.png)
When AI Decides Who Gets Hired: AI Governance Case Study on Mobley v. Workday
- Vimal Rughani
- Aug 6
- 8 min read
If your company is relying on AI-driven tools for resume screening, matching candidates’ skills, or running automated assessments, the case Derek Mobley v. Workday, Inc. is something you can’t afford to overlook.
Case refer about Derek Mobley who got automatically rejected over 100 jobs by companies AI bots software, without even getting an interview, even thought he was qualified candidate !
Mobley v. Workday, Inc. is not merely a lawsuit. It is a case study in what happens when AI systems are deployed at enterprise scale without adequate governance, transparency, or accountability frameworks. Case Study reveals about an industry-wide blind spot: the assumption that automating a decision makes it neutral. But It does not !
The Case: What Happened and Why It Matters
Background
Derek Mobley is an African American man, over the age of 40, who lives with anxiety and depression. He holds a bachelor's degree and has professional experience at well known organization. He was laid off from his job in 2017, he turned to digital hiring platforms to find his next job. Between 2017 and 2023, Mobley applied to more than 100 positions through companies using Workday's talent acquisition platform. He was rejected every single time, including one rejection documented at odd time 1:50 a.m. He got rejection email written by AI bot and he found something wrong !
On February 21, 2023, Mobley filed suit in the U.S. District Court for the Northern District of California against Workday, Inc., alleging that its AI-powered applicant screening tools discriminated against him — and a class of similarly situated individuals — on the basis of race, age, and disability.
The Technology at the Centre of the Dispute
To understand the governance failure here, you need to understand what Workday's platform actually does — and how its AI tools interact with the hiring process.
Workday provides human capital management (HCM) software on a subscription basis. Its platform collects and processes job applications, and through machine learning and
AI-based tools, it scores, ranks, and sorts candidates — effectively determining who gets forwarded to a human recruiter and who gets an automated rejection.
The plaintiff's complaint alleged that Workday's tools use artificial intelligence, machine learning, assessments, tests, and pymetrics to make these recommendations — and that the criteria these models learned to prioritise are, whether intentionally or not, correlated with protected characteristics like race, age, and disability status.
This is the essence of algorithmic bias through disparate impact: the system was not explicitly told to favour younger, non-disabled, white candidates. It learned to do so, almost certainly by training on historical hiring data that already reflected decades of human bias.
What Makes This Case a Governance Failure, Not Just a Legal One
It would be easy to read Mobley v. Workday as a story about a bad actor — a company that knowingly built discriminatory AI. That framing would be both unfair and, more importantly, misleading.
The more uncomfortable truth is that what allegedly happened here is entirely predictable in the absence of robust AI governance. Here is why:
1. Historical Data Encodes Historical Inequality
Machine learning models learn from patterns in data. If an organisation's hiring data over the past 20 years shows that most successful hires were white, non-disabled, and under 40 — because of pre-existing human bias — then a model trained on that data will learn to replicate those patterns.
This is not a bug in the code. It is a fundamental property of how supervised learning works. Governance frameworks exist precisely to detect and correct this before systems reach production.
2. Proxy Variables Create "Race-Neutral" Discrimination
A University of Washington study found that AI resume screening models preferred candidates with white-associated names in 85% of cases and Black-associated names only 9% of the time — even when qualifications were identical. The models were not given race as an input.
As Johns Hopkins computer science professor Mark Dredze noted: "Where we live, what we do for a living, what type of activities we engage in, what we purchase, even our names all have correlations with race. Not telling an algorithm a person's race doesn't prevent it from inferring that information from countless other things it may know about us."
This is the governance challenge that no single bias audit can fully solve — but that ongoing monitoring, explainability requirements, and disparate impact testing can meaningfully reduce.
3. Scale Transforms Individual Errors into Systemic Harm
Workday's platform screens applications for over 10,000 organisations worldwide. The sheer scale of its deployment means that even a modest bias rate — something that might be a statistical rounding error in a small organisation — becomes a mechanism of systemic exclusion affecting potentially millions of people.
AI governance frameworks specifically address this: the scale of an AI system must inform the rigour of its oversight. High-volume, consequential decisions affecting protected classes require the highest levels of audit, explainability, and human review.
4. Vendors Cannot Outsource Accountability — and Neither Can Buyers
One of the most significant governance lessons from this case is the court's rejection of Workday's "we're just the tool" argument. This has direct implications for every organisation that has ever signed a vendor contract for an AI hiring tool and assumed the liability rests elsewhere.
It does not. You are responsible for the outcomes of AI systems you deploy — regardless of who built them.
The Regulatory Landscape: The World Is Responding
Mobley v. Workday did not emerge in a vacuum. Governments are finally treating hiring AI as a high-risk technology that must be transparent and fair.
United States
NYC Local Law 144 (AEDT Law) — Effective July 2023. Requires independent bias audits of AI hiring tools before deployment, mandatory candidate notification, and public disclosure of audit results. : https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page
Illinois House Bill 3773 — Signed August 2024. Requires employer disclosure when AI is used in hiring, promotion, or termination decisions. Prohibits the use of zip codes as proxies for protected classes. : https://legiscan.com/IL/bill/HB3773/2023
Colorado AI Act — Effective 2026. Requires annual impact assessments and transparency requirements for high-risk AI deployments. : https://leg.colorado.gov/bills/sb24-205
European Union
The EU AI Act (Regulation 2024/1689), which entered into force on August 1, 2024, explicitly classifies AI systems used in recruitment and employment as high-risk under Annex III, Category 4. Full enforcement applies from August 2, 2026.
