AI hiring tool liability is the question of who pays — and who must explain the process — when an automated screen allegedly disadvantages applicants by race, sex, age, or disability. In plain terms it splits into two roles: the vendor (developer of the ranking or scoring product) and the deployer (the employer who puts that product into the hiring funnel). Courts, contracts, and state AI statutes increasingly treat those roles as distinct. Marketing language that says “our model is fair” does not erase Title VII-style disparate-impact risk for the company that decided to use the tool on real candidates.
In September 2026 that split stopped being theoretical. Reuters coverage of Mobley v. Workday framed the live fight as whether applicants can chase the platform that scored them across many employers — not only each employer one by one. Plaintiffs asked a San Francisco federal court to certify subclasses covering African American, female, over-40, and disabled applicants screened by Workday’s AI tools. Opposition is due 10 November 2026; the class-certification hearing is set for 9 March 2027. No court has found discrimination. Buyers still need a working answer to: if this pattern shows up in our funnel, who owns the evidence trail?
This piece is buyer guidance for HR, TA, and counsel — not legal advice and not a second fairness checklist. For the operating checklist (inventory, disclose, human override, monitor), use responsible AI in hiring. Here the job is sharper: vendor vs deployer questions after Workday, plus when to prefer openable work evidence such as Dotof AI Role-Simulation Assessments over opaque CV ranks.
What is the difference between vendor and deployer liability?
A vendor designs, trains, hosts, or substantially modifies the automated employment decision tool. A deployer is the employer (or agency) that turns the tool on for applicants in a jurisdiction. In litigation, plaintiffs may sue vendors as agents or as platforms that effectively sorted them; regulators often still put notice, impact assessment, and human-review duties on deployers. Contracts try to push duties one way or the other — but waivers that pretend the deployer has zero employment-law exposure are a fantasy. If your ATS auto-rejects people before a human sees the file, your company chose that threshold.
Practical buyer rule: assume you remain accountable for how the tool is used in your process, even when the vendor faces its own claims. Ask for score-data access, adverse-impact methodology, and audit cooperation in writing — not a one-pager that says “bias tested.”
Why does Mobley v. Workday matter to buyers who never used Workday?
Because the theory travels. If courts allow class treatment of applicants screened by a common AI feature across many employers, every high-volume screening vendor becomes a potential focal point — and every deployer still has to show job-related criteria, human gatekeeping, and monitoring of its own funnel. Reuters reported that co-lead plaintiff Derek Mobley alleged more than 100 rejections, often within hours, at companies using Workday’s AI hiring tools. Whether or not those claims succeed, TA leaders will face board questions that sound like: “Are we the next caption?”
Separately, Connecticut’s Artificial Intelligence Responsibility & Transparency framework phases deployer duties for high-risk systems used in consequential employment decisions — risk-management policy and impact assessments beginning around 1 October 2026, with richer applicant notice tracks later. Inventories and human-appeal paths are not “nice to have” in that environment; they are how you answer counsel on a Friday afternoon.
Which questions should HR ask before buying another AI screen?
- Does this tool auto-reject, or only advise? Silent knockouts need the strongest job-related justification and sampling of false negatives.
- Can we export scores, thresholds, and model/version IDs? If the vendor will not share data for independent review, you cannot monitor impact.
- Who is named as the human override owner? “Approve all” is not oversight — see AI screening vs human judgment.
- What exactly is scored? Résumé language proxies are harder to defend than a task a manager can open.
- What happens on a candidate challenge? You need an alternative path and a log of interventions.
- Does the contract allocate notice and audit duties clearly? Developer-to-deployer information flow matters under state AI statutes; do not assume the vendor will appear in court for you.
When should we use work samples instead of opaque AI screens?
Use a work sample or role simulation when the decision is high-stakes, the screen is hard to explain, or counsel asks what evidence proves the person can do the job. Opaque “fit” ranks from CVs and chat answers are convenient; they are also what plaintiffs and auditors dig into first. A short, JD-native task — scored against a versioned rubric, with a human deciding who advances — gives you an artifact you can open in a debrief. That is the point of AI Role-Simulation Assessments: measure job-related work, keep humans accountable, and reduce reliance on résumé proxies that travel poorly under disparate-impact scrutiny.
You do not need to throw away light matching as advice. You do need a gate before deep interviews where the score is of something real. Pair that with the practices in the responsible AI checklist rather than rewriting it here.
What should lean teams do this quarter?
- Inventory every ranking, scoring, or auto-advance tool in the funnel — including “smart” ATS features.
- Classify each as advise-only vs auto-reject; turn off silent rejects you cannot defend.
- Demand vendor packets: methodology, data access, accommodation paths, training-use of candidate data.
- Add one simulation gate on a pilot role so managers review work, not only language models of résumés.
- Brief leadership with the Workday timeline (opposition Nov 2026 / hearing Mar 2027) so risk appetite is explicit — not discovered in a deposition.