Questions to Ask an AI Hiring Vendor: 12 Contract Clauses After Mobley v. Workday

Between 2017 and 2023, Derek Mobley, a Morehouse College finance honors graduate over age 40 with a disability, applied to more than 100 jobs at firms running Workday's applicant-screening platform and was rejected every single time, sometimes within minutes at 1:55 a.m. (Clearinghouse Case 44074). Many HR buyers initially assumed Mobley v. Workday concerned only software giants. Then US District Judge Rita F. Lin issued two landmark rulings in the Northern District of California: on July 12, 2024, she held an ATS vendor can be sued directly as an employer's "agent" when delegated screening duties (Maynard Nexsen), and on May 16, 2025, she certified a nationwide Age Discrimination in Employment Act collective covering rejected applicants aged 40+ from September 24, 2020 onward (Holland & Knight). By July 2025, Judge Lin ordered customer identification for Workday's HiredScore AI module so rejected applicants could receive opt-in notices.

Small and midsize employers feel this squeeze hardest because standard SaaS order forms disclaim compliance duties while burying auto-enabled AI ranking switches inside product updates. Only 26% of applicants in a Gartner candidate survey trust AI to evaluate them fairly, even as Gartner separately forecasts (as an analyst prediction, not a measurement) that 1 in 4 candidate profiles will be fake by 2028 (Personnel Today). Meanwhile, NY State Comptroller Thomas DiNapoli's December 2025 audit of n = 50 NYC job postings found 17 likely Local Law 144 violations (34% of the n = 50 sample) when the city had substantiated just 1 complaint (NY State Comptroller). Paired with our guide to candidate rights when screened by AI, this October 29, 2026 guide is operational procurement reference, not legal advice.

Why does an ATS vendor's "agent" liability still leave the employer on the hook?

Judge Rita Lin's agency rulings in Mobley v. Workday expanded who plaintiffs can sue, not who gets excused. Under federal and state employment law, agency liability runs both ways: if a software vendor acts as your agent when scoring resumes, the vendor's model counts legally as your own selection test unless you prove job-relatedness and business necessity.

Think of hiring a third-party security firm to check IDs at your restaurant door. If the bouncer bars patrons over age 40 using a secret checklist the security vendor wrote, a patron suing the security firm does not shield your restaurant from a civil-rights claim. You hired the gatekeeper and adopted the exclusion. Where that bouncer analogy breaks is invisibility: a floor manager sees a bouncer turning guests away, whereas an ATS silently demotes 800 resumes to "Unreviewed" at 2:00 a.m. while your recruiter only sees the top 15 names.

Three federal statutes anchor direct employer liability regardless of who built the model:

1. Title VII (42 U.S.C. s. 2000e-2(k)) & Uniform Guidelines (29 C.F.R. Part 1607): When a ranking score or knockout rule causes adverse disparate impact by race, color, religion, sex, or national origin, the employer must prove the tool is job-related and consistent with business necessity (eCFR Part 1607). Even after agencies removed non-binding AI explainers in early 2025 (NatLawReview), Title VII lawsuits remain fully live.
2. Americans with Disabilities Act (42 U.S.C. s. 12112(b)(6) & (b)(2)): Section 12112(b)(2) forbids contractual vendor relationships that subject applicants to disability discrimination, and Section 12112(b)(6) bars selection criteria that screen out or tend to screen out individuals with disabilities (such as resume-gap penalties or timed speech scorers) without business necessity and reasonable accommodation (GovInfo 42 U.S.C. 12112).
3. Age Discrimination in Employment Act (29 U.S.C. s. 623 & s. 626(b)): Protects applicants aged 40+ and enables nationwide opt-in collectives unless disparate impact rests on "reasonable factors other than age", which you cannot prove if your vendor hides graduation-date or tenure weights.

Which state and city AI hiring laws fine the employer directly in 2026 and 2027?

State and city AI statutes place duties for candidate notices, independent bias audits, human review, and 4-year logs directly on the deploying employer. Meanwhile, standard SaaS contracts cap vendor liability at 12 months of fees, and Colorado voids clauses shifting anti-discrimination liability.

• Illinois HB 3773 (in force Jan 1, 2026): Bars AI disparate impact and ZIP-code proxies and makes omitting candidate AI notice an independent violation (Hinshaw). Draft IDHR Subpart J rules require naming product, vendor, purpose, data, and ADA path, plus 4-year logs and fee-shifting. Use our Illinois HB 3773 fill-in notice.
• California FEHA ADS Rules (in force Oct 1, 2025): Cover employers with 5+ staff, codify vendors as "agents", treat missing bias tests as adverse evidence, and mandate 4-year retention of ADS data and scores (Mayer Brown).
• NYC Local Law 144 (Admin. Code s. 20-870): Requires an annual independent bias audit posted online plus 10-business-day candidate notice ($500 to $1,500/day) (NYC DCWP). Vendor whitepapers do not qualify.
• Colorado SB 26-189 (signed May 14, 2026; eff. Jan 1, 2027): Requires pre-decision ADMT notice, 30-day plain-language adverse explanations with human review, 3-year logs, and voids indemnity clauses shifting statutory anti-discrimination liability (Legal 500). See our Colorado SB 26-189 checklist.
• Massachusetts (M.G.L. c. 149, s. 19B & c. 93A): Bars devices assessing honesty ($500 minimum plus treble wages) and mandates a job-application disclaimer (MA s. 19B). See is AI hiring legal in Massachusetts.

