Title VII cases about hiring models are decided on documents, and the documents are decided long before the trial, in discovery. A plaintiff asks for six things. What comes back, and what stays back, is the practical content of this subject.
One order now answers several of those questions directly. On 28 May 2026, in Mobley v. Workday, Inc., Case No. 23-cv-00770-RFL in the Northern District of California, Magistrate Judge Laurel Beeler resolved three discovery disputes at once and filed the order the following day. Almost everything written about that order gets the outcome the wrong way round.
What follows takes the six requests in the order a plaintiff makes them, says who holds the material, what the court did with it, and what the underlying law is asking the document to prove.
Request one: the bias-testing results, and the three findings that sealed them
Bias-testing results are the first thing a plaintiff asks for, and in Mobley the request covered the code, the results and the underlying data together. Disparate impact evidence of that kind stayed sealed, because the court denied the motion to compel all of it.
Three findings carried the adverse impact material out of reach. The court recorded that the defendant’s “attorneys curated the data it used in the bias testing”, that “the overall purpose of the testing was to provide legal advice and not to be used in a business capacity”, and that “it has not submitted the data to a regulatory body”. On that basis: “Workday has shown more than mere direction by its attorneys. Thus, the bias-testing data is privileged.”
Read the three findings as a test, because that is how the next court will read them. Attorney curation of the inputs, a legal-advice purpose rather than a business purpose, and no submission to a regulator. Testing commissioned by a data science team to improve a product satisfies none of the three. Testing commissioned by counsel, scoped by counsel and used to advise on exposure satisfies all three.
Adverse impact work done before deployment sits differently from work done after a charge arrives. Pre-deployment work tends to be engineering output created for a product decision, which is hard to characterise as attorney-directed after the fact. Post-charge work is easier to shelter and arrives too late to change the design. Interpretation: an organisation that wants both a usable product signal and a protected legal analysis needs two workstreams with different owners, not one report wearing two hats.
Request two: the applicant data a platform holds but does not control
Applicant records are what adverse impact is computed from, so the second request goes after them. In Mobley the plaintiffs sought the applicant data belonging to the defendant’s customers, which the defendant stores on its own servers.
The court denied that too, and on a different ground. Privilege had nothing to do with it: “The plaintiffs have not shown that Workday has control of its customers’ data under Rule 34.”
Storage is not control, and adverse impact data is no exception. A platform holding employer data under contract may lack the legal right to produce it, which leaves the plaintiff to subpoena the employers one by one. Every employer using a shared hiring platform should read that holding twice, because it means the records sit with the employer for discovery purposes even when the employer cannot log in and export them without the vendor’s help.
Contract terms decide whether that is a problem. A licence that gives the employer no export right, no audit right and no obligation on the vendor to preserve applicant records leaves the employer unable to produce its own evidence and unable to point at anyone else’s.
Request three: the EEO-1 and OFCCP filings, produced because you filed them
One category did come out, and it is the category nobody commissions. The court ordered production of the defendant’s EEO-1 and Office of Federal Contract Compliance Programs documents, on the ground that “They are relevant to Workday’s knowledge of potential demographic disparities when utilizing the AI tools”.
Knowledge is the word to notice, because it is what a disparate impact plaintiff has to establish. Filings made to the government are not privileged, they are dated, and they establish what the organisation knew about its own demographics and when. A disparity visible in a filed report is a disparity the organisation is on notice of, whatever its sealed bias testing concluded.
Title VII reporting already puts demographic data in government hands for most large employers. An EEO-1 component 1 report gives workforce counts by job category, sex and race or ethnicity, and a federal contractor’s affirmative action programme records go further. None of that was created for litigation, and all of it is dated, which is exactly what makes it useful to a plaintiff establishing what the organisation could see.
So the shape of the order is the opposite of the usual summary. Material created for lawyers stayed in. Material already given to a regulator came out. Any bias audit published under a disclosure regime, such as the annual summary New York City requires, sits on the wrong side of that line by design, and the court’s own third finding says so.
