Your ATS Ranks Applicants With AI: What Mobley v. Workday Means for the Employer Customer

Why Vendor Liability in Mobley v. Workday Never Immunizes the Employer

Letting plaintiffs sue an ATS vendor as an "agent" adds a second pocket to the caption. It never excuses the employer that switched on the ranking model or delegated the rejection gate.

Many Talent Acquisition leaders misread the headlines around Mobley v. Workday, Inc., Case No. 3:23-cv-00770-RFL (N.D. Cal.). When Judge Rita F. Lin denied Workday's motion to dismiss the agency theory in July 2024—holding that a vendor delegated traditional hiring-gatekeeper functions can plausibly qualify as an "agent" of the employer under Title VII (42 U.S.C. § 2000e(b)), the Age Discrimination in Employment Act (29 U.S.C. § 630(b)), and the Americans with Disabilities Act (42 U.S.C. § 12111(5))—some HR teams breathed a sigh of relief. They assumed the vendor took the bullet.

Read the subsequent docket orders and that comfort evaporates fast. Following preliminary certification of a nationwide ADEA collective action in May 2025 and survival of direct California Fair Employment and Housing Act (FEHA) claims in June 2026, the court's October 6, 2026 discovery order recorded that more than 15,000 job applicants have opted into the ADEA collective, while Workday's enterprise customer lists and feature-deployment logs became contested discovery subjects under Attorneys' Eyes Only protective orders.

Under long-settled federal civil rights doctrine and the Uniform Guidelines on Employee Selection Procedures (29 CFR Part 1607), an employer's statutory duty not to use selection procedures causing unlawful disparate impact (42 U.S.C. § 2000e-2(k)) is non-delegable. If a third-party test, recruiter, or machine-learning ranker screens out applicants aged 40 and older—or applicants with disability-related resume gaps—at a statistically significant rate (measured against the 29 CFR § 1607.4(D) four-fifths / 80% rule and standard-deviation tests), the employer using that screen is directly liable unless it proves the specific tool is job-related for the position in question and consistent with business necessity. Nor can vendor contracts shift blame cleanly: state lawmakers are actively closing contractual loopholes, including Colorado's revised automated decision-making statute (SB 26-189, effective January 1, 2027), which voids contract clauses purporting to shield a party from liability for its own discriminatory acts.

The Hidden Evidence Trail Inside Your Own ATS Admin Panel

Most disparate-impact exposure does not come from mysterious neural networks alone. It comes from forgotten knockout rules, graduation-year fields, and recruiter sort habits sitting inside your own tenant.

Last quarter, a 450-person software firm audited its ATS workflows after counsel asked which AI and changing work features were live in Recruiting. The Head of TA swore the team "never auto-rejects anyone with AI—every resume gets human eyes." Then the HRIS administrator exported the requisition template table. Three years earlier, a former coordinator had configured two silent rules on high-volume support and sales requisitions: (1) an automated knockout disposition rejecting anyone who selected "More than 10 years" on an experience dropdown intended for entry-level pay bands, and (2) an AI match-score sort where recruiters reviewed only "Grade A / 85%+" profiles in the top 25 rows before closing the slate, leaving 380 lower-ranked applicants untouched until bulk-dispositioned at requisition close.

Legally, never opening rows 26 through 405 because an algorithm sorted them to page nine is functionally identical to an automated rejection. Pull your ATS configuration table this week and check five concrete settings:

1. Auto-Disposition & Knockout Questions: Audit every requisition template for mandatory college graduation years, maximum-experience ceilings ("3–7 years strictly"), uninterrupted recent-employment rules that penalize disability or caregiving leaves, or rigid schedule prompts unmoored from essential functions.
2. AI Match Scores, Grades, and Stack Ranking: Document every vendor module generating star ratings, A/B/C/D fit grades, or percentage match scores. Check whether recruiters actually read below the top score band—and calculate selection rates across age, sex, and race/ethnicity cohorts at the exact stage where human review stops.
3. ZIP-Code Radius & Commute Proxies: Filtering remote or metro-wide applicants by tight ZIP-code clusters or historical salary bands frequently acts as a direct demographic proxy—an explicit violation in Illinois as of January 1, 2026.
4. Automated Video or Chatbot Pre-Screens: Verify whether asynchronous video or chat tools score speech cadence, facial expression, or response speed, which carry acute ADA disparate-impact exposure for neurodivergent, deaf, or speech-impaired candidates.
5. Model Retraining Feedback Loops: Check whether clicking "Thumbs Down / Not a Fit" in your ATS feeds tenant-specific weights back into the vendor's ranking model, locking historical hiring-manager bias into next quarter's slates. (If you also use algorithmic metrics in workforce reductions, pair this check with our AI productivity metrics and layoff selection audit.)

Four Live State and Local Mandates: NYC, Illinois, California, and Colorado

Waiting for federal AI legislation is a costly mistake when four sub-federal regimes already govern applicant notices, bias testing, and multi-year data retention. Map your remote and on-site requisitions against all four thresholds.

