News Analysis
White Paper
The Future of Leadership Development: AI-Driven Manager Enablement
Hiring is hard. Now it's getting complicated.
Here's what the problem looks like. Post a job in New York and you may soon have to prove the role is real. Let your ATS vendor's AI screen candidates and you can inherit a discrimination claim. Let that same AI assign every applicant a score and, according to another lawsuit, you may have just used an illegal credit report.
Those three problems — the posting, the selection, the score — each come with their own legal theory, and none of them stops at the vendor.
The Job Posting Has to Be Real Now
Ghost jobs, postings with no intention of hiring behind them, have been an open secret for years. Research suggests roughly one in five postings may be ghost jobs, and possibly more in some industries. A working paper by Steven Singer and Derya Oktay, recognized by the National Association for Business Economics, flagged roughly 26% of LinkedIn postings in high-ghost industries as likely deceptive, with the market-wide figure closer to 20%.
Why do companies do it? Because resumes are useful even when nobody gets hired. "Even if they don't hire, from resumes they become aware of what competitors are doing and find out how much they are paying. They get an idea of what the talent pool looks like," Oktay told Reworked. Free market research, extracted from job seekers who think they're applying for real work.
Until now, nothing was stopping it. "Employers feel justified in posting ghost jobs. There are no laws against it," Oktay said. In the United States, that's still technically true, but not for long.
New York's S8877 passed both chambers on June 2 and sits on Governor Kathy Hochul's desk. If she signs it, employers with 100 or more employees must state in every posting, in bold capital letters, whether the job is a vacancy they intend to fill within 90 days, a vacancy they'll fill later, or not a vacancy at all. Filled jobs must come down within two weeks. Violations carry $2,500 fines per publication or platform, doubling every 30 days uncorrected with no cure period, and the state Department of Labor can audit.
The fines look small for a Fortune 500 company. But the doubling and audits should worry employers. Senator Mike Gianaris, the sponsor of the bill, called ghost postings "dishonest and exploitative."
New York isn't alone. New Jersey's S2136 mirrors the approach, and California and Kentucky have similar proposals in the legislative pipeline. Illinois amended its Human Rights Act to cover AI in employment decisions, effective Jan. 1. Ontario has had this in place since January: employers with 25 or more employees must state whether a posting is a real vacancy, disclose AI screening and tell interviewed candidates the outcome within 45 days. Corporate fines can reach $100,000. If your company hires in Toronto, you're already running the playbook that's about to go live in New York. And the New York bill takes effect the moment it's signed, so employers will have to get right with the rules the day it passes.
There's one more exposure that's already cost someone money. In February, the Justice Department settled with Elegant Enterprise-Wide Solutions, a Virginia IT firm whose AI-generated job ads, the department stated, illegally restricted roles to certain visa holders, screening out U.S. workers. The penalty was $9,460. The principle was bigger. Assistant Attorney General Harmeet Dhillon said the department won't tolerate discrimination "no matter who — or what — drafts a job advertisement."
The ad copy itself is your liability, even when a machine wrote it.
'We're Just Software' Failed in Court
The middle of the funnel is where Mobley v. Workday lives. The case has survived three motions to dismiss since it was filed in Feb. 2023. The short version of what has happened since: Judge Rita Lin granted preliminary certification of a nationwide collective of applicants 40 and older who were denied employment recommendations through Workday's platform from Sept. 24, 2020 to present. The notice process is underway.
Two things in Lin's order should make employers pay attention. She found the applicants alike in the way that matters because they allegedly had to compete "on unequal footing due to Workday's discriminatory AI recommendations." And when Workday argued the collective could include hundreds of millions of people, she was unmoved: "Allegedly widespread discrimination is not a basis for denying notice," she warned. In other words, scale is not a defense. The bigger the deployment, the bigger the class.
Workday continues to argue the case is "without merit" and says it is confident the claims will be dismissed once the facts are established. But the court has already treated the vendor as an agent of the employers using it, and it used Workday's own website against its claim that it doesn't recommend candidates.
Your vendor's marketing copy can now become evidence, and the way its algorithm treats applicants is on you.
The Score Itself May Be the Violation
The third front doesn't allege bias. Kistler v. Eightfold AI, filed in January in California state court, argues that the score itself is the problem. Eightfold's platform ranks candidates from 0 to 5 on their supposed likelihood of success, allegedly drawing on data beyond what applicants submitted. The plaintiffs say that makes each score a consumer report under the Fair Credit Reporting Act (FCRA), and Eightfold a consumer reporting agency that skipped required safeguards. Eightfold denies it, saying it doesn't scrape social media, instead working from data candidates and customers provide.
Here's why you should care even though you're not the defendant. The FCRA regulates the companies that use consumer reports, not just the ones that make them. "They must be given notice and a chance to dispute it. They need to know what data was used and in what context," Jenny Yang, a partner at Outten & Golden, the firm representing the Eightfold plaintiffs, and a former chair of the Equal Employment Opportunity Commission, told Reworked. Before rejecting someone based on a report, an employer must hand over a copy and a summary of rights, then wait for a reasonable window before finalizing the rejection.
