- AI hiring tools are not neutral. Research shows they systematically favor white-associated names 85% of the time and show measurable bias against women, older workers, and candidates with disabilities.
- Mobley v. Workday is the case every HR team needs to understand. In 2026, it became a nationwide class action covering potentially millions of applicants over 40. A March 2026 court ruling rejected Workday’s central defense. The case is ongoing.
- Employers are legally responsible for discriminatory outcomes produced by third-party AI tools — even when they did not build the algorithm. “We just used the vendor’s software” is not a legal defense.
- The regulatory picture in 2026 is fragmented but tightening: California, Colorado, and New York City have active requirements in effect or taking effect this year.
- Six things HR teams should do now: request a bias audit from every AI hiring vendor, apply the four-fifths rule to your screening data, document everything, keep humans in the loop on final decisions, update candidate notices, and review your vendor contracts.
In 2023, the EEOC settled its first AI hiring discrimination lawsuit. The defendant, iTutorGroup, had programmed its recruitment software to automatically reject women over 55 and men over 60.
The settlement was $365,000. The fix was a policy overhaul. It was the first case. It was not the last.
By 2026, AI-powered tools are involved in hiring decisions at approximately 88% of companies, according to World Economic Forum data.
That penetration means the bias embedded in those tools is not an edge case — it is systemic. Courts are beginning to treat it as such.
This article explains how AI bias happens in hiring, what the legal landscape looks like in 2026, and what HR teams need to do now. Not eventually.
How AI Bias Happens: Three Mechanisms
Understanding bias in AI hiring requires understanding where it comes from.
It is not a glitch. It is a predictable output of how these systems are built.
Mechanism 1: Biased Training Data
AI hiring tools learn from historical hiring data. If your organization, or the organizations whose data the tool was trained on, hired mostly white men for engineering roles over the past decade, the model learns to associate those characteristics with engineering success.
It is not making a moral judgment. It is pattern-matching. The pattern it is matching happens to reproduce historical discrimination.
A large-scale randomised experiment published through VoxDev in May 2025 (An, Huang, Lin & Tai, 2025) found that leading AI models systematically favored female applicants while disadvantaging Black male applicants with identical qualifications — not through any explicit design choice, but because the tools reproduced existing disparities in their training data.
The discrimination was not intentional. It was structural.
Mechanism 2: Proxy Variables
Even when demographic information is explicitly removed from the data the AI evaluates, the model can infer protected characteristics through proxy variables. ZIP codes correlate with race. University names correlate with socioeconomic background.
Resume formatting conventions correlate with national origin and age. Gap years correlate with disability or caregiving.
The Amazon resume screening tool — a well-documented case from 2018 that the company ultimately abandoned — penalized resumes that included the word “women’s,” as in “women’s chess club” or “women’s college.”
The system had no explicit instruction to discriminate against women. It had trained on a decade of resumes from successful Amazon employees, most of whom were men, and learned to deprioritize signals associated with female applicants.
Mechanism 3: Feedback Loops
When AI screening tools advance candidates who perform well in the role, and that performance data is fed back into the model, the model optimizes for the characteristics of historically successful employees.
If the historical workforce was demographically homogeneous, by design or circumstance, the feedback loop reinforces that homogeneity.
The system gets better at finding people who look like the people who already work there, which is definitionally not what diversity hiring is trying to do.
What the Data Shows
The documented evidence of AI hiring bias is no longer theoretical.
A 2026 audit of algorithmic hiring systems found that resume screening algorithms were 35% less likely to advance applications from candidates with names perceived as African American, and video interview analysis tools showed a 28% bias against candidates over age 50.
Research aggregated across multiple studies shows AI tools favor white-associated names 85% of the time. Male names are preferred over female names by rates of 52 to 85%, depending on the tool and role type.
The documentation gap is significant. Most organizations deploying AI hiring tools cannot produce independent audit results on request, have not run the four-fifths calculation on their screening data, and lack the four-year records California now requires for automated decision systems.
