Introduction: AI Risk No Longer Stops at Hiring

Artificial intelligence (AI) tools are now part of the full employment lifecycle for many employers, not just at the applicant screening stage. AI has also become engrained in many employers’ onboarding, scheduling, timekeeping, performance evaluation, discipline, accommodations, and separation processes. With this level of implementation, the legal risk from non-compliance with local, state, and federal laws due to improper use has expanded in symmetrical fashion. Federal anti-discrimination statutes remain technology-neutral: the same Title VII, Americans with Disabilities Act (ADA), and Age Discrimination in Employment Act (ADEA) frameworks that applied to paper-and-pencil selection tests also apply to algorithmic tools. At the same time, a growing number of state and local AI laws are adding obligations that go well beyond this federal baseline and employers must remain aware of their new obligations. 

The Employer Still Owns the Decision

No federal statute gives an employer a pass on discrimination liability simply because a vendor, rather than a manager, made or influenced the challenged decision. Under Title VII, an employer using an AI screening tool that has a disparate impact on a protected class must show that the tool is job-related and consistent with business necessity, the same burden that applies to any facially neutral criterion. Title VII also expressly prohibits discriminatory job notices and advertisements, which can include AI-generated postings.

The ADA prohibits using standards, criteria, or methods of administration that discriminate on the basis of disability, as well as selection criteria that screen out individuals with disabilities unless they are job-related and consistent with business necessity. Employers must also provide reasonable accommodations, including accommodations related to the test or assessment itself. For example, an employer that deploys a vendor’s psychometric AI assessment without confirming that it can accommodate disabled applicants may inherit the full range of ADA exposure. 

The ADEA likewise applies when automated screening decisions disproportionately exclude older workers. Courts are now beginning to test the related agent theory of liability, under which an employer may remain responsible for a vendor exercising delegated screening authority. 

Under these laws and in each of these scenarios the employer (or potential employer) retains liability for the decisions made in the hiring process, including in those scenarios where it is outsourcing significant decision making.

Mobley v. Workday

The leading case testing the extent to which liability for hiring decisions can be extended is Mobley v. Workday, Inc., No. 3:23-cv-00770 (N.D. Cal.). In Mobley, the plaintiff brought suit on behalf of himself, and others similarly situated, alleging that he had submitted over 150 job applications via the Workday website but had never been contacted back. When he was finally contacted on one application, Mobley realized that it was a response set from a bot rather than a human reviewer. Using this information, Mobley brought suit alleging that Workday’s AI discriminated against older applicants in its review. In a July 2024 ruling on Workday’s motion to dismiss, the court allowed the plaintiff’s claims against Workday to proceed under an “agent” theory, reasoning that employer-clients allegedly delegated traditional screening functions to Workday’s AI platform. The court rejected the separate theory that Workday qualified as an “employment agency” under Title VII. On May 16, 2025, the court conditionally certified an ADEA collective action. Beyond the effect of Workday facing liability as a third-party vendor, this matters to employers because employers who contracted with Workday may not escape liability either. Depending on their individual contracts and circumstances, those employers who utilizes Workday’s AI screening function will also be liable for the ultimate decisions made by the AI tool (absent any rare indemnification provisions to cover the total cost of such suits). 

The State and Local Landscape

As of September 2026, there are at least four states and localities that impose AI-specific employment obligations that go beyond federal anti-discrimination law. Employers operating in these cities or states or state lines need to ensure they stay up to date with the overall regulatory landscape at all times. As we explored in a prior DE Insight, these state and local obligations now represent a core compliance imperative for multi-state employers.

Illinois

Illinois Public Act 103-0804 amended the Illinois Human Rights Act, effective January 1, 2026, prohibits the use of AI “with respect to recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or the terms, privileges, or conditions of employment” in a way “that has the effect of subjecting employees to discrimination on the basis of protected classes … or to use zip codes as a proxy for protected classes . . . .” The law also requires notice to employees and applicants that the company is using AI in such processes. The Illinois Department of Human Rights had released rules for review and comment, however, they have since temporarily postponed rulemaking to collaborate with other state agencies, however, the underlying law remains in effect. 

New York City

New York City Local Law 144 requires employers and employment agencies that use an automated employment decision tool (AEDT) to:

• Conduct an annual independent bias audit within one year before the tool’s use;
• Publicly post the audit results, including any impact-ratio or scoring-rate data;
• Provide candidates with at least 10 business days’ notice before using an AEDT, including the qualifications and characteristics the tool assesses; and
• Offer an alternative selection process or accommodation upon request.

Enforcement is handled by the New York City Department of Consumer and Worker Protection (DCWP). 

California

The California Privacy Protection Agency (CPPA) approved final regulations on automated decision-making technology (ADMT) in September 2025. The regulations took effect on January 1, 2026, but compliance with the ADMT-specific provisions does not begin until January 1, 2027. The regulations require compliance with the rules when an ADMT is used to replace or substantially replace human decision-making in “significant decisions” in employment which are defined as hiring, allocation or assignment of work or benefits, compensation decisions, promotion, and discipline and termination. The regulation also requires employers to provide notice and certain opt-out options, provide an appeal process, allow employees and potential employees to access information about the use of ADMT, and requires risk assessments to be performed. 