Request four: the selection records 29 CFR 1607.4(A) already tells you to keep
Selection outcomes by group are what adverse impact analysis runs on, and federal regulation has told employers to keep them since 1978. Section 1607.4(A) of the Uniform Guidelines on Employee Selection Procedures provides that each user “should maintain and have available for inspection records or other information which will disclose the impact which its tests and other selection procedures have upon employment opportunities of persons by identifiable race, sex, or ethnic group”.
Part 1607 is still there. Pulling it from the electronic Code of Federal Regulations on 10 September 2026 returns 16,141 words. Pulling part 1608, the affirmative action guidelines the Commission rescinded in a final interpretive rule effective 6 July 2026 and applicable as of 29 June 2026, returns three words: “PART 1608 [RESERVED]”.
Disparate impact commentary confuses those two parts constantly. One was rescinded, the other was not, and the one that survived is the one that governs selection procedures.
Nothing in part 1607 protects these records. Selection records predate the dispute, were not created for counsel, and are the first thing a plaintiff’s lawyer asks for once the complaint survives a motion to dismiss.
Request five: the validation study the Justice Department calls unconstitutional
Validation is what adverse impact triggers under the Uniform Guidelines, and the study is request five. Section 1607.3(A) provides that use of any selection procedure with an adverse impact “will be considered to be discriminatory and inconsistent with these guidelines, unless the procedure has been validated in accordance with these guidelines”, and sections 1607.5 and 1607.14 set out criterion-related, content and construct validity with technical standards for each.
An Office of Legal Counsel opinion dated 9 June 2026, signed by Assistant Attorney General T. Elliot Gaiser and addressed to the EEOC Chair, attacks that provision directly. The opinion concludes that “Disparate-impact liability as currently interpreted by EEOC is unconstitutional”, and that “The Guidelines unconstitutionally saddle employers with an atextual and onerous validation requirement for employment practices that are presumptively job-related and matters of business necessity”.
Disparate impact survives in the opinion’s own argument, which matters as much as its conclusion. The opinion says disparate impact is legitimate only as “an evidentiary mechanism to smoke out intentional discrimination”, and names three prerequisites to liability: an appropriate threshold for business necessity, a demanding standard of causality, and “evidence of an equally effective alternative practice that causes less disparate impact”.
Reach is the limit. An OLC opinion binds the executive branch, not a federal judge, and part 1607 remained in the Code of Federal Regulations three months after it issued. An employer producing no validation evidence in discovery because the Justice Department disapproves of the requirement will be explaining that to a court which is not bound by the opinion.
Title VII validation standards carry a technical mismatch problem, and that is the better argument. Criterion-related, content and construct validity were written for tests administered to identifiable candidates under controlled conditions. A model retrained quarterly on production data, scoring features that change between versions, fits none of the three cleanly. Interpretation: that mismatch is a reason to document the validity evidence a model can actually support, not a reason to hold none.
Request six: the alternative practice you considered and did not adopt
Title VII carries a second route to liability that most bias audits never address. Under 42 U.S.C. 2000e-2(k)(1)(A)(ii), a plaintiff establishes disparate impact by making the demonstration described in subparagraph (C) “with respect to an alternative employment practice” where the respondent “refuses to adopt such alternative employment practice”.
Title VII’s second route is what makes the sixth request ask what else you looked at. Candidate models, thresholds, feature sets and vendors considered and rejected are all responsive, and the comparison that shows a rejected option had a smaller disparity is the plaintiff’s case.
Silence is no defence to a disparate impact claim, and neither is the absence of any comparison. A selection process built without ever testing an alternative leaves the plaintiff free to propose one, and the employer arguing about it for the first time in litigation is arguing from nothing.
What the requests are proving: section 703(k) and the clause about opacity
Title VII’s text is what all six requests are aimed at. Section 703(k)(1)(A)(i) establishes liability where a complaining party “demonstrates that a respondent uses a particular employment practice that causes a disparate impact” and the respondent “fails to demonstrate that the challenged practice is job related for the position in question and consistent with business necessity”.
One clause written in 1991 for multi-component selection processes lands squarely on modern models. Subparagraph (B)(i) requires a plaintiff to isolate each challenged practice, “except that if the complaining party can demonstrate to the court that the elements of a respondent’s decisionmaking process are not capable of separation for analysis, the decisionmaking process may be analyzed as one employment practice”.
