What happens if an AI-influenced hiring decision gets legally challenged?

An AI-influenced hiring decision has already been challenged in federal court, and the case didn't get dismissed.

In Mobley v. Workday, a judge let age discrimination claims move forward past the company's motion to dismiss. The judge also authorized formal notice to a class covering everyone 40 or older who applied through the platform since September 2020. And the court allowed a theory that would have sounded like a stretch a few years ago: a hiring vendor's AI system can itself be treated as the employer's agent for discrimination purposes.

Court filings in the case reference roughly 1.1 billion job applications processed through the platform during that window. Whatever happens next in that specific case, one thing is already clear: a legal challenge to an AI-influenced hiring decision is no longer a hypothetical question.

Employers already sense this shift. Littler's 2026 Annual Employer Survey, drawing on more than 300 U.S. C-suite executives, in-house counsel, and HR leaders, found 79% expect AI-related litigation is possible in the next 12 months, and discrimination or bias was the single most-cited legal concern behind data privacy.

A quick note before we go further: Tier8 isn't a law firm, and nothing here is legal advice. This is our read on where the law and the litigation actually stand in 2026, and what it means for how you implement AI in hiring.

What actually happens once a challenge is filed

A challenge to an AI-influenced hiring decision rarely stays a dispute about one candidate. Once litigation starts, both the employer and the vendor whose tool touched the decision are typically named, on the theory that a vendor performing a hiring function is acting as the employer's agent, not a neutral outside supplier.

Discovery then reaches past the individual rejection into the tool itself: what data trained or informed it, what criteria it weighted, and how consistently it produced the same pattern across every applicant who looks like the plaintiff, not just the one who complained. That last part usually turns into a statistical check: did the tool reject people in this group more often than it rejected everyone else?

In other words, this means the case stops being about one candidate's rejection and becomes about a pattern across everyone the tool ever screened. None of this depends on whether anyone intended to discriminate. It depends on what the pattern actually shows and what record exists of how the decision got made.

The part that decides how the conversation goes

In the governance and steering committee structures I've been part of, documenting the rationale behind a decision was never optional. Every consequential call needed a written record of what was considered, who signed off, and why the outcome landed where it did. It was a simple decision log but was a record we could go back to. That discipline wasn't built with litigation in mind. It existed so a decision could be explained months later to someone who wasn't in the room when it happened: a new team member, an internal auditor, a leadership review.

HR teams already do a version of this. Interviewers take notes, hiring managers talk through why one candidate beat another, and some version of the rationale usually exists somewhere, even if it's informal and scattered across emails or a shared drive. What changes once an AI tool is making or influencing the screening decision is that this note-taking has to become formal and consistent. The informal version that worked when a person made every call doesn't hold up the same way once a tool is doing part of the screening at scale.

That's the exact muscle a legally challenged hiring decision tests. An organization that can already produce a clear record of what happened and why is having a hard conversation. One that can't is often trying to reconstruct, after the fact and under pressure, a decision nobody wrote down the first time.

What ends up under scrutiny once a challenge is filed

1. Whether a documented rationale exists for the outcome, not just a score the tool produced. A number without a record of what it meant or who acted on it doesn't explain a decision to anyone.
2. Whether the vendor contract assigns liability, or quietly leaves it with you. A 2025 Stanford Law analysis of AI vendor contracts found 88% of AI vendors cap their own liability, often at the value of the subscription fee, while only 17% offer any warranty of regulatory compliance. Most of that gap lands on the employer by default, not by negotiation.
3. Whether a human was meaningfully involved, not just nominally present. A reviewer who rubber-stamps every recommendation the tool produces is a formality, not a safeguard, and that distinction tends to matter once a court is asking about it.
4. Whether the tool's pattern holds up under a disparate-impact test run across the whole applicant pool, not just the flagged case. A tool can look neutral on any single decision and still produce a skewed pattern in aggregate.

The legal landscape is a patchwork, not a gap

Original Tier8 diagram, built in SVG (vector) at 1200x1200 to match the Insights image style standard.

Federal guidance on AI in hiring didn't get stronger in 2026, it got thinner. The EEOC withdrew its formal AI-hiring guidance in early 2025 under the new administration, and no replacement has taken its place. But withdrawn guidance isn't the same as no law. Title VII, the ADA, and the ADEA still apply to a hiring decision whether or not AI was involved in making it, and Mobley is being litigated entirely on that existing statutory ground, not on guidance that no longer exists.

States are filling the visible gap at different speeds. New York City's Local Law 144 already requires an independent bias audit before an automated hiring tool gets used. Illinois' HB 3773 took effect January 1, 2026, extending the state's existing human rights law to AI-assisted employment decisions. Colorado's broader AI Act, by contrast, got stayed by a federal court in April 2026, with a narrower replacement bill not set to take effect until January 1, 2027, if signed into law. Three states, three different postures, in the same calendar year.

Enforcement doesn't close that gap as cleanly as a rulebook suggests, either. A New York State Comptroller's audit of Local Law 144 enforcement found the city agency responsible for checking employer compliance identified just one issue of non-compliance across 32 companies reviewed, while an independent audit of those same companies found 17, roughly six percent of what was actually there. A quiet enforcement record doesn't mean a low-risk practice. It can just as easily mean nobody's looked closely yet.

What this means in practice: there's no single national rulebook to check your process against, and a quiet enforcement record in your state doesn't mean your hiring tool is compliant or safe. The patchwork puts the burden back on each organization to look at its own practices directly, rather than waiting for a regulator to flag the problem first.

What your own file would show if someone asked today

• If we had to reconstruct why a specific candidate was screened out, could we, using records that already exist, or would we be starting from nothing?
• Does our vendor contract say who's liable if the tool's pattern turns out to be discriminatory, or does that risk sit entirely with us by default?
• Has anyone actually run a disparate-impact check across our applicant pool, or are we assuming the tool is neutral because no one's complained yet?

None of that guarantees a challenge is coming. It just determines what the organization would actually have to work with if one did.

Where governance and legal exposure meet

Security & Risk is one of the five pillars the RAISE OS™ AI Maturity Assessment measures on its own, separate from Responsibility & Governance, because a company can have reasonably clear ownership of AI decisions and still be carrying legal exposure nobody has actually tested. Ownership answers who's accountable for an AI-assisted decision; what a legal challenge tests is whether that accountability ever produced a record anyone can stand behind.

That's not a pass/fail security check, it's a broader read on how prepared your organization actually is across all five pillars.

Find out where your organization actually stands