Even if your company never faces a class subpoena out of Mobley, people operations teams hiring across state lines must satisfy four overlapping statutory regimes:

• California Civil Rights Council ADS Regulations (2 CCR §§ 11008, 11010, 11016 et seq. — effective October 1, 2025, 5+ employees): Explicitly brings "Automated-Decision Systems" (any computational process derived from machine learning, statistics, data analytics, or AI that screens, evaluates, categorizes, or recommends applicants or employees) under FEHA's anti-discrimination prohibitions for both employers and their agents. Two operational shocks stand out: first, the presence or absence of proactive anti-bias testing and quality assurance is expressly relevant evidence in any FEHA claim; second, California extended mandatory personnel record retention from two years to four full years for all ADS data, selection criteria, scoring outputs, and assessment records.
• Illinois Human Rights Act AI Amendments — HB 3773 (775 ILCS 5/2-102(L), Public Act 103-0804 — effective January 1, 2026, 1+ employees): Makes it a civil rights violation to use AI (including generative AI) in recruitment, hiring, promotion, renewal, selection for training, discipline, discharge, or tenure in a way that subjects employees or applicants to discrimination, explicitly bans using ZIP codes as a proxy for protected classes, and requires employers to provide affirmative notice to applicants and employees whenever AI is used for those employment purposes.
• New York City Local Law 144 (NYC Admin. Code §§ 20-870 to 20-874 & 6 RCNY § 5-300 — in force): Covers any Automated Employment Decision Tool (AEDT) that substantially assists or replaces discretionary decision-making for jobs in NYC. Requires (a) an independent third-party bias audit within the past 12 months calculating sex, race/ethnicity, and intersectional selection/scoring impact ratios, (b) public posting of the audit summary and tool distribution date on your career site, and (c) candidate notice at least 10 business days before use, backed by civil penalties of $500 to $1,500 per day per violation.
• Colorado AI / ADMT Law (C.R.S. § 6-1-1701 et seq., enacted via SB 24-205 and revised via SB 26-189 effective January 1, 2027): Requires consequential-decision disclosures, genuine human review rather than rubber-stamp ratification of AI rankings, voiding of discriminatory liability shields, and three-year compliance record retention.

Run the Privileged Applicant-Flow & Age-Band Audit Before Discovery Forces It

You cannot pull an ADEA adverse-impact table because your ATS never collects dates of birth at application—yet plaintiffs reconstruct age in ten minutes from graduation years and credit headers. Test your funnel under privilege first.

Notice the clever analytical trap inside Mobley: employers rightly avoid asking applicants their birth date on job applications, then assume nobody can measure whether an AI ranker penalizes candidates aged 40+. In litigation, plaintiffs match applicant names and addresses against public records, LinkedIn graduation years, or background-check headers to compute exact age-band pass-through rates at every funnel step. Direct your internal audit under written engagement from employment counsel so preliminary statistical runs carry attorney-client privilege, and capture every live ATS feature in a single configuration register:

======================================================================
PRIVILEGED & CONFIDENTIAL — PREPARED AT DIRECTION OF LEGAL COUNSEL
ATS & RECRUITING AI CONFIGURATION AUDIT REGISTER
======================================================================
Tenant / Platform Audited:       [ATS Name + Add-On Modules]
Audit Period & Reviewer:         [YYYY-MM-DD] · [Counsel + HRIS Lead]

1. FEATURE-BY-FEATURE LIVE INVENTORY
- Module / Feature Name:         [e.g., AI Candidate Match Score v4.2]
- Enabled On Which Reqs/States?  [All US Reqs / Engineering Only / Off]
- Auto-Reject or Hard Cutoff?    [NO / YES -> Disable unvalidated cutoff]
- Recruiter Default Sort Order:  [Chronological / Match Score High-to-Low]
  * % of hires drawn from top-quartile AI score band: [____%]
  * % of unreviewed applicants below score [XX] at Req close: [____%]

2. KNOCKOUT & PROXY QUESTION SCRUB (775 ILCS 5/2-102(L) & ADEA)
[ ] Zero college graduation-year minimums or "max X years exp" knockouts
[ ] Zero ZIP-code radius auto-filters on remote/metro requisitions
[ ] Zero automated employment-gap penalties (ADA / caregiving risk)
[ ] Explicit 1-click ADA accommodation bypass link on all assessments

3. NOTICE, AUDIT & 4-YEAR RETENTION VERIFICATION
[ ] Illinois HB 3773 AI evaluation notice active on career portal & ATS
[ ] NYC Local Law 144 10-business-day notice + published annual audit URL
[ ] California 2 CCR § 11008 4-Year Retention Vault active (archiving
    exact model version, input parse, match score, and human disposition)
======================================================================

Governance Roles Across TA, HRIS, Procurement, and Counsel

Most "shadow AI" in recruiting enters through a free browser extension or a silent quarterly vendor release toggled on by default. Lock admin permissions so zero scoring tools launch without Legal and HRIS sign-off.

Train recruiters and hiring managers via manager support that an AI match grade is never a substitute for reading resumes against objective, written minimum qualifications—and ban pasting candidate resumes into unapproved personal chatbots.