screening algorithm constitutes a PCP. If a UK employer uses an automated tool to screen candidates, and that tool filters out older applicants, minority applicants, or neurodivergent individuals at a disproportionate rate, the employer has committed indirect discrimination.

Similar to the US disparate impact theory, intent is entirely irrelevant under Section 19. The employer does not need to know the algorithm is biased. The mere fact that the tool creates a disadvantageous outcome establishes liability, unless the employer can prove the practice is a "proportionate means of achieving a legitimate aim"—a rigorous legal hurdle that standard automated screening rarely satisfies.

Section 109: Non-Delegable Statutory Duties and Agency

UK employers often assume that if a software vendor certifies their platform as "biased-tested" or compliant, the employer is legally protected. This is a profound misunderstanding of UK statutory law.

Under Section 109 of the Equality Act 2010, an employer is liable for the acts of its agents done with the employer's authority, or its employees in the course of employment. This creates a non-delegable duty. An employer cannot contract out of its statutory obligations under the Equality Act.

If a third-party AI provider acts as the gatekeeper for an employer's hiring process, that provider functions as an agent. If the agent's tool discriminates, the employer remains primarily and strictly liable to the rejected candidates. Any indemnification clause in the vendor contract only provides a grounds for a secondary contract dispute; it does not absolve the employer of statutory liability before an Employment Tribunal.

4. The Data Protection Layer: UK GDPR and Automated Decision-Making

Beyond anti-discrimination law, UK employers face a parallel regulatory challenge under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Automated hiring tools directly engage strict privacy laws concerning automated profiling.

Article 22: The Right to Human Intervention

Article 22 of the UK GDPR establishes a general prohibition on decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects on an individual.

Is Your Hiring Process Compliant with Article 22 UK GDPR?
                      
                 [AI Evaluates Applicant]
                            ?
                            ?
               {Is there human oversight?}
               ??? No  ??? [Breach of Article 22 (Solely Automated)]
               ??? Yes ??? {Is human review meaningful?}
                            ??? No  ??? [Rubber-Stamping Breach]
                            ??? Yes ??? [Compliant Processing]

A decision to reject a job applicant at the initial screening phase carries a "similarly significant effect." Consequently, solely automated resume screening is illegal under the UK GDPR unless it falls under specific exemptions, such as being necessary for entering into a contract, and is accompanied by safeguards. These safeguards must include:

The right for the applicant to obtain human intervention.
The right for the applicant to express their point of view.
The right for the applicant to contest the decision.

The "Rubber-Stamping" Trap

Many employers attempt to circumvent Article 22 by introducing a "human in the loop" defense. They argue that a human manager makes the final selection from an AI-generated shortlist, meaning the process is not solely automated.

The UK Information Commissioner’s Office (ICO) has repeatedly rejected this defense if the human involvement is a mere administrative formality. If an HR professional receives a list of top 10 candidates from an AI platform and automatically moves them to the interview stage without reviewing the rejected applications, the human oversight is an illusion.

Regulatory guidance specifies that for human intervention to be meaningful, the reviewer must have the authority, capability, and data necessary to overturn the algorithm's recommendation. "Rubber-stamping" an AI's decision leaves the employer fully exposed to severe regulatory fines under the UK GDPR, which can reach up to £17.5 million or 4% of global annual turnover.

5. Algorithmic Bias: Why AI Discriminates

To effectively mitigate these legal liabilities, legal counsel and HR executives must understand the technical mechanisms that generate algorithmic bias. AI systems do not possess intent, but they reproduce human bias through data anomalies and structural design flaws.

Training Data Deficiencies and Historical Replication

Machine learning models learn to identify qualified candidates by analyzing historical data. If an organization historically promoted or hired a demographic slice that lacked diversity, the training dataset reflects that imbalance.

The AI looks for statistical correlations within this data. For instance, if past successful hires frequently listed specific hobbies or attended certain institutions, the AI flags those parameters as indicators of candidate quality.

Conversely, it may penalize indicators associated with protected groups, such as gaps in employment history due to maternity leave, or graduation dates that reveal advanced age.

Proxy Variables

Even when developers explicitly remove protected attributes—such as age, gender, race, or disability status—from the training data, AI models routinely reconstruct these categories using proxy variables. A proxy variable is an ostensibly neutral data point that correlates with a protected trait.

Zip/Postal Codes: Can serve as a proxy for race or socioeconomic status due to residential demographics.
Graduation Year: Acts as a direct proxy for age.
Participation in Certain Sports or Organizations: Can serve as a proxy for gender or ethnicity.

An algorithm designed to maximize efficiency will leverage these proxy correlations to sort applications, inadvertently executing systemic discrimination under a facially neutral process.

6. Strategic Compliance: A Blueprint for Employers

The preliminary ruling in Mobley v. Workday confirms that waiting for litigation to challenge hiring software is an expensive error. Employers must adopt a proactive compliance framework to govern their automated recruitment tools.

