The Lawsuit That Changes Everything
On January 20, 2026, plaintiffs filed a class action against Eightfold AI in California's Contra Costa County Superior Court. The allegations are direct: Eightfold scraped data on more than one billion workers, scored each profile on a zero-to-five scale, and discarded low-ranked candidates before a human recruiter ever saw their file. None of those candidates were notified. None gave consent. The Fair Credit Reporting Act requires both.
The companies using Eightfold's platform? Microsoft. PayPal. Morgan Stanley. Starbucks. Chevron. Bayer.
If your company uses a major AI recruiting platform, there is a meaningful chance you are running something that works exactly like this.
Two Theories, Two Targets
What makes 2026 legally significant isn't one case. It's two, running on parallel tracks toward the same conclusion: AI screening tools create legal exposure for everyone in the chain.
Kistler v. Eightfold AI is built on the Fair Credit Reporting Act, not anti-discrimination law. The plaintiffs aren't arguing the algorithm was biased. They're arguing it operated in secret. FCRA requires specific disclosures and candidate consent when automated processes contribute to employment decisions. Eightfold, the complaint alleges, built a system that made those decisions invisibly. No notice. No opt-out. No paper trail.
Mobley v. Workday has been in litigation since 2024, but hit its most significant ruling on March 6, 2026. Judge Rita Lin rejected Workday's strongest dismissal argument, holding that the company acted as an "agent" of the employers using its screening tools. Workday isn't just a software vendor under this theory. It is a co-defendant under Title VII and the Age Discrimination in Employment Act.
The "agent" ruling matters because it killed the defense every employer thought they had: we bought this tool, we didn't build it, so it's not our problem. If a vendor's tool performs a function that a human HR professional would otherwise perform, both the vendor and the employer can be held liable. The algorithm did it is not an answer the courts are accepting.
Mobley already has preliminary nationwide collective action certification, potentially covering millions of job applicants over 40 who were screened out by Workday's automated systems. The class is still being litigated, but the trajectory is clear.
The Regulatory Layer on Top
Litigation is only half the exposure. Federal enforcement and a wave of state laws have quietly assembled a compliance framework around AI hiring that most recruiting teams have not fully mapped.
EEOC made it explicit in 2024 guidance that disparate impact under Title VII applies to AI screening tools the same way it applies to human decisions. If your tool disproportionately filters out protected classes, you are liable. This is not theoretical: iTutorGroup paid $365,000 to settle EEOC charges after its AI software automatically rejected female applicants over 55 and male applicants over 60.
Illinois HB 3773 took effect January 1, 2026. It makes it a civil rights violation to use AI in employment decisions - including hiring - in ways that produce discriminatory outcomes, even unintentional ones. Employers must notify candidates when AI is used. Four-year retention of notices, system inventories, audits, and selection metrics is required. Penalties include actual damages, civil fines, and attorneys' fees.
NYC Local Law 144 requires annual independent bias audits of any automated employment decision tool, public posting of results, and candidate notification. A December 2025 audit by the NYC Comptroller found enforcement had been effectively nonexistent: auditors found 17 potential violations across 32 companies reviewed that the Department of Consumer and Worker Protection missed entirely. Three out of twelve test complaint calls to 311 were routed correctly. The DCWP has since committed to stronger enforcement. Daily penalties run $500 to $1,500.
Colorado and California both have AI-in-employment bills moving through 2026 legislative sessions. The patchwork is thickening.
What Recruiters Need to Do Right Now
Most recruiting teams have adopted AI tools for efficiency - resume parsing, ATS scoring, automated outreach sequencing, video interview analysis. Very few have conducted a legal audit of what those tools do with candidate data, how decisions are recorded, or whether FCRA and anti-discrimination disclosures are in place.
Here is the minimum standard to hold yourself to today.
Inventory every tool that touches candidates before a human decides. ATS scoring, resume ranking, chatbot screening, video analysis - all of it. List the vendor, the function, and whether it produces a score or ranking that affects who advances. If you do not know what you're running, you cannot assess what you're exposed to.
Ask your vendors hard questions. How is the scoring model trained? What data did it learn from? Has an independent bias audit been conducted, and can you see the results? Does the system comply with FCRA disclosure requirements? A vendor that cannot answer these questions clearly is a vendor that is putting you at risk.
Run a basic disparate impact check. Pull your screening-out rates by demographic group and compare them to the overall applicant pool. You do not need an audit firm for a first pass - a spreadsheet showing which groups are filtered out at higher rates is enough to know whether you have a problem worth investigating. If you find one, fix it before a plaintiff's attorney finds it for you.
Build your notice and documentation process now. If you are in Illinois, you are legally required to notify candidates when AI is used in decisions affecting them. If you are in NYC, you are required to post bias audit results publicly. Even if neither law currently applies to your location, building the documentation habit now is far cheaper than reconstructing records during litigation.
Put a human in the loop and document that it happened. Courts are examining whether humans actually reviewed decisions or simply ratified what the algorithm returned. If a candidate is screened out before any recruiter sees their file, that is the precise exposure point. Set a policy that AI scores inform - they do not determine - who advances. Make sure every hiring manager understands the difference, and keep records that show it.
The Risk Calculus
AI screening tools are genuinely useful. They handle resume volume that human recruiters cannot, surface pattern matches faster, and reduce time-to-fill when configured well. None of that value disappears because of these cases.
But the calculation has shifted. Running a major AI screening platform without understanding what it does, how it was trained, and whether it satisfies disclosure requirements is no longer a minor compliance gap. The Workday and Eightfold cases are active. If either produces a significant verdict, expect a wave of similar actions targeting every vendor in the market.
The smart move is not to stop using AI in hiring. It is to know what your tools are doing and build documentation that shows you were paying attention before anyone asked.
BlueLine's matching tools surface qualified candidates without black-box scoring. See how it works at /register.