Room to Be Wrong. The Emergent Era of the Algorithmic Rejection.

Sometime this past winter, a very large number of people received an email telling them they might be part of a lawsuit. Most of them probably deleted it, but those who read it learned that a job application they had filed at some point since September 2020 (possibly one of dozens, almost certainly one they had forgotten) had been adjudicated by software before a human reviewed it. Most people probably assumed that has been the case for a while, with their job applications disappearing into a void after hours of careful crafting and painstaking submission.

The case in question is Mobley v. Workday, which has been running since February 2023 and is the latest in a long line of real-world legal tests of “who answers for an algorithm?” If you (an employer) have AI anywhere near a hiring decision, or (a bank) a lending decision, or (everyone else) any other decision that a legal statute cares about, this is the case to follow. And one of the more interesting things to come out of the case this year had nothing to do with hiring at all.1

I.Three in the Morning

Derek Mobley is Black, over forty, and has been diagnosed with anxiety and depression. Between 2017 and 2022 he applied for more than a hundred jobs through employer portals powered by Workday, and he was turned down for every one of them. Some of the rejections arrived within an hour of his applying. At least one landed in the middle of the night.2 You do not need a law degree to work out what he inferred from the timing.

What made his complaint unusual is that he did not choose to sue the (potential) employers; instead he sued the software that powered their recruiting.

Workday’s answer to the suit was the obvious one (and for a while it even looked like a good one): we are a vendor. We sell a tool. Our customers are the ones who decide who to hire, they configure the tools, they set the thresholds, and if one of them uses our product to discriminate then you have a claim against them and not against us. Federal anti-discrimination law reaches employers and employment agencies, and Workday is neither.

In July 2024, Judge Rita Lin agreed with about half of that. Workday is not an employment agency, because it does not go out and procure employees for anybody.3 And Mobley had no claim for intentional discrimination, because nobody suggested Workday wanted these outcomes.4 But Title VII, the ADEA and the ADA all define “employer” to include “any agent of” an employer, and on that the case survived. If a company hands off the job of screening applicants, it doesn’t really matter whether it hands it to a person or to a piece of software. As the court put it, “[n]othing in the language of the federal anti-discrimination statutes or the case law interpreting those statutes distinguishes between delegating functions to an automated agent versus a live human one.”5

The claim that survived is what is known as a disparate impact claim, and there is a distinction here that matters (though it is frequently muddled). Disparate treatment is discrimination as most people think about it: someone decided to treat you worse because of what you are. Disparate impact looks at a neutral practice (applied to everyone identically) and asks whether it happens to knock out one protected group at a materially higher rate than another. Intent is beside the point. A written test, a minimum height requirement, a credit check, a resume filter, any of them can be perfectly well-meant and still be unlawful if it produces disparity and the employer can’t show the practice is job-related and justified by business necessity.6

Which is the oft-touted issue with machine learning. Nobody at Workday sat down and wrote a rule about age. But when a model gets trained on who got hired in the past, it becomes a very efficient device for reproducing the justifications for who got hired in the past, and it will find (intentionally or not) proxies for the protected characteristic.7

In May 2025 the court granted preliminary certification of a nationwide collective under the age discrimination statute, covering everyone forty and over who applied through the platform since September 24, 2020 and was passed over.8 At the hearing, Workday’s counsel put the number of applications rejected during that window at 1.1 billion.9 The court observed that this implied “potentially hundreds of millions of potential plaintiffs,” and then declined to treat the sheer size of the problem as a reason not to tell anyone about it. Widespread discrimination, it said, is not a basis for denying notice.

And it’s all very much under discussion still. In March, one day before the opt-in deadline, the court rejected Workday’s contention that job applicants cannot bring age discrimination claims at all.10 In June it held that California’s civil rights statute reaches Workday’s conduct regardless of where the applicants live, because the tools are “designed, developed, maintained, and controlled” from a California headquarters.11 Roughly fourteen thousand people are reported to have opted in (though that figure comes from the trade press rather than the docket and Workday has declined to confirm it).12 Discovery is ongoing, and there is no trial date scheduled yet.

