A pattern is forming in American courtrooms that every business using AI tools should understand. The question being litigated across multiple federal cases is straightforward: when an AI tool produces a harmful or discriminatory outcome, who is legally responsible — the company that built the tool, or the company that deployed it?
The courts are answering with increasing consistency: both. And for the business that chose to use the tool, the defense that “the vendor said it was unbiased” or “we didn't know the algorithm worked that way” is proving insufficient.
The Workday Case and What It Established
The foundational case is Mobley v. Workday, Inc., pending in the Northern District of California. Derek Mobley alleges that Workday's AI-powered applicant screening tools discriminated against him on the basis of race, age, and disability across more than 100 job applications to employers using Workday's platform.
The critical legal question was whether Workday — a software vendor, not an employer — could be held liable under Title VII, the Age Discrimination in Employment Act, and the Americans with Disabilities Act. In July 2024, Judge Rita Lin ruled that claims could proceed under an “agent” theory: because Workday's tools perform the traditional employer function of screening and rejecting candidates, Workday can be treated as the employer's agent for purposes of discrimination liability.
The case has continued to develop through 2026. In March 2026, the court rejected Workday's argument that the ADEA doesn't cover job applicants — a ruling that expanded the case's reach. In May 2025, the court granted preliminary certification of a collective action on the age discrimination claim. As of mid-2026, the case is in discovery and has not reached a final judgment, but the rulings to date have established a framework that other courts and litigants are building on.
Why the “Agent” Theory Matters for Every Business
The agent theory's significance extends well beyond Workday. Its logic applies to any business that delegates a decision-making function to an AI tool. If you use an AI system to screen resumes, score loan applications, set insurance premiums, or make any other consequential decision about individuals, and that system produces discriminatory outcomes, the emerging legal framework suggests you bear liability alongside the vendor — because you chose to delegate the decision to the tool and the tool acted as your agent in making it.
This collapses the assumption many businesses have operated under: that buying a tool from a reputable vendor, relying on the vendor's representations about fairness and accuracy, and using the tool as designed creates a defensible position. It does not, at least not under the legal theories courts are currently allowing to proceed.
A parallel case reinforces this from a different angle. A class action filed in January 2026 against Eightfold AI alleges that the company's applicant screening platform operated as a consumer reporting agency under the Fair Credit Reporting Act — collecting and scoring applicant data from unverified third-party sources without consent. While Mobley attacks the outcomes of AI hiring (discrimination), the Eightfold case attacks the process (data handling and transparency). Together, they create a two-front exposure for AI hiring vendors and the businesses that use them.
What Small Businesses Should Understand
The temptation is to treat these cases as problems for large enterprises — companies using enterprise-grade AI platforms from vendors like Workday. That reading is too narrow for two reasons.
First, the legal principles being established are not size-dependent. The agent theory doesn't ask how big the employer is; it asks whether the AI tool performed a function the employer would otherwise have performed. A ten-person company using an AI resume screener faces the same analytical framework as a Fortune 500 company using Workday — the scale differs, but the legal theory is identical.
Second, state and local regulation is moving faster than federal litigation. New York City's Local Law 144, effective since July 2023, requires employers using automated employment decision tools to conduct annual bias audits, publish the results, and notify candidates that an AI tool is being used. Several other jurisdictions are developing or have enacted similar requirements. Compliance with these laws requires knowing what your AI tools do, how they make decisions, and whether those decisions produce disparate impacts — exactly the kind of oversight that many businesses using off-the-shelf AI tools have never conducted.
The Practical Audit
If your business uses AI tools that affect people — hiring decisions, customer interactions, pricing, content generation, credit decisions — four steps reduce your exposure.
Review your vendor agreements. Does the contract include representations about bias testing, accuracy, and compliance with anti-discrimination laws? Does it include indemnification if the tool produces discriminatory or harmful outcomes? Many vendor agreements disclaim liability for outputs, which means the business bears the full risk. Understanding what your contract actually says — rather than what the sales materials implied — is the starting point.
Document your oversight. If you use an AI hiring tool, are you reviewing a sample of its decisions to check for patterns that suggest bias? If you use an AI customer service tool, are you monitoring its interactions for accuracy? Documentation of genuine oversight — not just purchasing the tool, but actively supervising its use — is relevant in both litigation and regulatory contexts.
Understand what the tool does with data. AI tools consume data, and the data they process may include personal information protected by privacy laws, information subject to the Fair Credit Reporting Act, or data that the individuals involved didn't consent to share for this purpose. Knowing what data flows into your AI tools, where that data comes from, and what the tool does with it is a compliance question as much as a technical one.
Evaluate whether you need the tool at all. Not every AI-powered feature adds value proportionate to its risk. An AI resume screener that processes 500 applications a month for a company that hires three people a year may be introducing legal exposure for a function that a human could perform more carefully and with less liability in the same amount of time.
The Bottom Line
The legal framework around AI in business is being built in real time, and the direction is clear: businesses that deploy AI tools bear responsibility for what those tools do. The defense that the vendor built it, the vendor said it was fair, and the business simply used it as designed is being rejected by courts in the cases that are defining the field. Understanding that dynamic — and building oversight, documentation, and vendor accountability into your AI adoption decisions — is the practical response to a legal landscape that is moving faster than most businesses realize.
This article is for educational purposes only and does not constitute legal, tax, or financial advice. Consult a qualified professional for guidance specific to your situation.