AI Hiring Liability 2027: Who Pays When the Algorithm Rejects the Wrong Person
Why employers answer first for AI screening errors, what the 2027 deadlines change, and the audit to run now.
Employers, not vendors, answer first when AI screening rejects the wrong people. Here are the cases, the 2027 deadlines in Colorado and the EU, and an eight-week audit.
TL;DR
AI hiring liability sits with the employer, not only with the software vendor. If a screening tool rejects the wrong people in a pattern, the company that made the hiring decision is the one regulators and plaintiffs reach first. The two numbers to remember are up to $20,000 per violation in Colorado from 1 January 2027, and $100 to $1,000 per applicant in statutory damages if a scoring tool is ever treated as a consumer report. Courts are still deciding how much of the bill a vendor shares, which is exactly why human-in-the-loop hiring has stopped being a courtesy and become a legal control.
What is actually happening
Three things changed in the last eighteen months, and they point the same way. First, the lawsuits got real. In Mobley v. Workday, a federal court in California allowed an age discrimination collective action to proceed in 2025 and later extended it to applicants screened by a second vendor tool. Court documents in the case reference 1.1 billion rejected applications processed through the vendor's software, which is the scale that makes plaintiffs' lawyers pay attention.
Second, the theory of harm widened. In January 2026, two applicants sued Eightfold AI in California, alleging its candidate scores work like hidden credit reports under the Fair Credit Reporting Act. That complaint does not claim the AI is biased at all. It claims candidates were scored without notice, consent, or a chance to dispute the score, so even a perfectly fair model can create exposure.
Third, the federal safety net thinned while state rules thickened. The US equal employment regulator removed its AI hiring guidance from its website in January 2025, but legal commentators were quick to point out that removing guidance does not repeal Title VII or the Uniform Guidelines on selection procedures. California's automated decision rules took effect on 1 October 2025 and can treat a vendor as the employer's agent. Illinois followed on 1 January 2026 with a disparate impact standard and a duty to notify workers.
Not every case lands. A litigation tracker reports that a federal court in Michigan dismissed Harper v. Sirius XM without prejudice on 30 September 2026, and the Eightfold motion to dismiss was still pending in October. The honest summary is that no court has yet issued a final liability finding against an AI hiring tool. That is a statement about timing, not safety.
If you want the rulebook in more detail, our AI compliance in hiring guide walks through the rules by jurisdiction. This post is about the other side of the same coin: who pays, and how much, when something goes wrong.
The numbers
Start with what the statutes actually say. Under the US Fair Credit Reporting Act, a willful violation carries statutory damages of $100 to $1,000 per consumer, plus punitive damages and the plaintiff's attorney fees. Those are small numbers per person, which is the point: class actions multiply them by the size of the applicant pool.
The chart below is illustrative arithmetic, not a forecast. It multiplies the statutory range by five applicant pool sizes, in US dollars, because the source data is American. A team screening 2,000 applicants a year is looking at up to $2 million on paper, before any punitive award or fees.
- How to read this: Each bar runs from the $100 floor to the $1,000 ceiling per applicant, multiplied by the pool size on the left. Real outcomes depend on proof of willfulness and on whether a court treats the tool as a consumer report at all.
- What it leaves out: Discrimination claims carry separate remedies, and Colorado adds up to $20,000 per violation. Defence costs come on top of any award.
- Why it still matters: The pool size is the lever. An automated filter touches every applicant, so one flaw is replicated thousands of times, while a human recruiter's flaw is capped by their calendar.
How it actually works, and where it breaks
Liability in hiring is mostly about outcomes, not intent. The standard test is disparate impact: if a selection step passes one group at a much lower rate than another, the employer must show the step is job related. The US rule of thumb is the four-fifths rule. If one group's selection rate is below 80 percent of the highest group's rate, that generally signals adverse impact, though the regulator called it a rule of thumb rather than an absolute test.
The 2023 US technical assistance on this point stated that an employer may be liable for adverse impact from a tool even when an outside vendor built or ran it. It also said a vendor's wrong assurance does not remove that liability. The guidance page is gone, but the underlying law is not, and the Workday case is testing the vendor side of the same question.
The first failure mode is the black box with no evidence trail. Most employers cannot say what a tool scored, on what data, or why a candidate fell below the line. When a claim arrives, "the vendor handles that" is not a defence, and it is also not evidence.
The second is silent drift. A model that was tested at purchase can change after an update, a new job family, or a shift in the applicant pool. Our piece on AI screening false negatives covers how qualified people get filtered out without anyone noticing.
The third is the missing human. A tool that auto-rejects with no review, no notice, and no appeal route is the pattern that every recent complaint describes. Colorado's new law and the European rules both turn on whether a person can actually review the decision.
"A vendor can sell you the model, but it cannot sell you the defence when the rejection letter carries your company's name."
What this means for your team
The rules now differ by place, so map where your applicants live, not just where your company sits. Colorado's replacement law, SB 26-189, takes effect on 1 January 2027. Only the state Attorney General enforces it, there is no private right of action, and violations can draw fines of up to $20,000 each. If AI materially contributes to an adverse decision, the employer must disclose the tool's role within 30 days and explain how to seek reconsideration. A proposed federal policy statement has questioned whether the law is preempted, so watch that space.