II.Curated by Counsel

Somewhere in the middle of all this, the plaintiffs asked for Workday’s internal bias testing. It’s an obvious request: any responsible vendor of screening software would run its models against demographic data to see whether the selection rates come out lopsided, and whatever those tests found would almost certainly be among the most useful documents in the case. Workday refused, on the ground that the testing was privileged.

On May 29, 2026, Magistrate Judge Laurel Beeler agreed.13 Workday represented that its attorneys had curated the data used in the testing, that the purpose of the exercise was to obtain legal advice rather than to run the business, and that the results had never been submitted to any regulator. The court credited all three and held the testing protected. It also held that Workday had not waived anything by mentioning publicly that it did bias testing at all, since “invoking the mere existence of its bias testing outside of litigation is not enough to waive privilege.”14

Still, Workday didn’t win everything. It was ordered to hand over its own EEO-1 and OFCCP filings, on the theory that a company using its own AI tools internally knows something about what those tools do to demographics.15 It had already produced, by agreement, the underlying historical data behind the bias audit it ran on its Spotlight product using the impact-ratio method that New York City requires.16 And a good deal of commentary since has read the order as a green light for privileged AI auditing generally (which is probably reading it too hard, but we’ll let the courts decide). So far, Beeler’s order is a magistrate’s discovery ruling, not a precedent, and the facts that carried the day are narrower than they look.

Even so, it is a landmark to have a court asked squarely whether you can test your own AI for bias without handing the results to the people suing you, and the answer came back yes. Whether that is worth as much as it sounds depends entirely on what privilege actually does.

III.Behind the Shield

Legal privilege17 is one of those phrases that gets tossed around confidently in legal dramas while most people have only a vague sense of what it actually does. In practice there are two doctrines doing most of the work, and a third that companies believe in (and that doesn’t really exist).

The first is attorney-client privilege, which protects confidential communications between a client and its lawyers made for the purpose of getting legal advice. In a company, the Supreme Court settled in Upjohn that this reaches down past the executive suite to whichever employees have the information counsel needs.18 The critical limit, which Upjohn itself spelled out, is that the privilege covers the communication and not the fact. “A fact is one thing and a communication concerning that fact is an entirely different thing.”19 Your lawyer’s memo about your selection rates may well be untouchable, but the selection rates themselves sit in your systems as ordinary business records, and the other side can request them directly.

The second is work product, which protects material prepared in anticipation of litigation.20 The trouble is that a bias audit is almost never prepared for one reason. It serves the lawyers, and the product team, and the compliance function, and the customer who asked about it in a security questionnaire. Courts split on how to handle documents like that, and the Ninth Circuit (where most of the large AI vendors happen to live) takes the stricter line: for attorney-client privilege over a dual-purpose communication, the legal purpose has to be the primary one, not merely one among several.21

The third doctrine is the one everyone assumes and nobody has. It is called the self-critical analysis privilege, and the idea is intuitive: if we want institutions to examine themselves honestly, we shouldn’t punish them by making every honest self-examination an exhibit. Its origin is a 1970 hospital peer-review case.22 It has almost no life in federal employment litigation. The Supreme Court declined to recognize anything like it when the EEOC came for a university’s tenure files, and its reasoning carries: “[w]e are especially reluctant to recognize a privilege in an area where it appears that Congress has considered the relevant competing concerns but has not provided the privilege itself.”23 Congress has legislated on workplace discrimination at length and repeatedly, and has never once created a shelter for the employer who audits itself. Lower courts have taken the hint.24

The gap between what people think this doctrine does and what it does is (I suspect) responsible for a meaningful number of unprotected internal reports currently sitting in company file shares.

Where does that leave the audit itself? If you want an outside expert’s fairness analysis inside the privilege, you are relying on a doctrine that comes from a 1961 case about an accountant, which extends privilege to a third party whose presence is “necessary, or at least highly useful, for the effective consultation between the client and the lawyer.”25 It works well enough, but it also fails in pretty predictable ways: when the vendor is engaged by the product team rather than by counsel; when the same firm is doing your model tuning under the same contract; when the report is circulated to twenty people in engineering; or when the expert is generating fresh substantive analysis of their own rather than helping counsel understand the client.26 And there is a structural problem with using your statutory auditor for the job, since New York City requires that auditor to be independent of you, which is difficult to square with taking direction from your lawyers.27

There is one more potential failure mode, and it usually catches the companies who are trying hardest. If your general counsel is properly useful in AI governance (sitting on the model review board, signing off on thresholds, deciding what ships), then counsel is doing operational work (and a court may well say so). That is roughly what happened in Koumoulis, where outside counsel was found to have become “an adjunct member of the human resources team” and her communications lost their protection accordingly.28 The more embedded your lawyer is, the more valuable they are and the less privileged their work becomes.