The problem is not ignorance of the tools — it is ignorance of what those tools are actually doing to the applicant pool.
If you are accepting your vendor’s bias-reduction marketing without requesting independent audit data, you are operating on faith rather than evidence.
The Legal Landscape in 2026
Mobley v. Workday: The Case That Changed Everything
Derek Mobley is a Black man over 40 with anxiety and depression. Beginning in 2017, he applied to more than 100 jobs at companies that use Workday’s AI-powered screening tools.
He was rejected every time — often within minutes of submitting his application, sometimes in the middle of the night. He sued in 2023.
What has happened since:
July 2024: A California federal court rejected Workday’s motion to dismiss. The court held that Workday could be treated as an “agent” of the employers who used its tools — meaning the vendor itself could bear direct liability for discriminatory outcomes.
May 2025: Judge Rita Lin granted preliminary collective certification. The case became a nationwide class action covering applicants over 40 who were screened through Workday’s AI tools since September 2020. Potentially millions of applicants were included.
March 6, 2026: The court rejected Workday’s central remaining defense — that the Age Discrimination in Employment Act does not cover job applicants, only current employees. That argument failed.
March to April 2026: Plaintiffs filed an amended complaint reasserting California state and disability claims. The case continues in active litigation.
The case now presents compounding exposure not only for Workday but increasingly for the more than 10,000 employers that use Workday’s AI-powered hiring tools.
If those employers receive opt-in notices — and discover they were not disclosing, auditing, or governing their AI tools — they may face simultaneous exposure in litigation and regulatory enforcement.
In January 2026, a separate class action was filed against Eightfold AI, alleging the company operated as a consumer reporting agency — collecting and scoring applicant data from unverified third-party sources without consent, in violation of the Fair Credit Reporting Act.
Workday establishes that vendors can be liable for discrimination. Eightfold frames vendors as entities subject to transparency mandates. These two cases are developing the legal framework from two directions.
What This Means for Employers
The core legal principle to understand: employers remain fully liable under Title VII if their AI hiring tools produce a disparate impact on protected groups, regardless of whether the tool was purchased from a third-party vendor.
The EEOC has been explicit that “we just used the vendor’s software” is not a defense.
This has not changed under the Trump administration’s April 2025 executive order, which instructed federal agencies to reduce pursuit of disparate impact theories of liability.
That order affects government-led enforcement. It does not affect private litigation like Mobley, which proceeds on existing statutory grounds. State EEO agencies are actively taking up cases the federal government steps back from.
State Regulations Active
California (effective October 2025): New regulations from the Civil Rights Council explicitly bring AI-driven automated decision systems under existing anti-discrimination law.
Employers must maintain records of automated decision data for four years. AI tools that screen out applicants based on protected characteristics are prohibited.
Colorado (effective June 30, 2026, enforcement status uncertain): The AI Act (SB 24-205) requires employers and developers of high-risk AI hiring tools to use “reasonable care” to prevent algorithmic discrimination.
Mandatory risk assessments and transparency notices to candidates are required. Penalties can reach $25,000 per violation.
As of April 2026, a federal court has paused enforcement during ongoing litigation, and the Colorado legislature is actively considering SB 26-189, a bill that would substantially rewrite the law’s framework before it takes effect.
Employers in Colorado should monitor developments closely — the law’s final form is not yet settled.
New York City (in effect since July 2023): Local Law 144 requires annual independent bias audits for automated employment decision tools and public reporting of results. Candidates must be notified when such tools are used.
EU AI Act: Emotion recognition in workplace contexts has been prohibited since February 2025.
Any AI vendor still marketing facial expression analysis for hiring in European markets is operating in legally precarious territory.
The Four-Fifths Rule: The Standard You Need to Know
The four-fifths rule (also called the 80% rule) is the EEOC’s primary tool for identifying adverse impact.
