Your Hiring Software's AI Just Became Your Compliance Problem

"If the applicant tracking system rejected the candidate, who actually gets sued?" Owners and HR leaders ask us some version of that question whenever AI screening comes up, usually hoping the answer is "the software company." It is not that simple, and for employers it has not been that simple for a while.

AI hiring software compliance is the employer's obligation, even when a vendor built the algorithm. Federal and state anti-discrimination laws apply to the hiring decision, not to who wrote the code. Recent rulings have made vendors potential co-defendants, but that adds a defendant to the case. It does not remove the employer from it.

Here is the uncomfortable part. Many business leaders read the headlines about Mobley v. Workday and concluded that liability was shifting toward vendors, so their own risk had dropped. We read it the opposite way. The court's reasoning rests on the idea that AI screening performs a traditional hiring function. Hiring functions belong to the employer, and every state rule written since points the same direction: the employer must be able to show what the tool did and why the outcome was fair.

What did Mobley v. Workday actually decide?

Mobley v. Workday has not decided whether Workday's tools discriminate. What it has decided, so far, is that the claims are serious enough to proceed and that an AI vendor can face direct liability. In July 2024, Judge Rita Lin of the Northern District of California allowed the plaintiff's agent theory to go forward, finding it plausible that Workday's customers "delegated their traditional function of rejecting candidates or advancing them to the interview stage to Workday," according to Seyfarth Shaw's analysis of the July 2024 ruling.

The case then grew. The court granted preliminary certification of an age discrimination collective in May 2025, and in July 2025 it held that the collective includes applicants scored, sorted, ranked, or screened using Workday's HiredScore AI features. That July 29, 2025 order on the HiredScore dispute directed the parties to set a timeline for Workday to produce a list of customers that enabled those features. In June 2026, the court largely allowed the plaintiffs' California and ADA claims to proceed, including allegations that algorithms may screen out applicants through proxy indicators such as gaps tied to medical leave, as summarized in Duane Morris's review of the June 22, 2026 order.

The lesson for an employer is concrete. Your company does not need to be a named defendant to be pulled into this kind of case. If your organization turned on a vendor's AI scoring feature, your name can end up on a customer list produced in discovery, and your applicants can end up in a collective. The questions that follow are ones only you can answer: which features you enabled, how your recruiters used the scores, and whether a person meaningfully reviewed who was rejected.

Can my business be liable for discrimination caused by my vendor's AI?

Yes. Title VII, the ADA, and the Age Discrimination in Employment Act apply to employment decisions whether a recruiter or a scoring model made the first cut, and several jurisdictions have now written AI-specific obligations on top of those laws. Buying the tool from a reputable vendor does not transfer the duty.

California moved first at the state level. The Civil Rights Council's regulations on automated-decision systems in employment, effective October 1, 2025, confirm that an automated-decision system can violate California law when it harms applicants or employees based on protected characteristics, add a definition of "agent," and require employers to keep employment records, including automated-decision data, for at least four years. Illinois followed with HB 3773, which took effect January 1, 2026 and, as an Illinois Human Rights Commission training session on the new law explains, amends the Illinois Human Rights Act to prohibit employers from using AI in a way that results in workplace discrimination. In New York City, Local Law 144 on automated employment decision tools has required a bias audit within one year of use, public audit information, and candidate notice since enforcement began in July 2023.

Colorado is next. SB 26-189 on automated decision-making technology, signed May 14, 2026, replaced the original Colorado AI Act. Starting January 1, 2027, deployers must give notice when covered technology is used, explain its role within 30 days of an adverse decision, offer meaningful human review, and keep compliance records for at least three years. Developers must hand deployers documentation on intended uses, training data categories, known limitations, and human review. Timing is still moving: McDermott Will & Schulte reports that the state attorney general agreed not to enforce the law until rulemaking concludes and a pending preliminary injunction motion is resolved. That is a reason to prepare carefully, not a reason to wait. For a state-by-state breakdown, our AI Lab covers the details in how Illinois, California, and Colorado rewrote the rules for AI in hiring.