Under the EU AI Act, all AI hiring tools deployed in EU markets must meet six mandatory requirements:
Risk Management — Documented, continuously updated risk assessment processes
Data Governance — Training data must be representative, with bias controls in place
Technical Documentation — Full traceability from model design through deployment
Transparency — Candidates must be informed when AI is used in hiring decisions
Human Oversight — Human review must be possible and meaningful, not perfunctory
Accuracy and Robustness Testing — Ongoing performance monitoring across demographic groups
International Standards
ISO/IEC 42001 — The emerging international enterprise standard for AI management systems, now increasingly required in vendor procurement processes globally. Reference
NIST AI Risk Management Framework (AI RMF 1.0) — Structured AI risk management, providing a practical methodology that organisations can implement alongside regulatory requirements. :
What Good AI Governance Would Have Looked Like
This is not an abstract question. There are concrete practices — most of them well-established in responsible AI literature — that, if applied before deployment, could have substantially mitigated the risks now playing out in court.
Pre-Deployment
Disparate Impact Testing Before any AI hiring tool goes live, it must be evaluated across all protected-class dimensions: race, ethnicity, gender, age, disability status, and their intersections. Selection rates for each group should be compared against the majority group. Ff a protected group's selection rate falls below 80% of the highest-selected group's rate, that constitutes evidence of adverse impact.
Training Data Audits Who are the "successful hires" in your historical data? What were their demographic characteristics? Were there structural barriers — in the era that data was collected — that artificially skewed who was hired? These are governance questions that must be answered before a model is trained, not after it is deployed.
Vendor Due Diligence If you are procuring an AI hiring tool, your contract should require: (a) documented evidence of bias testing, (b) access to model performance metrics by demographic group, (c) explainability of how individual decisions are made, and (d) clear contractual allocation of liability for discriminatory outcomes.
During Deployment
Human-in-the-Loop Requirements AI should support hiring decisions, not make them. A recommendation system that can reject a candidate in 47 seconds at 1:50 a.m. without any human review is not a support tool — it is a decision-maker. Governance frameworks should require meaningful human review at every consequential decision point.
Ongoing Monitoring and Drift Detection A bias audit at deployment is necessary but not sufficient. Models drift over time as job markets, applicant pools, and organisational hiring patterns change. Governance frameworks must include continuous monitoring, with defined thresholds for intervention when demographic disparities emerge.
Candidate Transparency Applicants should know when AI is involved in reviewing their application. This is not just good governance — it is now a legal requirement in multiple jurisdictions.
Organisational Culture
Cross-Functional Governance Committees AI governance cannot live in the legal department or the IT function alone. Effective AI governance requires HR, legal, data science, ethics, and senior leadership working together — with clear escalation paths and documented accountability.
AI Literacy for Non-Technical Stakeholders Organisations must ensure sufficient AI literacy among people working with high-risk AI tools. Recruiters, HR managers, and hiring directors do not need to understand backpropagation. They do need to understand what an AI tool's outputs mean, where its limitations lie, and when to override it.
What Organisations Should Do Now
If you are deploying AI tools that affect people's livelihoods, housing, health, or financial lives, the time for reactive governance has passed. Here is a practical starting point:
1. Inventory Your AI Systems Identify every AI tool in your operational stack that influences decisions about people. Categorise by risk level. Prioritise high-volume, high-consequence systems.
2. Conduct Bias Audits — Now, Not at Renewal Do not wait for a regulatory mandate or a lawsuit. Commission independent bias audits for any AI system that scores, ranks, or filters people. Document the results.
3. Review Your Vendor Contracts Your contracts should explicitly address: AI liability allocation, data governance requirements, access to model documentation, and your right to audit the vendor's systems. If they don't, renegotiate.
4. Implement Meaningful Human Oversight Define what "human review" actually means for each AI-assisted decision. A human clicking "confirm" on an AI recommendation without reading the underlying materials is not human oversight — it is liability without accountability.
5. Build a Governance Framework Aligned to Multiple Jurisdictions If you operate globally or use global vendors, design your governance framework to meet the most stringent applicable requirements — currently, the EU AI Act and NYC Local Law 144. What satisfies the strictest standards will generally satisfy the rest.
6. Document Everything In litigation, the question is not only "did your AI discriminate?" — it is also "what did you know, and when did you know it?" Documented governance processes, audit results, and remediation actions are your best evidence of good faith.
My Reflection
Derek Mobley applied for more than 100 jobs. He received 100+ rejections. He may never have known — without this lawsuit — that a machine was the one making those calls.
That is the quiet danger of ungoverned AI. It does not announce its failures. It does not leave a paper trail that points to bias. It simply produces outcomes that mirror historical injustice, at the speed of computation, and at the scale of enterprise infrastructure.
Mobley v. Workday is still being litigated. A merits decision could come in 2026, or the case may settle before then. But whatever its legal outcome, its governance lesson is already clear:
An algorithm that automates a biased decision does not fix the bias. It industrialises it.
AI governance is not a compliance exercise. It is the organisational discipline of ensuring that when we delegate decisions to machines — decisions that affect people's jobs, homes, health, and futures — we remain accountable for those decisions. The law is catching up rapidly. The ethical obligation was always there.
References :
Case Reference: Mobley v. Workday, Inc., Case No. 3:23-cv-00770, U.S. District Court for the Northern District of California : Case Summary
Harvard Undergraduate Law Review — AI As An Employment Agent: What Mobley v. Workday Addresses, and What It Doesn't
Bloomberg Law — AI's Racial Bias Claims Tested in Court as US Regulations Lag
NYC Local Law 144 (AEDT Law) : Reference
Illinois House Bill 3773 : Reference
Colorado AI Act : Reference
ISO/IEC 42001 : Reference
NIST AI Risk Management Framework (AI RMF 1.0) : Reference
Comments