Why the May 29 Workday Ruling Should Change How HR Teams Pick AI Hiring Tools | McCoy BlogSkip to contentHiringWhy the May 29 Workday Ruling Should Change How HR Teams Pick AI Hiring Tools
Josh Gafni<br>June 3, 2026
What the Court Did Last Month<br>On May 29, 2026, Magistrate Judge Laurel Beeler of the Northern District of California issued a discovery order in Mobley v. Workday, Inc. resolving three disputes:<br>Workday's internal bias-testing data is protected by attorney-client privilege . Plaintiffs cannot compel it.
Workday is not required to produce its customers' applicant data , because Workday does not "control" that data under Rule 34.
Workday's own EEO-1 and OFCCP filings are ordered produced .
This is a discovery order in one case, not a substantive ruling on liability and not binding precedent on other courts. But it draws a line that matters for any employer using an AI screening tool, and points to a single practical conclusion: your choice of tool, and how much it automates, is the part of your risk you must account for when hiring.<br>The Case Behind the Order<br>The named plaintiff is Derek Mobley, an African American man over forty who alleged various disabilities under the ADA. Beginning in 2017, he applied to over one hundred positions through employers using Workday and was rejected from every one. Four additional plaintiffs over forty joined him, alleging hundreds of similar rejections.<br>The complaint frames the harm structurally. The plaintiffs allege that Workday's AI screening systems reproduce and amplify historical hiring disparities through "proxy variables"; these are features that correlate with race, age, or disability without being labeled as such. The legal theory advanced is that Workday acts as an "agent" of its customer-employers when its tools (e.g., AI Screeners) score, sort, or screen candidates, and so falls within Title VII, the ADEA, and the ADA.<br>The Workday Products at Issue<br>The order names the specific tools in dispute:<br>Candidate Skills Match — Workday Recruiting's algorithmic feature that scores how well an applicant's skills match a role.
Spotlight — a candidate review tool that scores an applicant's fit against job requirements. Acquired by Workday in 2024 when it bought HiredScore.
Fetch — a sourcing tool that surfaces individuals for open roles. Also from the HiredScore acquisition.
All three produce algorithmic outputs that an employer's recruiter then acts on. Workday's relationship with its customers is governed by a Master Subscription Agreement under which "Customer owns all right, title and interest to its Customer Content." That ownership clause is load-bearing for the customer-data ruling discussed in detail below.<br>What the Order Actually Held<br>Bias-testing data: privileged<br>Workday represented to the court that its bias testing of Candidate Skills Match was conducted "at the direction and under the guidance of its legal counsel for the purpose of rendering legal advice," with access restricted to those who needed it to give that advice. This ruling rejected Plaintiffs' arguments that the underlying data is factual and not privileged, that counsel was acting in a "business capacity" (i.e., not a legal advisor), and that Workday waived privilege by publicly claiming in its AI Fact Sheet that it performs bias testing.<br>In rejecting each argument, the Court applied the eight-part Ruehle test for attorney-client privilege, and held that "Workday has shown more than mere direction by its attorneys," and that:<br>Workday's invoking the mere existence of its bias testing outside of litigation is not enough to waive privilege.
Two qualifiers matter. First, the court emphasized that privilege "is strictly construed." Workday cleared a high bar; it does not follow that all vendor bias-testing programs would. Second, Workday is not claiming privilege over everything. The court noted: "there may be some information that is not privileged" and Workday has disclosed underlying data it is not asserting privilege over. The order addresses only the bias-testing data Workday is actively claiming. The Court did state, however, that the testing data may be relevant to the proceedings, but was still privileged.<br>Notably, Workday did not claim privilege over a separate 2023 bias audit of Spotlight performed by an external consultant under NYC Local Law 144. Testing structured to face a regulator is treated differently from testing structured through counsel.<br>Customer applicant data: outside Workday's control<br>Plaintiffs sought the applicant data sitting inside Workday's customers' systems, pointing to a clause in the Master Subscription Agreement allowing Workday to disclose customer information "to the extent required by Law." But that same clause lets the customer "seek injunctive relief to enjoin any breach or threatened breach."<br>The court held that this conditional permission is not "control" in the Federal Rule 34 sense:<br>the court cannot say that Workday has a legal right to obtain...