In the European Union, an omnibus regulation published on 24 July 2026 moved the high-risk obligations, which include recruitment and candidate ranking, to 2 December 2027. That is a delay, not a reprieve. Systems bought now will still be running when the date arrives.
Indian teams are not outside this. If you screen applicants in the US or EU, run roles for clients there, or use a tool that processes their data, their rules can follow the candidate. Nothing here is legal advice, so confirm specifics with counsel, but the operating sequence below holds in every jurisdiction.
Eight weeks is realistic for a team with one recruiter, one analyst, and the vendor on speaker phone. The order matters: you cannot test what you have not inventoried, and you cannot defend what you have not logged.
AI screening vs manual screening
The comparison most leaders want is whether automation is riskier than a human doing the same job. It is different, not strictly riskier. Manual screening produces inconsistent but scattered errors, so the harm is spread thin and hard to prove as a pattern.
Automated screening produces consistent errors at scale, which is exactly what a disparate impact claim needs. The flip side is that automation is measurable. You can test a tool every month in a way you can never test a tired recruiter on a Friday, and that measurability is your best defence. Our guide on bias-free hiring with AI covers the testing methods in more depth.
How to actually do this (and the four traps)
Run the audit in this order: inventory every automated step, collect vendor evidence in writing, test selection rates by group, set notice and review rules, keep logs, and re-test on a schedule. Most teams skip straight to the vendor questionnaire, which is where the traps start.
- Trusting the vendor's bias audit as your own. A vendor report covers the vendor's test data, not your applicant pool. Run the four-fifths check on your own funnel, stage by stage, and keep the output.
- Auditing once at purchase. A tool is a moving target. Re-test after every model update, new role family, or channel change, and at least once a quarter.
- Treating notice as a legal footer. Colorado, Illinois and the FCRA theory in the Eightfold case all turn on telling candidates what is being scored. Put plain-language notice in the application flow, and make sure it matches what the tool really does. Our note on recruitment data privacy covers the data side.
- Auto-reject with no human path. Every rejection below a score line should be sampled by a person, and candidates should have a route to ask for review. If you cannot show the sample, the control does not exist.
"Fairness you tested once at purchase is a photograph, and regulators will ask for the video."
The one thing every hiring leader should take from this
You cannot outsource the decision, so you cannot outsource the liability. Buy the tool if it saves time, but keep the evidence, the sampling, and the notice in your own hands, because those are the three things a regulator or a plaintiff will ask for first. The vendors will be dragged into these cases too, yet that is cold comfort when your name is on the rejection letter.
The teams that handle this well are not the ones with the biggest legal budget. They are the ones that wrote the process down before anyone asked. If you want a second pair of eyes on your funnel, we look at this stuff all day.
Frequently Asked Questions
The employer is liable first, because the employer makes the hiring decision. US regulators have stated that an employer can be responsible for adverse impact from a tool even when an outside vendor built or ran it. Whether the vendor shares liability is still being tested in cases such as Mobley v. Workday, where the question is whether a vendor can act as the employer's agent.
Yes. The company that rejects the candidate can face discrimination claims regardless of who wrote the algorithm. Vendors can also be sued directly, as the Mobley v. Workday and Kistler v. Eightfold AI cases show, and in practice both parties often end up involved once discovery begins.
It is a rule of thumb from US selection guidelines. If one group's selection rate is below 80 percent of the highest group's rate at a hiring step, that generally signals adverse impact. It is not an absolute legal test, and smaller gaps can still matter when a tool processes many applicants.
Yes. Colorado's replacement law, SB 26-189, takes effect on 1 January 2027 and lists employment among the covered decision areas. The Attorney General enforces it, there is no private right of action, and fines can reach $20,000 per violation. Employers must disclose the AI's role in an adverse decision within 30 days and offer a route to reconsideration.
An omnibus regulation published on 24 July 2026 moved the application date for high-risk systems, which include recruitment and candidate ranking, to 2 December 2027. Tools you buy today will still be in use on that date, so vendor contracts should already ask for conformity evidence.
No court has issued a final liability finding. The court allowed an age discrimination collective action to proceed in 2025 and extended it to applicants screened by a second vendor tool. In September 2026 the plaintiffs moved to certify a broader class, with a hearing set for March 2027, according to litigation trackers.
That is the open question in Kistler v. Eightfold AI, filed in January 2026. The plaintiffs argue that candidate scores work like consumer reports, which would require notice, authorisation and a way to dispute them. The case was at the motion to dismiss stage in autumn 2026, so treat it as a risk to plan for rather than settled law.
They can. If you screen applicants located in the US or EU, hire for clients there, or use tools that process those candidates' data, those rules can reach you. This is general information, not legal advice, so confirm your position with counsel who knows the relevant jurisdiction.
At least once a quarter, and again after any model update, new role family or change in sourcing channel. A single audit at purchase only proves the tool passed on one day with one dataset.