Read that against an ensemble with several hundred features and no feature-level explanation. Opacity an employer cannot resolve is not a defensive asset under this clause, because inability to separate the elements is the condition that lets a plaintiff attack the process whole.
Disparate impact must be traced to a particular practice, and a hiring funnel has many. A sourcing algorithm, a knockout question, a resume parser, an assessment score, a scheduling step and a recruiter’s shortlist each sit between an application and an offer.
Isolating which one produced the disparity is the plaintiff’s first problem and the employer’s first defence, and stage-level selection rates are what answer it. An employer holding only the end-to-end ratio has the number that proves the claim and none of the numbers that narrow it.
Title VII puts the second burden on the employer, and it is evidentiary rather than argumentative. Job relatedness has to be shown for the challenged practice in the position at issue, which means evidence tying the screen to the work. A feature that improves model accuracy is not thereby job related, because accuracy at predicting a historical label is not relatedness to the duties of a job. Most algorithmic defences fail on that distinction.
The four-fifths number in your report, and the two sentences printed beside it
Impact ratios are where adverse impact meets arithmetic, and one sentence governs them. Section 1607.4(D) provides that “a selection rate for any race, sex, or ethnic group which is less than four-fifths (4/5) (or eighty percent) of the rate for the group with the highest rate will generally be regarded by the Federal enforcement agencies as evidence of adverse impact”.
Adverse impact carries two qualifications in the same paragraph, and they rarely travel with it. Smaller differences “may nevertheless constitute adverse impact, where they are significant in both statistical and practical terms”. Greater differences “may not constitute adverse impact where the differences are based on small numbers and are not statistically significant”.
An impact ratio of 0.83 is therefore not a pass, and 0.78 is not a finding of liability. Any report presenting 0.8 as a line is reporting a prosecutorial convention as a legal standard, and a report that omits the sample size next to the ratio has omitted the thing the second qualification turns on.
Adverse impact computed one attribute at a time can also miss a disparity that appears only at an intersection. A screen passing men and women at similar rates, and passing white and Black candidates at similar rates, can still reject Black women at a rate no single-attribute view reveals. New York City’s audit rules require the intersectional breakdown; the Uniform Guidelines do not name it; and a plaintiff who finds it will not care which document asked for it.
Title VII guidance used to say exactly this, and it is no longer on the agency’s website. Requesting the three EEOC technical assistance documents on algorithmic decision-making on 19 September 2026 returns HTTP 404 for the Title VII document, the Americans with Disabilities Act document and its questions and answers.
Title VII guidance from May 2023, in an archived copy running eight pages, says the four-fifths rule “is merely a rule of thumb”, suggesting employers ask a vendor “whether it relied on the four-fifths rule of thumb … or whether it relied on a standard such as statistical significance that is often used by courts”.
Vendor responsibility was answered in that archived document before any court reached it. The guidance said an employer “may be responsible under Title VII if the procedure discriminates on a basis prohibited by Title VII, even if the test was developed by an outside vendor”, and that employers “may be held responsible for the actions of their agents, which may include entities such as software vendors”. The Mobley court allowed claims to proceed against the vendor on that same agency theory, two years after the agency deleted the page that stated it.
Who is still asking: agencies stood down, states legislated, preemption opened
Executive Order 14281, “Restoring Equality of Opportunity and Meritocracy”, was signed on 23 April 2025 and published five days later, and it is more specific than most summaries suggest. Section 4 instructs that “all agencies shall deprioritize enforcement of all statutes and regulations to the extent they include disparate-impact liability, including but not limited to 42 U.S.C. 2000e-2”.
Its machinery explains the year that followed. Section 5(b) gave the Attorney General 30 days to report every existing regulation, guidance, rule or order imposing disparate-impact liability, “and detail agency steps for their amendment or repeal”. Section 6(a) gave the Attorney General and the EEOC Chair 45 days to assess all pending investigations, civil suits and positions relying on the theory. The part 1608 rescission and the June 2026 opinion are outputs of that instruction.
