YOU CAN'T OUTSOURCE DISCRIMINATION. THE COURTS JUST PROVED IT.

For three years, the working assumption inside most talent organizations has been some version of: the vendor built it, the vendor is responsible for it. You bought a screening tool, a ranking algorithm, an AI interview product. You signed a contract. Somewhere in that contract was language about the vendor's compliance obligations. You moved on.

That assumption just lost in federal court, and it's going to keep losing.

The ruling

On June 22, 2026, Judge Rita F. Lin of the U.S. District Court for the Northern District of California denied Workday's motion to dismiss the discrimination claims against it, ruling that Workday (a company that builds hiring software, not a company that hires anyone) can be held directly liable for employment discrimination under California's Fair Employment and Housing Act. Not liable because an employer using its software is liable. Liable on its own, independent of what any of its customers did or didn't know. The court leaned on a 2023 California Supreme Court precedent, Raines v. U.S. Healthworks Medical Group, to hold that Workday is "directly liable for its own engagement in FEHA-regulated activities on the employer's behalf": not a derivative of employer liability, but its own source of it.

It wasn't a clean sweep for the plaintiffs. Some race-discrimination claims tied to Asian American applicants were dismissed on procedural grounds. But the theory that matters (that a vendor can be sued directly, on its own conduct, regardless of what its customer knew) survived intact. That's the part every company using a purchased hiring tool should be paying attention to, not the scoreline.

Read that twice, because it cuts both ways. Vendors can no longer say "we just provide tools, sue our customer." Employers can no longer say "we just bought a tool, sue the vendor." The court didn't choose a side. It opened the door to both being named, separately, in the same suit.

This is the case known as Mobley v. Workday, and it's been the bellwether AI-hiring case since it was filed in 2023 by Derek Mobley and, later, three additional plaintiffs alleging that Workday's algorithmic screening tools discriminated against applicants on the basis of race, age, and disability. The case hasn't slowed down. It's accelerated. In February 2026, the court authorized notice to a nationwide collective of applicants alleging age discrimination under the ADEA. The opt-in window closed March 7, 2026; industry reporting puts the number of people who joined at roughly 14,000, though Workday has declined to confirm a figure. The case is now in discovery, with no trial date set, and the surviving claims (FEHA discrimination and at least one ADA claim) move forward on the merits.

A second front, a different weapon

Two weeks before the Workday ruling, on a separate track entirely, a different kind of AI-hiring suit was already picking up speed. Kistler v. Eightfold AI, filed in January 2026 by two California job applicants, doesn't argue discrimination directly. It argues that Eightfold, whose platform is used by employers including Microsoft and PayPal, generated candidate "Match Score" reports that function as consumer reports under the federal Fair Credit Reporting Act and California's Investigative Consumer Reporting Agencies Act, without the disclosure, consent, or dispute rights those laws require. Eightfold has denied the allegations, arguing it operates on data submitted by candidates or provided by its employer customers. The case is still in its early stages, with no ruling yet on the merits.

Different legal theory. Same underlying exposure: a third-party AI system made a consequential decision about a real person's employment, and the people affected by it didn't know what it was doing, on what data, using what criteria, or how to challenge it.

Why this is bigger than two lawsuits

It would be easy to file Mobley and Eightfold under "vendor risk" and move on. That's the wrong read. These cases matter to every talent leader, not just Workday's and Eightfold's customers, because they're closing off the one argument nearly every organization has been quietly relying on: we didn't build the bias, we bought it.

That argument was always weaker than it felt. It just hadn't been tested. Now it has, and it didn't hold.

The regulatory vacuum states are filling

This is landing at a specific moment in the enforcement cycle, and the timing matters. Federal appetite for policing AI-related discrimination has been retreating for over a year. In April 2025, Executive Order 14281 directed the EEOC, DOJ, FTC, and CFPB to deprioritize disparate-impact enforcement, the legal theory that covers most algorithmic bias claims, since AI tools rarely discriminate on purpose. The EEOC made it official this June: its new National Enforcement Plan, approved June 4, 2026, formally shifts the agency's focus toward intentional discrimination and away from disparate impact.