What hidden product traps turn a routine ATS subscription into a lawsuit?

Small employers rarely set out to buy discriminatory AI; instead, existing payroll or ATS suites quietly activate "Smart Rank" or "Recommended Talent" toggles during routine updates:

1. Silent default sorting: Sorting 250 applicants by "AI Match Stars" so recruiters read only the top 20 counts as an automated screen under CA FEHA, IL HB 3773, and Mobley, even without auto-rejection emails.
2. Cross-tenant training bias: Global models trained on other companies' past hire/reject clicks import outside age or disability patterns into your queue.
3. 180-day log purges: SaaS platforms that delete raw scores after 6 to 12 months break California and Illinois 4-year retention mandates.
4. 1x fee caps: Standard contracts cap vendor liability at 12 months of fees and disclaim customer regulatory compliance.

Worked numerical example (assumptions labelled): Suppose a 65-person firm pays $8,400/year for an ATS and leaves "Smart Rank" active across 12 roles drawing 600 Illinois and NYC applicants over 40 active posting days, with zero notices, zero independent audit, and 180-day log deletion. NYC Local Law 144 daily exposure reaches $59,000 ($500 day 1 + $1,500 x 39 days), and defending even one fee-shifted Illinois HB 3773 notice charge costs $35,000 to $75,000 in legal fees. Against $94,000+ in exposure, a 1x SaaS cap covers at most $8,400 (often $0). Disabling auto-ranking or attaching the rider below costs $0 in software fees. Compare our general AI vendor accuracy checklist.

How do you attach the ed.cafe 12-Question ATS/Hiring-AI Due-Diligence Rider?

Send the ed.cafe 12-Question ATS/Hiring-AI Due-Diligence Rider & Contract Clauses as a required written attachment before signing or 60 days prior to ATS renewal. The ed.cafe 12-Question ATS/Hiring-AI Due-Diligence Rider secures signed product disclosures and four balanced clauses built for 20-to-500 person buyers.

THE ED.CAFE 12-QUESTION ATS / HIRING-AI DUE-DILIGENCE RIDER & CONTRACT CLAUSES
Verified: Oct 29, 2026 | Publisher: ed.cafe by No Worker Left Behind (EIN 88-3268312)
Operational procurement rider for 20-to-500 person employers; review final text with counsel.

PART 1: 12 WRITTEN VENDOR QUESTIONS (ATTACH SIGNED ANSWERS TO ORDER FORM)
1. Admin Kill-Switch: List every feature that parses, scores, ranks, sorts, or dispositions
   applicants. Can our admin hard-disable each one globally?
2. Silent Updates: Will you commit NEVER to enable new AI ranking/scoring features by default
   in product updates without our prior written opt-in?
3. Cross-Tenant Data: Was the model trained on other employers' hire/reject clicks (including
   acquired modules like HiredScore), and are our resumes excluded from shared training?
4. Proxies Blocked: Which fields are ingested? Confirm graduation dates, tenure caps, resume
   gaps, ZIP codes (IL HB 3773), and speech/honesty traits (MA c. 149 s. 19B) are excluded.
5. Job Validation (29 C.F.R. Part 1607): Provide validation studies tying scores to specific
   job duties rather than pedigree or keyword correlation.
6. Independent Audit & CO Docs: Attach your (<12 mo) INDEPENDENT third-party bias audit (NYC
   LL144 / CA FEHA) plus developer technical docs for Colorado SB 26-189 (due Jan 1, 2027).
7. Native Candidate Notice: Does the portal show customizable state notices (IL, NYC, CO, MA)
   and log candidate timestamps pre-application?
8. One-Click ADA Bypass (42 U.S.C. s. 12112): Does the screen offer a direct human-review /
   accommodation link BEFORE the AI scores the file?
9. 30-Day Adverse Factors: Can we export exact score drivers per candidate to issue Colorado
   SB 26-189 plain-language adverse explanations within 30 days?
10. 4-Year Free Log Export: Can we export full CSV/JSON logs (model version, inputs, raw
    scores, ranks, human overrides) for 4 years (CA FEHA / IL HB 3773) at $0 extra cost?
11. Litigation Disclosure: List any EEOC, state civil-rights, or collective actions (e.g.,
    Mobley-style claims) naming your screening modules.
12. Insurance Backstop: Confirm Tech E&O limits and verify NO generative-AI or civil-rights
    exclusion bars vendor defense obligations.