Two further sections point forward. Section 7(a) directs the Attorney General to determine whether federal authorities “preempt State laws, regulations, policies, or practices that impose disparate-impact liability”, which puts the state layer described below inside the same project. Section 7(b) requires the Attorney General and the EEOC Chair to “jointly formulate and issue guidance or technical assistance to employers”, and no such joint guidance has been published as at 19 September 2026.
Title VII litigation runs on a separate track throughout. A claim reaches court through a charge and a right-to-sue letter, and agency posture changes how much happens in the middle of that sequence rather than the beginning or the end. Interpretation: a quieter Commission produces more private suits, not fewer, because the process that once resolved claims administratively is resolving fewer of them.
Illinois, California and New York City each ask for something different
Disparate impact moved into state law while federal policy moved away from it, and the three regimes ask for different documents. Illinois amended its Human Rights Act with effect from 1 January 2026 under House Bill 3773, making it a civil rights violation to use artificial intelligence that has the effect of discriminating on a protected basis, to use zip code as a proxy for a protected class, and to fail to give notice that artificial intelligence is being used in an employment decision.
Rules giving that disparate impact duty content do not exist. The Illinois Department of Human Rights published proposed amendments to Title 44, Part 2520 of the Illinois Administrative Code on 15 May 2026 and withdrew them on 2 June 2026, a step both firm alerts describing it call temporary, with no revised timeline given. So the statute binds, the notice duty binds, and nothing tells an employer what evidence satisfies either.
Disparate impact became evidence in California by regulation instead. Civil Rights Department regulations on automated-decision systems under the Fair Employment and Housing Act took effect on 1 October 2025, carry a four-year retention period for automated-decision system data, and make “evidence, or the lack of evidence, of anti-bias testing or similar proactive efforts to avoid unlawful discrimination, including the quality, efficacy, recency, and scope of such effort, the results of such testing or other effort, and the response to the results” relevant to a discrimination claim.
Adverse impact auditing is compulsory in New York City, which requires it rather than merely weighing it. Local Law 144 has been enforced since 5 July 2023 and obliges an annual independent bias audit of automated employment decision tools used for hiring or promotion, publication of a summary of results, and notice to candidates. Publication is what distinguishes it, and publication is also what forfeits the shelter the Mobley order described.
Article 4a permits the data collection that American law leaves you guessing about
Adverse impact testing needs protected-class data, and the two continents differ on whether you may hold it. Article 4a of the EU AI Act, inserted by the Digital Omnibus, is headed “Processing of special categories of personal data for bias detection and correction”.
The article permits providers of high-risk systems to process such data where “strictly necessary to ensure bias detection and correction in relation to high-risk AI systems in accordance with Article 10(2), points (f) and (g)”. Six conditions attach, covering necessity, technical limitation, access control, no onward transfer, deletion once the bias is corrected, and a recorded justification.
Adverse impact work turns on placement as much as permission. Article 4a sits in Chapter I, which has applied since 2 February 2025, while the Article 10 duties it serves attach to high-risk systems classified under Article 6(2) from 2 December 2027. The permission is therefore live before the obligation it supports.
Article 4a also sets its own limit, in a sentence worth quoting to anyone who reads it as a mandate: “This paragraph does not create any obligation to conduct such bias detection and correction”.
American employers have no equivalent permission and a good deal of caution about collecting race and ethnicity outside the contexts where reporting already requires it, which is why so many United States audits rest on imputed rather than observed categories. Imputation is a methodological choice that belongs in the report, next to the sample size.
What to hold before anyone asks
Discovery rewards the organisation that decided what to keep before it had a reason to. Six records answer the six requests, and each one is cheap to create and impossible to reconstruct.
Selection outcomes by protected group with the date and the tool version attached, because every analysis on this page is computed from them and section 1607.4(A) already expects them. Impact ratios reported with a statistical significance test and the sample size, so the analysis survives both qualifications in 1607.4(D). A dated job-relatedness rationale for each screen that drives the decision, which is the business necessity defence written before it is needed.
A record of the alternatives considered and the reason for the choice, which answers the second route to liability. Vendor answers in writing on what testing was done and against which standard, together with the contractual right to obtain applicant records, because the Rule 34 holding turns on control. And a log of what changed after each finding, which is the item every state regime turns into the material question.
