The assumption that your screening vendor owns the legal risk is quietly collapsing. Recent case law and enforcement are moving the exposure onto employers, and “the software did it” is no longer a defense.
Most Heads of Talent carry an assumption that has quietly stopped being true: if you bought your screening tool from a vendor, the vendor owns the legal risk. You licensed software. They built it. Their problem.
Three years of enforcement and case law have dismantled that. The exposure is landing on employers, and increasingly on the people who run hiring.
The vendor defense is collapsingYour risk now
Start with the case everyone in talent should know by name. In Mobley v. Workday, a federal court allowed discrimination claims to proceed by treating the software vendor as an “agent” of the employers using it, not a neutral tool provider, but a party performing a hiring function. In 2025 the court conditionally certified a nationwide age-discrimination collective potentially covering millions of applicants.
The significance is not that a vendor got sued. It is the theory: the algorithm was performing the employer's hiring, so its output is the employer's decision. “The software did it” stops being a defense the moment the software is treated as you.
Enforcement is no longer hypothetical
The EEOC has already put a number on it. In EEOC v. iTutorGroup, the agency reached its first AI-hiring discrimination settlement, $365,000, over software configured to automatically reject applicants above a certain age. No trial needed for the lesson to land: an automated rule that produces a discriminatory pattern is a Title VII problem with a price tag.
And the measurement is something a plaintiff can run on your own data. The EEOC assesses AI selection tools under the four-fifths rule: if any protected group's selection rate falls below 80% of the top group's, that is a flag for adverse impact. You do not get to argue intent. The ratio speaks.
The map keeps adding jurisdictions
This is not one rule in one place. It is a widening patchwork.
New York City's Local Law 144 requires annual independent bias audits of automated employment decision tools, with the impact ratios published. Illinois, Colorado, and New Jersey are building on that model. And the EU AI Act classifies hiring and selection AI as “high-risk,” pulling in transparency, human-oversight, and documentation obligations for anyone operating there.
The trajectory only points one way. Each year adds a jurisdiction, a precedent, or an enforcement action, and every one of them converts your screening tool's output into your exposure.
What this means for how you run hiring
The through-line across all of it is a single capability: you have to be able to explain, and if necessary defend, any individual hiring decision. Not the vendor's model in the abstract, the specific call on the specific candidate.
That means knowing what evidence a rejection rested on, being able to show a human reviewed it, and being able to audit your outcomes for adverse impact before a regulator or a plaintiff does it for you. “We trusted the vendor” is not an answer to any of those. “Here is the evidence, here is who reviewed it, here is our impact ratio” is.
So, who is liable when AI screening discriminates?
Increasingly, you are, and possibly your vendor alongside you, but that does not get you off the hook. The agent theory, the first settlement, the four-fifths math, the audit mandates, and the high-risk classification all converge on the same expectation: account for your hiring decisions.
The teams that will be fine are not the ones with the most cautious vendor contract. They are the ones who can open any decision and show what it was based on.
When a decision is questioned, you need to open it and show what it rested on. Confeti binds every claim to a specific moment in the interview, with speaker, timestamp, and quote, so each hiring decision has an inspectable evidence trail and a human accountable for it.
See how it worksCommon questions
Who is liable when an AI hiring tool discriminates?+
Increasingly the employer, and potentially the vendor too. In Mobley v. Workday a court treated the vendor as an 'agent' of employers, meaning the tool's output is treated as the employer's hiring decision.
Has anyone actually been penalized for biased AI hiring?+
Yes. In EEOC v. iTutorGroup the EEOC reached its first AI-hiring discrimination settlement, $365,000, over software that automatically rejected older applicants.
What is the four-fifths rule?+
An EEOC adverse-impact test: if a protected group's selection rate is below 80% of the highest group's rate, it flags potential discrimination. It can be calculated from your own hiring data.
What does NYC Local Law 144 require?+
Annual independent bias audits of automated employment decision tools, with impact ratios published. Illinois, Colorado, and New Jersey are building on the model, and the EU AI Act classifies hiring AI as high-risk.
How do we reduce AI hiring legal exposure?+
Be able to explain any individual decision: what evidence it rested on, that a human reviewed it, and what your adverse-impact ratios are. 'We trusted the vendor' is not a defense.
References
- Mobley v. Workday, N.D. Cal. — agent-liability ruling (2024) and ADEA collective certification (2025), via Reuters and Jones Walker LLP. link
- EEOC v. iTutorGroup — first EEOC AI-hiring discrimination settlement ($365,000); EEOC technical guidance on AI under Title VII. link
- NYC Local Law 144 — Automated Employment Decision Tools, NYC Department of Consumer and Worker Protection. link
- EU AI Act — high-risk classification of AI hiring systems (2024). link