????????????????????????????????????????????????????????????????????????????
?                     5-STEP EMPLOYER COMPLIANCE ROADMAP                   ?
????????????????????????????????????????????????????????????????????????????
?  1. MANDATE VENDOR TRANSPARENCY                                         ?
?     Require algorithmic architecture details and data origin audits.     ?
????????????????????????????????????????????????????????????????????????????
?  2. IMPLEMENT BIAS AUDITS (THE 4/5THS RULE)                             ?
?     Regularly test selection rates across protected demographics.        ?
????????????????????????????????????????????????????????????????????????????
?  3. RESTRUCTURE VENDOR CONTRACTS                                        ?
?     Secure robust indemnification and regular compliance reporting.      ?
????????????????????????????????????????????????????????????????????????????
?  4. ENFORCE MEANINGFUL HUMAN OVERSIGHT                                  ?
?     Train HR professionals to independently evaluate AI outputs.        ?
????????????????????????????????????????????????????????????????????????????
?  5. EXECUTE RECRUITMENT DPIAs                                           ?
?     Document data flows, algorithmic risks, and mitigation strategies.  ?
????????????????????????????????????????????????????????????????????????????

Step 1: Mandate Comprehensive Vendor Transparency

Employers should not buy or deploy recruitment software that operates as a closed "black box." You must demand detailed documentation from software providers explaining:

The composition of the data used to train the underlying machine learning models.
The specific criteria, weights, and variables the algorithm uses to rank or screen candidates.
The methodologies used by the vendor to test for and mitigate demographic bias.

Step 2: Implement Independent Algorithmic Bias Audits

Employers must conduct statistical reviews of their hiring outcomes. In the US, this involves evaluating whether automated screening complies with the Four-Fifths Rule (or 80% rule). Under this guideline, a selection rate for any race, sex, or ethnic group that is less than four-fifths (80%) of the rate for the group with the highest rate is evidence of adverse impact.

In the UK, statistical testing should look for disproportionate impact across all protected characteristics defined by the Equality Act 2010. If an audit reveals that an AI screening tool systematically assigns lower scores to applicants over 40 or from minority backgrounds, the algorithm must be taken offline and recalibrated.

Step 3: Restructure Vendor Contracts and Indemnification

Standard software-as-a-service (SaaS) agreements are typically written to protect the tech vendor, disclaiming all warranties of fitness for a particular purpose and capping liability at a nominal amount. Given the shifting landscape toward agency liability, employers must renegotiate these contracts to include:

Clear representations and warranties that the software complies with Title VII, the Equality Act 2010, and the UK GDPR.
Uncapped indemnification clauses requiring the vendor to cover legal fees, damages, and regulatory fines resulting from discrimination claims caused by the software.
Contractual obligations for the vendor to provide regular, updated bias audit reports.

Step 4: Enforce Meaningful Human Oversight

To address regulatory challenges under Article 22 of the UK GDPR, employers must restructure the role of human recruiters. HR personnel must be trained to understand that AI recommendations are advisory, not definitive.

Organizations should implement a quality-control process where a random sample of applications rejected by the AI are audited by human personnel to ensure qualified candidates are not being systematically excluded.

Step 5: Execute Recruitment-Specific Data Protection Impact Assessments (DPIAs)

Under the UK GDPR, processing operations that utilize new technologies and are highly likely to result in a high risk to the rights and freedoms of individuals require a formal Data Protection Impact Assessment (DPIA). Automated hiring platforms fit this description.

A thorough DPIA must document the systematic data flows, identify specific privacy and discrimination risks, and detail the organizational measures implemented to mitigate those risks. A documented DPIA provides evidence of proactive regulatory compliance if investigated by the ICO.

Balancing Innovation with Liability

The Mobley v. Workday, Inc. class-action lawsuit is a foundational shift in tech-driven employment litigation. The ruling that AI platforms can be legally scrutinized as employer agents changes the risk calculation for corporate legal departments and HR executives worldwide.

In an interconnected global market, the legal principles governing automated systems are converging. Whether analyzed through the lens of US disparate impact theory or the strict liability frameworks of the UK Equality Act 2010 and the UK GDPR, the conclusion remains the same: delegating employment decisions to algorithms does not delegate legal responsibility.

As courts and international regulators increase their scrutiny of automated employment practices, companies must take steps to audit their hiring platforms, secure vendor accountability, and maintain human oversight. The efficiency of AI screening cannot come at the cost of legal non-compliance and systemic discrimination.

Key Takeaways for Corporate Counsel

No Shield: Outsourcing candidate screening to third-party AI tools does not insulate an employer from discrimination claims.
Strict Legal Standards: Under both US and UK frameworks, an employer can be held liable for discriminatory hiring outcomes even without any intent to discriminate.
Audit and Review: To mitigate liability, organizations must audit their automated systems, demand structural transparency from technology vendors, and ensure human involvement in hiring decisions.

To review your organization's hiring technologies or to evaluate automated recruitment tools for compliance under current employment and data privacy frameworks, consider exploring the detailed analysis at Poyner Spruill LLP.