Why AI hiring software compliance comes down to evidence

Look across all of these rules and one requirement keeps repeating: be able to show your work. Four years of automated-decision data in California. Three years of compliance records in Colorado. Bias audits and notices in New York City. An explanation of the technology's role after an adverse decision. Every one of these assumes the employer can produce records about a system it did not build and often does not fully see into.

This is where most small and mid-sized employers are weakest. The applicant tracking system was purchased by HR, configured by the vendor's onboarding team, and has picked up AI features through updates. The scoring data lives in the vendor's cloud, under retention settings nobody at your company chose. If a complaint arrives, the first request from your attorney will be for exactly the records you may not have.

We see the same pattern in healthcare, where a breach at a business associate still lands on the covered entity, a dynamic we unpacked in why your billing vendor's breach is still your HIPAA problem. Outsourcing the function does not outsource the accountability. AI hiring tools follow the same logic, and the fix is the same: treat the vendor as part of your compliance program, with documented expectations, rather than as a black box. Our AI Lab explains why ordinary system logs rarely satisfy that burden in why application logs cannot defend an AI decision to a regulator.

What should we ask our HR software vendor before the next renewal?

Ask which features in your account score, rank, filter, or reject candidates, whether each is switched on, and what evidence exists that each was tested for bias. Then ask how you would retrieve that data if a regulator or court asked for it. Get the answers in writing, because a sales call is not evidence. A complete request covers:

• A list of every AI or automated scoring feature, and its current on or off status in your tenant
• The most recent bias audit or adverse impact testing: who performed it, when, and on what population
• Documentation of intended uses, known limitations, training data categories, and recommended human review steps
• Advance notice commitments for material model updates or new screening features
• Retention and export of scoring and decision data for at least the longest period your jurisdictions require
• The vendor's obligation to cooperate, and provide records, if your company faces a charge or lawsuit

Is this worth the effort for a small employer?

Yes, because the exposure scales with the tool, not with your headcount. A 60-person company using the same off-the-shelf screening features as a Fortune 500 employer is running the same model against its applicants. New York City's rule applies to employers and employment agencies using covered tools, and remote hiring means you may be recruiting in jurisdictions you have never thought of as yours.

The practical burden is also smaller than it sounds when you build it once. A short quarterly sequence covers most of the ground:

1. Inventory every hiring tool that screens resumes, ranks candidates, schedules interviews based on scoring, or runs automated assessments.
2. Switch off AI features you are not deliberately using, and document the decision.
3. Define where a person reviews AI-influenced rejections before they become final.
4. Draft candidate notice language for each jurisdiction where you hire, and review it with employment counsel.
5. Set retention for decision data to your longest legal requirement and test that you can export it.

That cadence fits naturally into the broader discipline described in how regular compliance audits prevent costly failures, and into the vendor oversight work in protecting your business from vendor vulnerabilities. Without that governance layer, as we have argued before, AI without governance is simply risk.

How Securafy helps

Hiring compliance sits between HR, legal, and IT, which is why it often belongs to no one. We work alongside your HR leader and employment counsel on the technical side: identifying which AI features are actually enabled across your hiring stack, confirming where scoring data is stored and how long it is kept, and setting up retention and export so the records exist when you need them. Where a vendor's answers are vague, we help translate technical gaps into specific written requests.

For regulated firms, we fold this into the same compliance program that already covers HIPAA, financial safeguards, or client security requirements, so AI hiring tools get reviewed on a schedule instead of only after a complaint. Counsel decides the legal position. We make sure the evidence behind it is real.

Where To Go From Here

If an AI feature touches who gets interviewed at your company, the obligation to explain and document that decision is already yours. The firms that handle this well are the ones that know what their tools do before anyone asks.

If you want help building the records, vendor reviews, and audit rhythm that hiring compliance now demands, Securafy Comply Care gives your team an ongoing compliance program instead of a one-time scramble.

If you would rather talk through your specific environment first, book a strategy call with Securafy and we will walk through your hiring stack, where the evidence gaps are, and what to fix first.