The Workday Rulings So Far Point at the Employer’s Own Settings

The case is Mobley v Workday, and it is being heard in the federal court in San Francisco. The claims of race, age, and disability discrimination have been there from the start, and a claim of sex discrimination was added this year. None of them has been proven. On 10 November 2026, Workday filed its opposition to the applicants’ bid to run the case as a full class action, and the court will hear that bid on 9 March 2027. Until the court rules, what each side says about it is argument, not a finding.

The decisions the court has already made are another matter. They say something every employer using screening software should take on board. The line between the vendor’s AI and the employer’s own choices is one the court has drawn, and the employer’s side of it is for the employer to explain.

What the case is about

Derek Mobley alleges that he applied for more than 100 jobs with companies using Workday’s screening features, and was turned down every time. Three more named applicants have since joined him. In May 2025 the court allowed his age claim to go forward as a nationwide collective of applicants aged 40 and over, which other applicants can join.

The tools in dispute score, sort, rank, or screen applicants and pass the result to the employer. One, Candidate Skills Match, compares the skills in an employer’s job posting with the skills in an applicant’s CV, and reports the match to the employer as strong, good, fair, or low. Others come from HiredScore, a company Workday bought in 2024.

The spreadsheet line

In July 2024, refusing to strike out the claim, the court held that the applicants had plausibly alleged Workday was acting as its customers’ agent. It also explained where the line falls. If an employer uses a spreadsheet program to sort applicants by birthdate and filter out everyone over 40, the software vendor is not the employer’s agent, because the spreadsheet takes no part in deciding who is hired. Workday was different, on the allegations, because its tools were said to perform a traditional hiring function: rejecting candidates at screening and recommending who goes forward.

When the age collective was certified in May 2025, the court applied the same line. The collective covers only applicants whose applications went through Workday’s AI because the employer turned those features on. An applicant screened only on criteria the employer itself selected falls outside it, because in that situation Workday is no different from the employer’s own spreadsheet. The court added that whether any disparate impact is driven by employer preferences rather than by Workday’s own algorithms is a question for a later stage of the case.

Two months later, the court directed the parties to settle a timeline for Workday to produce its list of customers who had enabled the HiredScore AI features.

Three things follow from these rulings, at least at this stage of the case. Workday’s exposure depends on what its own AI does, and screening on criteria the employer chose is treated as the employer’s own act rather than Workday’s. The record of which employer switched on which feature also matters, because the court has already told the parties to plan how Workday will produce it.

The data is the employer’s, and so is the testing

In May 2026 the applicants asked the court to make Workday hand over its customers’ applicant data. The court refused, because the applicants had not shown that Workday controls that data. Workday’s standard subscription agreement says the customer owns all right, title, and interest in its own content. The district judge then sent one question back for a fresh look: whether Workday nonetheless has the data in its possession, because it sits on Workday’s servers. In July 2026 the answer was no. The court found that the data is kept in separate, password-protected customer accounts that Workday is contractually prohibited from freely accessing.

The May ruling also held that Workday’s bias testing of Candidate Skills Match is privileged, because Workday’s lawyers curated the data and used the results to give legal advice. That part of the ruling was left standing. Keeping that testing privileged is a legitimate choice for a vendor in litigation, and it carries a lesson for the vendor’s customers. An employer cannot assume the vendor’s testing will be there to defend the employer’s own decisions. If an employer wants to show that its screening is fair, the evidence will have to be its own.

Why this lands on New Zealand employers

New Zealand law is not American law, and nothing in Mobley binds a New Zealand court or tribunal. The court’s reasoning is still useful here, because our Human Rights Act 1993 asks a similar question. When a job applicant is turned down because of their age, sex, or another prohibited ground of discrimination, the Act asks whose decision or practice produced that result. It can hold the employer responsible even when someone acting for the employer carried the decision out.

Section 22 makes it unlawful for an employer, or anyone acting on an employer’s behalf, to refuse or omit to employ a qualified applicant because of a prohibited ground of discrimination. Age is a prohibited ground from 16 onwards. Section 65 deals with indirect discrimination: a practice that looks neutral but has the effect of treating a group differently on a prohibited ground is unlawful, unless the person whose practice it is “establishes good reason for it”. Section 68(2) treats anything done by an agent as done by the principal as well, unless it was done without the principal’s express or implied authority.

