A Vendor, Not Just an Employer, on the Hook
On June 22, 2026, Judge Rita F. Lin of the U.S. District Court for the Northern District of California denied most of Workday's motion to dismiss in Mobley v. Workday, letting age-discrimination claims over its AI applicant-screening tools proceed under the Age Discrimination in Employment Act (ADEA), and — more consequentially — letting California Fair Employment and Housing Act (FEHA) claims reach Workday itself, not merely the employers who bought its software (EEOC amicus filing, case 3:23-cv-00770; Duane Morris summary).
The court's reasoning is narrow but sharp: Workday allegedly designs, develops, and operates its screening algorithm from its California headquarters, so the discriminatory decision-making "originates in and is carried out from" the state — enough to establish a FEHA nexus even for applicants who applied to jobs elsewhere. On the merits, the court treated Workday as potentially liable as an employer's "agent," a theory that puts the vendor's own conduct — designing and running the model — on trial, not just the hiring company's use of it (HR Executive).
Why the Agent Theory Has Purchase
The steelman here is straightforward. Workday's tools reportedly processed roughly 1.1 billion job applications during the period at issue — a scale no single employer's HR department could replicate manually, and one where a biased scoring model could quietly disadvantage older or disabled applicants across thousands of companies simultaneously. Disparate-impact liability exists precisely for harms like this: diffuse, statistical, and invisible to any one decision-maker. If liability stopped at the employer's door, a vendor could sell a discriminatory tool to a thousand companies and face no exposure at all, while each individual employer could plausibly claim it never audited what it bought. The EEOC evidently saw enough at stake to file an amicus brief in the case back in April 2024, addressing Title VII, ADEA, and ADA theories together — a sign career staff viewed vendor-side algorithmic screening as squarely within existing civil-rights statutes, not a novel category requiring new legislation.
California's own regulators reached a similar judgment on a separate track. The Civil Rights Council's automated-decision-system regulations, approved June 27, 2025 and effective October 1, 2025, extend FEHA liability to any "agent" — defined as anyone exercising a FEHA-regulated function like screening or hiring on an employer's behalf — and require four years of retained automated-decision records (California Civil Rights Department). Judge Lin's ruling and the CRD's rulemaking are, in effect, converging on the same conclusion through different institutions: software vendors that build and operate the decision engine are not neutral pass-throughs.
The Case for Caution
But there is a real cost to letting courts set this rule case-by-case rather than through clear, prospective standards. AI hiring vendors now serve as the connective tissue for an enormous share of U.S. recruiting; if every large customer's discrimination suit can also name the platform vendor under an evolving "agent" theory, litigation exposure scales with market share rather than fault, which pushes toward fewer, larger incumbents who can absorb the risk — the opposite of the competitive vendor market that produces better, more auditable tools. Discovery in this case has already required Workday to hand over EEO-1 and OFCCP compliance data, a burden smaller AI-hiring startups are far less equipped to bear than an enterprise incumbent.
The deeper problem is the vacuum this litigation is filling. The EEOC pulled its 2023 technical-assistance guidance on assessing adverse impact in AI hiring tools from its website in January 2025, following the new administration's rollback of Biden-era AI policy. With no federal safe harbor or bias-testing standard, states have written their own, divergent rules — California's disparate-impact/vendor-liability framework, Illinois's private right of action, Colorado's NIST-anchored "reasonable care" standard, Texas's intent-only approach. A company selling hiring software nationally must now satisfy at least four incompatible legal theories simultaneously, with no federal baseline to reconcile them (National Law Review). That patchwork, not vendor accountability itself, is the innovation-chilling problem — and it is a predictable consequence of Washington abandoning the field rather than replacing prescriptive guidance with a lighter, clearer one.
What Should Follow
Mobley does not resolve whether Workday's tools actually discriminated; it only clears the pleading bar, and the case is far from a merits verdict. But it confirms that vendors, not just employers, are now a live target under existing civil-rights law when they design and operate the algorithm rather than merely license it. The parallel EFF has drawn between automated content moderation and other automated decision systems applies here too: as automation scales a function, accountability structures have to scale with it, or victims of systemic errors have no one to sue (EFF). The fix isn't to block vendor liability outright — Judge Lin's reasoning is sound on the facts alleged — but for Congress or the EEOC to replace the guidance it withdrew with a clear, proportionate bias-testing safe harbor, so vendors face one predictable standard instead of fifty state experiments decided one motion to dismiss at a time.