people studio

The screening tool is a defendant now

In May 2025 a federal judge in California granted preliminary certification of an age-discrimination collective action against Workday — the software vendor, not an employer — over claims that an AI applicant-screening system discriminated by age, race, and disability. Workday told the court its platform had processed 1.1 billion rejected applications. Court-authorized opt-in notices to applicants over 40 began going out in early 2026 — the EEOC had argued in an earlier amicus brief that a vendor can be covered under Title VII, the ADEA, and the ADA — and press coverage speculates Mobley v. Workday could end up among the largest collective actions in US history. The speculation may not hold. The 1.1 billion is Workday's own number.

Meanwhile the tools are already on your desk. SHRM's 2025 Talent Trends survey (2,040 HR professionals) found 43% of organizations using AI in HR tasks, up from 26% a year earlier — recruiting first, led by job-description writing (66% of AI-using recruiters) and resume screening (44%). The adoption happened. The discipline mostly didn't: only 17% of HR professionals call their org's AI implementation "highly successful," and Gartner reported in late 2025 that 88% of HR leaders say their organizations have not realized significant business value from AI tools. Both of those can be true at once — a tool that saves you twenty minutes on a JD and exposes you to a collective action is exactly the kind of thing both surveys would describe.

This chapter is the discipline, as code. Three tools a working people team runs every week: a data firewall that keeps employee records out of prompts because a script refuses them, not because everyone remembered the rule on a busy Thursday; recruiting briefs where every claim about a candidate cites the resume line that proves it; and the paper trail — policy drafts that cannot reach "published" without a named legal reviewer, versions you can date, and adverse-action records built to survive a discrimination claim.

Why it matters

• HR holds the most protected data in the building. Medical information, accommodation requests, investigation notes, background-check reports — the exact material AI assistants are best at summarizing is the material with statutes attached. One pasted FMLA letter is a disclosure, and no time savings buys it back. The firewall has to live in code, where it works on the days you're slammed.
• The compliance map moved toward you, not away. Federal enforcement receded — the EEOC pulled its 2023 AI guidance in early 2025, and an April 2025 executive order directed agencies away from disparate-impact theories — while NYC's Local Law 144 fines up to $1,500 a day for unaudited screening tools, Illinois requires consent before AI touches a video interview, and Colorado's law (effective January 2027) requires notice, human review of adverse actions, and three-year record retention. Accountability didn't shrink. It moved to state law and private litigation, where Mobley lives.
• The market teaches the risk; almost nobody teaches the check. The HR certification world names algorithmic bias more than any other function's training does — and in the programs we scanned, it stays at principle level. Verifying an AI candidate summary against the actual resume, or an AI policy draft against the review boundary, before it enters an employment decision: that operational layer is the gap, and it's this chapter.

What AI specifically gets wrong

• It summarizes whatever you paste — and pasting is the breach. The model doesn't know an investigation note from a picnic flyer. "Anonymize this grievance, then summarize it" fails at the comma: the material entered the prompt. The gate has to fire before send, on the payload, every time.
• It states inferences in the voice of facts. "Strong culture fit," "comfortable with ambiguity," "likely to stay long-term" — no resume line sources those, and a screening brief that presents them as findings is a discrimination exhibit waiting for its case number. Sourced gets a receipt; inference gets a label; there is no third state.
• It will happily "improve" legal boilerplate. At-will language, EEO statements, leave provisions that vary by state — approved boilerplate is pasted, never regenerated. A policy draft is legal surface, and the draft-to-published path runs through a named reviewer or it doesn't run.
• It leaves no trail unless you build one. The tool recommends, the human decides, and six months later someone asks which version of the policy was in force and why candidate R-203 was rejected over the tool's advance recommendation. "The vendor's tool did it" is the argument Mobley exists to test. Your records are the better one.

What you'll be able to do at the end

• Run every prompt payload through a data firewall — approved sources plus a never-list scanner for ER, medical, identity, and background-check material — that returns ALLOW or BLOCK with named reasons, and blocks employee-relations content with zero carve-outs.
• Audit an AI screening brief claim by claim: SOURCED with a resume-line receipt, INFERENCE with a label, or VIOLATION — and hold any brief where the decision owner is a tool instead of a person.
• Enforce the legal-review boundary as a state machine — draft, legal review, approved, published, no shortcuts even on Friday — with a version log that answers "which version was in force when" in one lookup.
• Build adverse-action decision records that log what the AI recommended, who decided, why, when notice went out, and how long to retain — then audit a whole docket and say exactly which decisions are defensible.

Every drill runs in plain Python. The logic is the point: the same gate works as a script on your desktop, a rule in your ATS, or the policy you hand the next vendor who promises to make screening effortless.