Adverse impact monitoring belongs on the cadence of change rather than on an annual calendar, because a model moves between audits and a candidate pool moves between seasons. Retraining, threshold tuning, a new sourcing channel and a shift in the applicant mix each move the ratio without anyone touching the code that computes it. Tying review to those events, and recording the tie, is what converts a periodic number into a control.
Governance software earns its place at exactly that point, and adverse impact evidence is the problem Govern365.ai was built around. Holding the selection data lineage, the test results, the job-relatedness rationale, the alternatives considered and the vendor attestations in one dated place turns a defence into a file rather than a reconstruction.
Govern365.ai maps each obligation to the record that proves it across Title VII, the EU AI Act, ISO/IEC 42001 and the NIST AI Risk Management Framework, so an employer answering a charge in Chicago and a conformity assessment in Dublin works from one artefact.
Six requests and what each one produced
| Request | Who holds it | Outcome in the 28 May 2026 order | What it proves |
| Bias-testing code, results and data | The organisation, via counsel | Motion to compel denied, privileged | Whether the disparity was measured and what was found |
| Customers’ applicant data | Stored by the platform, owned by employers | Motion to compel denied, no Rule 34 control | Selection rates by group |
| EEO-1 and OFCCP filings | The organisation, already filed | Production ordered | Knowledge of demographic disparities |
| Selection records under 1607.4(A) | The employer | Not at issue in this order | Impact of the selection procedure |
| Validation study under 1607.5 and 1607.14 | The employer or the vendor | Not at issue in this order | Job relatedness and business necessity |
| Alternatives considered | The employer | Not at issue in this order | Whether a less discriminatory option was refused |
Frequently Asked Questions
Is a bias audit protected by attorney-client privilege?
The 28 May 2026 order in Mobley protected bias-testing data on three findings: attorneys curated the data, the purpose was legal advice rather than business use, and the data had not been submitted to a regulator.
What did the court order produced in that ruling?
The EEO-1 and Office of Federal Contract Compliance Programs documents, because they were relevant to the defendant’s knowledge of potential demographic disparities when using the AI tools.
Why was the applicant data not produced?
The court held that the plaintiffs had not shown the platform has control of its customers’ data under Rule 34, which is a separate question from privilege.
Does publishing a bias audit remove its protection?
Submission to a regulatory body was one of the three findings supporting privilege in Mobley, so a summary published or filed under a disclosure regime sits outside the shelter that order described.
Is disparate impact still the law?
Section 703(k) is unamended and Griggs v. Duke Power Co. is undisturbed. A Justice Department opinion and an executive order change agency enforcement rather than the cause of action.
Did the EEOC rescind the Uniform Guidelines?
Part 1607 remains in the Code of Federal Regulations at 16,141 words. Part 1608, the separate affirmative action guidelines, was rescinded effective 6 July 2026 and now reads reserved.
Does an impact ratio above 0.8 mean the tool is lawful?
Section 1607.4(D) says smaller differences may still constitute adverse impact where they are significant in statistical and practical terms, so the ratio is a screening convention rather than a legal threshold.
Where did the EEOC guidance on AI hiring go?
Removed from the agency website in early 2025. The three relevant pages return 404, no successor has been published, and the joint guidance Executive Order 14281 directed has not appeared either.
Can an employer be liable for a vendor’s tool?
The withdrawn technical assistance said an employer may be responsible even where an outside vendor developed the test, and the Mobley court allowed claims against the vendor itself on an agency theory.
What does Illinois require from 1 January 2026?
Use of artificial intelligence with a discriminatory effect and use of zip code as a proxy are civil rights violations, and employers must give notice that artificial intelligence is being used in an employment decision. Implementing rules were withdrawn on 2 June 2026.
May a provider collect race data to test for bias in Europe?
Article 4a of the EU AI Act permits processing special categories of personal data where strictly necessary for bias detection and correction, subject to six conditions, and states that it creates no obligation to conduct that testing.
What is the single most useful record to start with?
Selection outcomes by protected group with the date and the tool version attached, because every other analysis is computed from it and none of it can be reconstructed later.