IV.The Price of Privilege

Privilege belongs to you, which means you can also give it up. The law says you give it up when you rely on the protected material to defend yourself. This is a fairness rule: you can’t wave a document at the jury and then refuse to let the other side read it. Employment lawyers have watched this play out for years with harassment investigations, where an employer who defends itself by pointing to the thoroughness of its internal investigation has thereby put the investigation in issue and must produce it, along with the notes and the interviews and the drafts.29

Which is awkward, given how a disparate impact case actually works. Once the plaintiff shows the disparity, the burden moves to the employer to demonstrate that the practice is job-related and consistent with business necessity.30 The way you carry that burden is with your validation evidence (i.e. the audit).

So the privilege holds right up until the moment you need it. Workday’s testing is protected today in part because Workday has not yet had to argue that its testing shows the tools are fine. When it does, the plaintiffs will be entitled to look.

California has gone further and made the whole calculation stranger. Since October 2025, the Civil Rights Council’s regulations on automated decision systems have provided that relevant to a discrimination claim (or a defense to one) is “evidence, or the lack of evidence, of anti-bias testing or similar proactive efforts to avoid unlawful discrimination, including the quality, efficacy, recency, and scope of such effort, the results of such testing or other effort, and the response to the results.”31 That phrase “or the lack of evidence” was added between the proposed text and the final one.32 In California, having never tested is now itself a fact about you that a plaintiff gets to put in front of a jury.

Meanwhile the federal government has spent the last year retreating from disparate impact entirely. An executive order in April 2025 directed every agency to deprioritize enforcement of disparate-impact liability, naming Title VII expressly.33 What it did not do (and could not do) is repeal the statute or close the courthouse to private plaintiffs.34 So the enforcement risk has moved rather than shrunk, away from agencies (which negotiate, and which have priorities that change with administrations) and toward private class litigation (where few negotiate and discovery is a contact sport). For anyone thinking about privilege, that is the worse of the two worlds.

V.Reasonable Effort

If you test your AI system and it comes back clean, you have gained a modest amount of comfort. If you test it and it comes back ugly, you have created a document proving that you knew. Under pure litigation logic the dominant strategy is to leave it untested. And yet, nobody wants to be the company that decided ignorance was the safer position.35

Privilege is what breaks the trap, without making the problem disappear (again, the underlying numbers were always discoverable and always will be). What it changes is the cost of a first look. Inside a properly constructed privileged assessment you can ask the hard questions early, get answers you didn’t want, and spend the intervening period fixing it (crucially without the intermediate drafts of your own uncertainty becoming the centerpiece of somebody’s opening statement). You get to be wrong on the way to being right.

What ultimately protects a company here is the remediation the oversight made possible, and privilege buys you the room in which remediation can happen at a sensible pace, before something that would have taken a quarter to fix has hardened into six years of documented practice across four hundred customers. Congress understood this shape of incentive in the one real statutory self-testing privilege we have, in fair lending, which is conditional on the lender actually taking corrective action when the test turns something up.36 You get the protection because you fixed it, which is the right instinct, and employment law’s failure to copy it is the gap everyone is currently improvising around.

The improvisation is not especially hard, but it has to be deliberate and done first. Counsel scopes the assessment and engages the experts, rather than being shown the results afterwards. The privileged assessment and the published regulatory audit are two different exercises with two different vendors (because trying to make one document do both jobs generally means it does neither37). Distribution stays controlled; the findings that need to reach engineering arrive as instructions rather than as forwarded memos. None of this is exotic, but almost all of it is impossible to retrofit once the complaint has been served.

We built Privlex to make that first look defensible at the scale these systems actually run at, which is to say across thousands of model decisions a day in production rather than a sample of forty pulled for a compliance report during testing. Doing that work under privilege, without breaking the privilege in the process, is the part everyone finds hard and the part we do best.38

Let us help you look, and unlock value for you at the same time.