PART 2: 4 SAMPLE CONTRACT RIDER CLAUSES (FOR COUNSEL REVIEW)
CLAUSE 1 - OPT-IN ONLY AI & 30-DAY CHANGE NOTICE: "Vendor shall provision all automated
candidate ranking, scoring, and filtering modules disabled by default, shall never enable new
ADS/ADMT features without Customer's written opt-in, and shall give 30 days' prior written
notice before any material modification to an enabled ADS."

CLAUSE 2 - 4-YEAR LOG RETENTION & FREE EXPORT: "To support Customer's duties under CA FEHA
ADS rules, IL HB 3773, and CO SB 26-189, Vendor shall retain and let Customer export at $0
extra fee machine-readable logs (model version, inputs, raw scores, ranks, notice timestamps,
and human overrides) for 4 years post-decision and 30 days post-termination."

CLAUSE 3 - AUDIT DOCS & 10-DAY DISCOVERY COOPERATION: "Vendor shall annually supply NYC LL144
independent bias-audit data and CO SB 26-189 developer documentation, and within 10 business
days of request provide candidate factor outputs for 30-day adverse notices or agency/court
subpoenas."

CLAUSE 4 - SHARED-FAULT SUPER-CAP (CO SB 26-189 SAFE): "Nothing herein shifts Customer's own
statutory deployer duties under Colorado SB 26-189. Vendor's general fee cap shall NOT apply
to losses, defense costs, or fines caused by (a) unapproved ADS activation, (b) inaccurate
developer audit/technical disclosures, or (c) lost 4-year logs, which carry a super-cap of
[5x Annual Fees or $500,000, whichever is greater]."

Through the Massachusetts AI Hub, Massachusetts residents can take the Google AI Professional Certificate free (Mass AI Hub). At ed.cafe, run by Boston nonprofit No Worker Left Behind (501(c)(3), EIN 88-3268312), applications are open at ed.cafe/start/ for Circle #1, a free 30-chair cohort closing December 1, 2026 (pre-launch as of October 2026; zero cohorts completed yet).

Where this stops being true

• Binary license checks: Verifying an active statutory license ("Active MA RN license?") differs from machine-learning ranking, though knockout rules must still satisfy Title VII and ADA job-relatedness (42 U.S.C. s. 12112(b)(6)).
• Federal contractors and unions: OFCCP contractors face strict validation rules, and unionized employers must bargain over evaluation AI under the NLRA.
• EU candidates: Digital Omnibus Reg. (EU) 2026/1744 deferred Annex III HR AI rules to December 2, 2027, while GDPR Article 22 profiling rules apply today.
• Active docket and not legal advice: Mobley v. Workday remains in merits litigation (collective certification is not a final verdict), Illinois Subpart J was reviewed in draft, and Colorado AG rules take effect January 1, 2027. Have employment counsel review final contracts.

Questions people ask

Key terms

• ADEA collective action (29 U.S.C. s. 626(b)): Federal procedure letting rejected applicants aged 40+ opt into one nationwide suit, as certified in Mobley v. Workday (May 16, 2025).
• Agent theory of vendor liability: Doctrine holding software vendors delegated hiring gatekeeping duties act as employer "agents" under Title VII, ADA, ADEA, and CA FEHA.
• Automated Employment Decision Tool (AEDT / ADS / ADMT): Software using machine learning or statistical scoring to rank, filter, or influence hiring or employment decisions.
• Independent bias audit (NYC Local Law 144): Annual impartial third-party statistical test calculating race, sex, and intersectional selection impact ratios.
• Qualification-standard screen-out (42 U.S.C. s. 12112(b)(6)): ADA rule barring selection criteria that screen out applicants with disabilities without business necessity.
• Uniform Guidelines (29 C.F.R. Part 1607): Federal validation standards governing selection tests that cause adverse disparate impact.

Sources

1. Civil Rights Litigation Clearinghouse, "Mobley v. Workday, Inc., No. 3:23-cv-00770-RFL (N.D. Cal.)" (2024-2026): Clearinghouse
2. Holland & Knight & Maynard Nexsen, "Mobley May 2025 Certification & July 2024 Agent Ruling": H&K and Maynard Nexsen
3. US Code & eCFR, "42 U.S.C. s. 12112 & 29 C.F.R. Part 1607": GovInfo and eCFR
4. NY State Comptroller DiNapoli & NYC DCWP, "NYC LL144 Audit (n = 50)" (Dec 2025): NY OSC and NYC DCWP
5. Hinshaw, "Illinois HB 3773 Employment AI Rules" (Feb 26, 2026): Hinshaw
6. Mayer Brown, "California FEHA ADS Regulations" (Aug 2025): Mayer Brown
7. Reinhart via Legal 500, "Colorado SB 26-189 Overhaul" (Jun 18, 2026): Legal 500
8. MA Legislature, "M.G.L. c. 149, s. 19B" & Personnel Today (Gartner Survey): MA s. 19B and Personnel Today