FEHA's application to California-based AI vendors

The court's most significant holding is that FEHA reaches Workday's conduct as a California-based agent engaging in allegedly discriminatory screening on behalf of employer-customers nationwide. The court rejected three principal arguments for dismissal:

Direct vs. derivative liability. Workday argued its liability as an "agent" turns on its employer-customers' liability. The court held this is "at odds with the FEHA's concept of agency liability". Workday is directly liable for its "own engagement in FEHA-regulated activities on the employer's behalf" independent of employer-customer liability.
Extraterritoriality. Workday argued FEHA cannot be applied based solely on California operations. The court disagreed and held that because Workday designs, develops and operates the tools from California, plaintiffs adequately alleged tortious discriminatory conduct occurring in California.
Products-liability analogy. The court rejected Workday's analogy to choice-of-law analysis in products-liability cases, reasoning that such cases do not illuminate FEHA's text, structure or remedial intent to "prevent and deter unlawful employment practices." The court declined to reach Workday's constitutional arguments, leaving them for a fuller factual record.

Key legal implications

Nationwide reach: A California-domiciled AI hiring-tool vendor may face FEHA liability for discriminatory outcomes nationwide, independent of whether any employer-customer would itself be subject to FEHA.
FEHA "agent" liability: The court held that Workday, operating as an "agent" of its customers, could still be held liable and "share liability" with its customers.
Product-suite sweep: Liability theories and collective definitions may encompass a vendor's entire AI feature set, including acquired products running on third-party systems, under a "unified policy" theory.

How employers can mitigate risks

To mitigate risks from potential AI-related lawsuits, employers and HR departments should take certain mitigation measures, including:

Develop clear company policies and guidelines regarding use of AI tools in the workplace, especially with HR-related functions such as recruitment, promotions, benefits, disciplinary actions, etc.
Before contracting with an AI vendor, request more information from the vendor to better understand the legal implications of the vendor's AI tools. Companies may want to create a list of standard questions posed to an AI vendor.
When contracting with an AI vendor, HR and legal departments should consider the allocation of responsibilities and risks in key employment compliance areas, including:

1. compliance with federal, state and local anti‑discrimination and employment laws;
2. ADA and accessibility compliance in the screening process;
3. data sources and accuracy of data;
4. bias testing, impact assessments and audit rights (including access to information needed to evaluate adverse impact);
5. data security and retention obligations;
6. compliance with applicable laws regarding required notice and applicant consent; and
7. allocation of liability and indemnification for claims arising from the AI tool or application.

Before deploying an AI tool, ensure that all necessary disclosures are made to those affected by the AI tool (e.g., job applicants), and obtain any legally required consent. In general, the more transparent a company is, the more insulated the company is from legal risks.
Once an AI tool has been deployed, maintain adequate human oversight of any AI tools and document such oversight. In the HR context, human oversight should look for indicia of bias, disparate impact, inaccuracy of information or lack of transparency.

Instant Insights /

Why Mobley v. Workday has far-reaching legal impacts for HR leaders

Related Stories

Recommended For You