The rule: if the selection rate for a protected group is less than 80% of the selection rate of the highest-selected group, that is an indicator of adverse impact.
In practice: if your AI screening tool advances 50% of white male applicants to the next stage, but only 35% of Black female applicants, that is 70% — below the 80% threshold.
That disparity is a signal that the tool may be producing discriminatory outcomes and warrants investigation.
This calculation requires data you may not currently be collecting. That is itself a problem.
Organizations that cannot run the four-fifths calculation on their screening tools do not know whether those tools are producing disparate impact. Ignorance is not protection. It is exposure.
For a detailed guide on running a bias audit specific to job description content, read: #24: How to Audit AI Job Posts for Bias Before Publishing
Six Steps HR Teams Need to Take Now
Step 1: Request an Independent Bias Audit from Every Vendor
Do not accept vendor-produced bias assessments as evidence of fairness. Request independent third-party audit results.
The audit should include: selection rate breakdowns by protected group, four-fifths calculations, documentation of what the model was trained on, and how frequently it is retested. If a vendor cannot or will not provide this documentation, that is itself a signal.
Step 2: Run the Four-Fifths Calculation on Your Own Screening Data
Pull your screening data for the last 12 months. Calculate selection rates by race, age, sex, and disability status at each stage — application to phone screen, phone screen to interview, interview to offer.
Any stage where a protected group’s advancement rate falls below 80% of the highest-advancing group warrants investigation. This is now a compliance requirement in California and a best practice everywhere.
Step 3: Document Everything
California requires four years of records on automated decision data. Colorado requires documentation of risk assessments.
Even where not legally required, documentation is your primary protection in litigation.
Document: which tools you use, what decisions they inform, how they were configured, what your human oversight process is, and the results of any bias audits.
Step 4: Keep Humans Between AI Output and Candidate-Facing Decisions
No automated rejection should go to a candidate without human review.
Automated rejections without human review are the fastest path to discrimination claims and the most difficult to defend.
A recruiter confirming that the AI’s shortlist is reasonable is sufficient for most stages. The key is that a human is accountable for the outcome.
Step 5: Update Candidate Notices
New York City requires explicit notice to candidates when automated employment decision tools are used.
California and Colorado have similar or broader requirements. Even where not mandated, disclosure is increasingly expected by candidates and may affect whether they view your process as fair.
Update your application process to include a plain-language statement about AI use in your screening.
Step 6: Review Your Vendor Contracts
Mobley established that employers can be held liable for their vendor’s algorithm. Your vendor contracts should address this directly.
At minimum: What warranties does the vendor provide about bias testing and non-discrimination? What does the contract say about liability for discriminatory outcomes? What audit rights do you have over the tool’s configuration and training data?
Standard boilerplate that the client “retains control” carries less weight if the system effectively prevents candidates from reaching a human reviewer.
The Complication: Changing Federal Priorities
The Trump administration’s April 2025 executive order instructing agencies to reduce pursuit of disparate impact theory creates genuine uncertainty at the federal level.
The EEOC’s May 2023 technical guidance on AI and employment discrimination — which was widely cited — has been removed from the agency’s website.
This does not mean the legal risk has diminished. It means the source of that risk has shifted. State attorneys general, private class action lawyers, and state EEO agencies are actively pursuing cases the federal government is stepping back from.
Mobley v. Workday proceeds as a private class action on statutory grounds that the executive order does not affect.
The practical implication for HR teams: do not interpret reduced federal enforcement activity as license to reduce bias auditing.
State-level exposure is expanding to fill the federal gap, and private litigation has always operated independently of EEOC enforcement priorities.