In our view, a screening tool running on settings the employer chose is the employer’s practice. The criteria it applies were the employer’s decision, and the tool applies them with the employer’s authority. If the outcome turns on how the customer configured the product, the employer is left to show good reason for a configuration it may never have written down. That is a hard thing to establish from memory, and harder still when the person who set it up has left.

The Privacy Act 2020 adds a second layer. Information Privacy Principle 8 says an agency must not use personal information without taking reasonable steps to make sure it is accurate, up to date, complete, relevant, and not misleading. A score generated about an applicant is personal information, and an employer who relies on it to decline an interview is using it. The applicant can also ask to see it, and many will want to. In the Privacy Commissioner’s 2026 annual survey, 67 per cent of New Zealanders said they were concerned about government agencies and businesses using AI to make decisions about people, up from 62 per cent the year before.

The tool can change under you

There is another difficulty, and it is less obvious. The product an employer configured is not always the product that is running. Workday bought HiredScore after the case began, and the court has treated HiredScore’s features as part of the same job application platform. A platform can grow new features after an employer has set it up, and each new feature is another setting the employer may need to account for.

The same pattern runs through general AI tools. On 9 November 2026 Anthropic released Claude Fable 5.2. Its announcement says that when the model’s safety classifiers block a high-risk cybersecurity or biology request, the user receives a response from an older model instead. That routing is unlikely to touch a hiring decision. But it illustrates a point that does: the system that produced an output is not always the one the customer chose, and the vendor’s release notes may be the only record that anything changed.

Our view

The court has not yet decided whether Workday’s tools caused any biased outcome, or who would be responsible if they did. What it has done is separate two things that employers often treat as one. On one side is what the vendor’s AI does on its own, and on the other are the choices the employer made when it set the software up, such as which features to turn on and which criteria to apply. If an unfair result comes from those choices, it is the employer’s result, and the employer will be the one asked to explain how it happened and why.

New Zealand figures suggest that many employers would struggle to give that explanation, because the records behind it were never made. On 12 November 2026, HRD New Zealand reported figures from MyHR, the HR software and advisory firm, showing that 87 per cent of New Zealand workplaces now use AI tools, but only 5.7 per cent of employers using AI have an AI policy in place. The gap was widest in the smallest businesses: 2.3 per cent of employers with five or fewer staff had guardrails for AI use, against 14.3 per cent of businesses with more than 100 people. The report, as HRD published it, does not say how the figures were gathered, so they are better read as a strong signal than as a census. Even so, a written AI policy is usually the first record an employer makes about AI. If so few employers have one, it would be surprising if many had written down how their screening software is set up.

Larger organisations tell a similar story. Datacom’s 2026 State of AI Index, a survey of 207 senior leaders in organisations with 100 or more staff, found that 91 per cent use AI, but only 38 per cent require a person to review AI-assisted decisions, and only 19 per cent monitor their AI for bias, accuracy, or drift. The Workday case is, at its heart, a claim about bias that nobody caught, and four in five of these organisations are not looking for it.

For most employers, then, the immediate risk is not a lawsuit but the lack of a record that would let them give that explanation. The record worth keeping is modest, and it can be kept in an ordinary register:

• which AI features are switched on, for which roles, and from what date;
• the criteria and weightings the employer chose, who chose them, and why;
• the vendor’s release notes or change log for the same period;
• what recruiters actually saw, such as a score band or a ranking, and how much weight they gave it; and
• whether anyone looks, from time to time, at the applicants the tool screened out.

None of this requires an employer to understand the vendor’s model. It requires the employer to understand its own choices, and to be able to show them later to the Human Rights Commission, the Human Rights Review Tribunal, or an applicant who asks.

How we can help

Closing those gaps is the work Lex Praxis does. Our AI Employment Risk Audit looks at eight areas where employers make decisions about people, starting with hiring, and finds where AI is being used in each of them. It then asks whether that use is disclosed and accountable, and where a decision would struggle to be defended if an applicant or employee challenged it. The audit ends in an Exposure Report that grades the exposure in each area and sets out what to fix first. For smaller teams, our AI Risk Baseline covers the same eight areas in a shorter review, and tells you whether a full audit is worth it. If you would like us to look at how your organisation uses AI in its staff decisions, email melt@lexpraxis.co.nz and we will start with a conversation about scope.

Lex Praxis advises New Zealand employers on employment law and AI governance. This article is general commentary and does not constitute legal advice. For advice specific to your circumstances, contact us directly.