Your AI Vendor Is Not a Liability Shield!

Employers using artificial intelligence to screen applicants have largely concluded the risk receded in 2025. It did not. It just relocated.

The Vendor is Not Your Shield

The central case is Mobley v. Workday, Inc., 740 F. Supp. 3d 796 (ND Cal., 2024), where the court let discrimination claims proceed against the software vendor on an agent theory, reasoning that a company performing screening functions on an employer’s behalf falls within the statutory definition of employer.[1]

The court granted preliminary collective certification on an ADEA claim in May 2025, extended the collective to applicants scored by acquired AI features, and in March 2026 rejected the argument that the ADEA does not reach job applicants at all.[2]

In June 2026 it sustained California FEHA claims on the theory that the vendor designs and operates the tools in-state.[3]

Employers read this as good news, assuming the vendor absorbs the exposure. That reading is backwards. Agent liability does not displace principal liability. It gives plaintiffs a deep-pocketed codefendant, nationwide collective mechanics, and discovery into algorithmic logic no individual plaintiff could have funded alone. The employer stays in the case.

The Audit Paradox

Clients should audit their tools for disparate impact. Illinois now makes discriminatory effect a civil rights violation regardless of intent, and Colorado and New York City add testing and notice duties.[4]

However, such audit also manufactures the plaintiff’s best exhibit. An audit that surfaces adverse impact converts defensible ignorance into documented knowledge, and the standard defense, that the employer had no reason to suspect bias, becomes untenable. Clients sense this, which is why some prefer not to look.

That instinct is the worst option available, and it is now avoidable. In May 2026 the Mobley court held the vendor’s bias-testing data privileged, but the bar is higher than clients assume: counsel must curate the underlying data, the purpose must be legal advice rather than business, and mere direction by attorneys is not enough.[5] The same order noted the data had not been submitted to any regulator, which matters because New York City requires published bias audits. Privilege and disclosure mandates can pull in opposite directions.

What to do?

Run the Audit Through Counsel. Counsel must shape the data and the purpose must be legal advice. A forwarded vendor report is not privileged.

Rewrite the Vendor Contract. Indemnities drafted before agent liability existed do not reach it. Demand bias-testing representations and audit rights.

Act on the Findings. Privilege protects the analysis, not inaction. A known problem left unfixed is worse than never testing.

The enforcement pause is a timing feature, not a safe harbor. Limitations periods are running on conduct occurring now, and the next administration inherits the record.

General information, not legal advice. This area is developing rapidly; confirm current posture before relying on any case cited.

Citations

1. Mobley v. Workday, Inc., 740 F. Supp. 3d 796 (N.D. Cal. July 12, 2024) (denying dismissal of federal claims on agency theory).

2. Mobley v. Workday, Inc., No. 23-cv-00770-RFL, 2025 U.S. Dist. LEXIS 94475 (N.D. Cal. May 16, 2025) (preliminary collective certification); order of July 7, 2025 (extending collective to HiredScore-screened applicants); Mobley v. Workday, Inc., 2026 U.S. Dist. LEXIS 47180 (N.D. Cal. Mar. 6, 2026) (denying dismissal of ADEA claim; job applicants may bring ADEA disparate-impact claims).

3. Mobley v. Workday, Inc., No. 23-cv-00770 (N.D. Cal. June 22, 2026), ECF 360 (sustaining FEHA claims; citing Raines v. U.S. Healthworks Med. Grp., 534 P.3d 40 (Cal. 2023)).

4. Ill. Pub. Act 103-0804 (amending 775 ILCS 5/2-102), eff. Jan. 1, 2026; Colo. SB 24-205; N.Y.C. Local Law 144 (2021).

5. Mobley, 2026 U.S. Dist. LEXIS 119695 (N.D. Cal. May 29, 2026) (ECF No. 340) (Beeler, M.J.) (denying motion to compel bias-testing data).