Colorado

Colorado’s newly amended law takes effect on January 1, 2027, and represents a different regulatory approach. The Colorado law covers employer use of ADMT and requires:

• Pre-use notice to individuals before an automated decision-making technology is used for a consequential decision;
• Post-adverse-outcome disclosures, including the right to a human review or reconsideration;
• Data correction rights;
• Records retention and documentation; and
• Requirements for meaningful human review rather than the prior law’s risk-management programs and impact assessments.

Beyond Hiring: Where AI Creates Risk 

Algorithmic Time Tracking and Surveillance

Automated timekeeping, productivity scoring, scheduling, and monitoring systems can create wage-and-hour exposure when they fail to capture all compensable working time. Under the law, employers must count all time during which an employee is suffered or permitted to work whether or not an algorithm recognizes the activity as productive. 

This same algorithmic monitoring of employee communications, location, and productivity can implicate protections under the National Labor Relations Act (NLRA), which protects employees who act together for mutual aid and protection. Surveillance tools that chill protected organizing or concerted complaints may lead to unfair labor practice charges. Additionally, some states, such as Maine, have enacted their own employee surveillance laws which limit the scope of employee monitoring. 

Generative AI: Familiar Risks in New Tools

Generative AI creates a different set of operational challenges across employment functions. Employers are already using Gen AI to draft job advertisements, interview questions, performance reviews, disciplinary memoranda, investigation summaries, accommodation responses, and termination rationales. Each use creates its own set of risks:

• Inconsistency and bias: AI-generated language may introduce inconsistencies in documentation due to the nature of how Gen AI processes information or inadvertent bias in job descriptions that expose the employer to disparate-treatment or disparate-impact claims.
• Hallucinated facts and citations: Large language models (LLMs) can fabricate facts, legal citations, and employee-performance data. Any AI-generated document used in an employment action should be verified against the employer’s actual records.
• Confidentiality and privilege: Absent a zero data retention agreement and an enterprise contract, inputting confidential personnel data, trade secrets, or attorney-client privileged communications into a third-party AI platform risks waiver of privilege and violation of confidentiality obligations. 
• Personal data of employees and applicants: Using AI tools that process personal data can trigger privacy obligations under the CCPA, state biometric laws, and potentially the European Union General Data Protection Regulation for multinational employers.

The U.S. Department of Commerce published an AI-at-work guide in April 2026 recommending that employers limit generative AI use to approved purposes, prohibit the input of confidential or personal data, require fact and citation checks, conduct bias reviews, and preserve human judgment in final decisions. Employers should require human verification of any AI-generated document that may become part of an employment record and preserve the actual business rationale for each employment decision independently of the AI output. 

Fair Credit Reporting Act: An Open Question for AI Vendor Reports

Another emerging trend is lawsuits testing whether vendor-generated candidate reports based on AI analysis such as personality assessments, social-media screening, or predictive-analytics scoring may qualify as “consumer reports” under the Fair Credit Reporting Act (FCRA). If they do, then the FCRA’s disclosure, authorization, and adverse-action notice requirements may apply. However, this is still a developing issue, and no court has established a definitive rule. 

A Practical Action Plan

A practical program can start with the following steps:

1. Inventory all AI tools and shadow AI. Shadow AI, or the use of unapproved AI tools by employees without oversite or governance, is one of the largest compliance risks employers face today. Catalog every AI-enabled tool used in employment decisions across the organization, including tools adopted by individual departments or managers without approval from upper management. Shadow AI at your company may be the biggest issue so implementing a control over its usage is important.
2. Classify by jurisdiction, use, decision impact, and data. Map each tool to the states and localities where it is used, what employment decisions it impacts, the level of impact on applicants or employees, and the categories of personal data it processes. 
3. Assign a human decision-maker. For every employment decision informed by AI, designate a manager to act as the “human in the loop” who has the authority and practical ability to review, override, and document every final decision. 
4. Audit and test for adverse impact. Conduct regular adverse-impact analyses across protected classes. Separately confirm that AI assessments are accessible to individuals with disabilities and that accommodation processes are in place.
5. Build notice, accommodation, and appeal workflows. Develop standard processes for pre-use notice to candidates and employees, accommodation requests, and appeals or reconsideration related to adverse decisions.
6. Review and revise vendor contracts. AI vendor agreements should address transparency into the tool’s design and training data, access to audit data, change-notification obligations, cooperation with employer-side bias audits, indemnification for discriminatory outcomes, data security, and data retention and deletion. 
7. Adopt an AI use policy and training program and monitor updates. Draft clear policies governing employee use of generative AI, including approved tools, prohibited uses (confidential data, personal information, and privileged communications), output verification requirements, and reporting for misuse. More importantly, provide training for employees on approved tools and provide an enterprise tool to discourage the use of Shadow AI. 

The cost of inaction for employers is not a hypothetical. Cases like Mobley show us how discrimination claims can reach AI vendors and, by extension, the employers that delegate decisions to them. State regulators are building enforcement regimens and the compliance window before the initial ADMT-specific rules take effect in 2027 is narrowing. For employers using these tools, the time to build the governance infrastructure is now.