Related Reading
- AI Tools for Resume Screening — What Actually Works
- #12: Can You Use AI-Generated Job Descriptions Legally? A Plain-English Guide
- #23: How to Disclose AI Use in Your Hiring Process to Candidates
- #24: How to Audit AI Job Posts for Bias Before Publishing
- P3: AI Ethics and Compliance in Hiring — The Complete Guide
Frequently Asked Questions
Every AI hiring tool trained on historical hiring data carries some risk of reproducing existing biases. The degree of risk varies by tool design, training data quality, the organization’s historical hiring patterns, and how the tool is configured. Tools with independent third-party bias audits, explainable scoring, and active monitoring for disparate impact perform better than black-box tools that cannot show their reasoning. No tool eliminates bias entirely. The meaningful distinction is between tools that make bias visible and auditable versus those that hide it behind algorithmic outputs no one can examine.
Not reliably. The Mobley v. Workday ruling established that employers can be treated as liable parties even when a third-party vendor produced the algorithm. Standard vendor contracts often include disclaimers that the client retains control over hiring decisions. Courts have been skeptical of this argument when the algorithm’s outputs effectively determine who advances and who does not, without meaningful human review. Contractual indemnification clauses may provide some financial protection if a vendor agrees to cover defense costs — but they do not eliminate the legal exposure or the reputational damage of a discrimination lawsuit naming your organization.
Most ATS platforms now include AI features — candidate scoring, resume ranking, recommended shortlists — often enabled by default. Start by asking your vendor these questions: What AI features are active in my account? What were those features trained on? Has the system been independently audited for disparate impact? What is the methodology for those audits? If the vendor cannot answer these questions clearly, escalate. The features may have been activated without deliberate setup decisions, and you may not know what criteria the algorithm is applying.
Reducing AI use reduces algorithmic bias risk but does not eliminate hiring bias risk overall. Human-only hiring decisions are also subject to discrimination law and often produce worse outcomes for candidates from underrepresented groups — unconscious bias in resume review and interviews is well-documented. The better framing is not “AI versus human” but “explainable decisions with documented reasoning and bias monitoring versus opaque decisions with no audit trail.” A well-governed AI screening process with active bias monitoring may produce more defensible outcomes than an unstructured human-only process.
Stop using the tool for final candidate decisions immediately. Do not destroy data — preserve all records related to how the tool was used, its outputs, and the candidates it processed. Consult employment counsel before taking further action. Conduct an internal investigation to understand the scope of the disparate impact — which roles, which time periods, which protected groups were affected. Consider whether candidates who were screened out may warrant re-evaluation. Document every step of your response. The way an organization handles a discovered bias problem affects its defensibility in any subsequent litigation significantly more than the bias problem itself.
Conclusion
The core of this issue is straightforward: AI systems that learn from biased data reproduce biased outcomes.
The tools do not intend to discriminate. They are extraordinarily good at finding patterns in historical data, and historical hiring has never been neutral.
The legal environment in 2026 does not allow employers to outsource accountability to their vendors.
Mobley v. Workday is the clearest signal that courts are prepared to hold employers responsible for algorithmic outcomes they did not design but chose to deploy without adequate governance.
The state-level regulatory picture tightens that exposure further, regardless of what happens at the federal level.
The response is not to stop using AI in hiring. The tools offer real efficiency advantages that are difficult to forgo at scale.
The response is to govern them as the high-stakes decision-making systems they are. Audit them. Document them.
Put humans between their outputs and your candidates. And make sure you can explain every decision, because eventually someone may ask you to.
The legal and regulatory picture in this article reflects what the Ailovyu team has tracked across case developments, court filings, and state-level regulation through May 2026 — and it is still moving.
We research and test AI tools so you can make informed decisions before spending money on them. Every review, comparison, and tutorial on this site is based on actual use, not vendor marketing.
Learn more on our About page.
Legal information in this article is sourced from court filings, law firm publications (Akin Gump, Fisher Phillips, Seyfarth Shaw, Maynard Nexsen), and published regulatory guidance. This article is for informational purposes and does not constitute legal advice. If your organization is facing a specific compliance question or litigation matter, consult qualified employment counsel. No affiliate relationships are disclosed in this article.