So, the federal referee stepped back. What's filling the vacuum isn't less scrutiny. It's scrutiny from more directions at once. Private plaintiffs' firms. State attorneys general. And a growing patchwork of state law that doesn't care what the EEOC deprioritized. Illinois amended its Human Rights Act effective January 1, 2026, to prohibit AI-driven discrimination and require employers to notify applicants when AI is used in hiring, promotion, discharge, or discipline decisions, and it specifically bars using zip code as a stand-in for race or national origin. California's Civil Rights Council rules extending FEHA to automated decision systems in employment took effect October 1, 2025, with a broader set of CPPA automated-decision-making rules (covering notice, opt-out rights, and access to the logic behind a decision) phasing in through April 2027. Colorado repealed and rewrote its AI Act entirely in May 2026, trading a stricter bias-audit-and-impact- assessment regime for a lighter disclosure-and-human-review framework, but it's still a live employer obligation taking effect January 1, 2027. New York City's Local Law 144, requiring independent bias audits of automated employment decision tools, has been in force since 2023 and remains the template other jurisdictions keep borrowing from.

Translate that into plain terms: there is no federal AI hiring law, and increasingly little federal appetite to build one. There is a widening set of state laws, court rulings, and plaintiff-side legal theories that assume the employer is on the hook regardless. If your compliance strategy has been "wait for federal guidance," you've been waiting for something that's being dismantled while the actual exposure grows.

The scale problem nobody's pricing in

Here's what makes this more than a legal footnote: the tools in question aren't niche. Jobscan's 2025 Applicant Tracking System report found that 97.8% of Fortune 500 companies (489 of 500) use a detectable applicant tracking system, with Workday alone powering talent acquisition at roughly 39% of them. That number has held in the high-90s every year Jobscan has measured it, back to 2018.

Meanwhile, a ResumeBuilder.com survey of 948 business leaders, fielded in October 2024, found 51% of companies were already using AI somewhere in their hiring process, with that figure projected to hit 68% by the end of 2025: 82% specifically for resume review, 40% for candidate-facing chatbots, and 23% for conducting interviews outright, with plans to push resume-screening use to 83% and assessment use to 69% within the year. That's not a niche pilot program at a handful of Silicon Valley firms. That's the default hiring infrastructure at more than half of corporate America, expanding by the month.

And the people on the receiving end know it, and don't trust it. That gap between adoption and trust is exactly the gap plaintiffs' attorneys are now building cases inside of.

Put the numbers together and the picture is stark: nearly every large employer in the country is running some form of AI-mediated screening (most of it purchased, not built in-house) at a moment when courts are ruling that ownership of the outcome doesn't transfer with the purchase.

What this demands of a talent leader

Not panic. Not abandoning AI tools: that ship has sailed, and done well, algorithmic screening solves a real throughput problem. What it demands is treating your hiring stack the way you'd treat any other system that makes consequential decisions about people: with documentation, testing, and a chain of accountability you could produce in discovery, because increasingly, you might have to.

That means knowing (in writing, not "the vendor said it's fine") what your screening and ranking tools optimize for, and what proxies they might be using for protected characteristics without anyone intending it. It means auditing outcomes by demographic group on a real cadence, not a one-time vendor assurance at contract signing. It means reading your vendor contracts for who bears liability, indemnification, and audit cooperation, because "the vendor is responsible for compliance" is a sentence that just got a lot less legally meaningful. It means keeping a human genuinely in the decision loop, not a rubber stamp on an algorithmic recommendation, because "meaningful human review" is now a specific requirement showing up in state law, not a nice-to-have. And it means treating every state's disclosure and audit requirements as your floor, not your ceiling, because the compliance bar is being set state by state, court ruling by court ruling, and the states are not waiting for each other to agree.

The employers who get hurt in this next phase won't be the ones who used AI in hiring. Nearly everyone did. It'll be the ones who never asked what it was doing, assumed the vendor's compliance page was a legal defense, and found out in a deposition that "we didn't know" was never going to be the shield they thought it was.