The obligation runs the other direction too. An employer "must certify to the consumer reporting agency" that it complied with the FCRA, provided a clear disclosure to the applicant and will follow adverse-action requirements, M. Alejandra Parra-Orlandoni, COO of Pasteur Labs and a senior fellow at Harvard's Kennedy School, told Reworked. She co-wrote a recent Harvard Business Review analysis of enterprise AI liability. One of those certifications is a promise that the report won't be used to violate equal employment laws.
Do the math. If AI hiring scores are consumer reports, then applicants got no notices, had no chance to dispute anything and vendors collected no certifications — both halves of the transaction have been out of compliance the whole time. And the complaint names the Eightfold customers: Microsoft, PayPal, Morgan Stanley, Starbucks, Chevron and Bayer.
The CFPB warned back in 2024 that FCRA rules apply to algorithmic scores used in employment decisions. Employers were on notice.
One Hiring Funnel, Three Legal Theories
The stories look separate, but they aren't. Every stage of your funnel now has a legal theory attached: the posting (transparency law), the selection (discrimination), the score (FCRA). And the layers feed each other. Ghost postings harvest resumes. Harvested applicant data is exactly what feeds AI screening systems. The practice regulated at the top of the funnel supplies the systems being litigated further down.
There are problems on both sides. Generative AI made applying nearly free. LinkedIn told The New York Times in mid-2025 that job applications had surged 45% year-over-year. Employers cite this flood of polished, identical-looking candidates to justify algorithmic screening. The tools employers bought to manage that flood are the same tools now being challenged in court.
Engaged, But Not Convinced: What's Eroding Beneath Your Strongest Engagement Numbers
Watch Now
Retention Is a Communication Problem: New Data from 6,000+ Employees
Watch Now
A harder finding buried in the ghost-jobs research connects the top of the funnel to the bottom.
The Singer-Oktay paper found ghost postings concentrate in occupations with higher shares of Black and Hispanic workers, while heavily white, college-educated occupations were largely insulated. The working paper has real limits: one week of LinkedIn data, ghost status inferred rather than confirmed, no causal claims. But if posting behavior itself has disparate demographic impact, then the transparency laws and the discrimination suits were never separate problems. Worth noting who's building this analysis: the economics team inside the same firm suing Eightfold. The plaintiffs' bar isn't waiting for regulators.
Federal regulators, for what it's worth, have stepped back. The EEOC's AI guidance was withdrawn in early 2025 after the administration change, though the discrimination laws it interpreted haven't gone anywhere. That vacuum is precisely why the action moved to private litigation and the states. Workers, meanwhile, have already made up their minds. New Jersey's teachers' union warned members in June that at its worst, AI hiring "hides bias behind a 'math' facade."
Who Pays When the Model Is Wrong?
Courts are treating AI vendors as agents of the employers that use them. Vendor contracts, meanwhile, treat the employer as the guarantor. A Jones Walker analysis found 88% of AI vendors cap their own liability while only 17% warrant regulatory compliance. Employers carry the exposure. Vendors keep the subscription fees.
Legislatures have noticed. Connecticut's new AI Responsibility and Transparency Act, signed in June with deadlines starting Oct. 1, explicitly states that using an automated tool is not a defense to a discrimination claim, though courts may weigh evidence of anti-bias testing. The same law lets developers and deployers contractually allocate compliance duties, which moves your vendor negotiation from a commercial exercise to a compliance one.
Two defenses are drying up at the same moment: "the algorithm did it" for employers, and "we're just a tool" as a vendor business model.
These theories are already jumping past hiring. A California trucker's wrongful-termination suit named his employer's AI monitoring vendor as a co-defendant. And in July, 26 Meta employees sued the company alleging its layoff selections were driven by AI productivity scores that couldn't account for medical leave or disability. The doctrine built in hiring cases is now being tested across the whole employee lifecycle.
What to Do Monday Morning
(Note: we are not lawyers, this is not legal advice, but it is practical.)
Start with an inventory. Which roles use AI screening, which vendor powers it and what data touches your candidates. Send that last question to your vendors in writing and ask your counsel whether the scores your tools produce trigger the FCRA notices Yang described.
Audit your New York postings for hiring-intent language now. Build the takedown-and-notify workflow S8877 will require. Keep your eyes on New Jersey. If you hire in Ontario, lift your compliant posting language and 45-day notification workflow and treat it as your North American template instead of maintaining one standard per jurisdiction. Put Connecticut's October deadline on your calendar.
Review what your generative tools write into job ads, especially anything touching visa status or citizenship. That's the Elegant takeaway.
And clean up your postings, because sloppiness now looks like fraud at dataset scale. Researchers flag postings as likely ghosts when they skip the salary field in pay-transparency states, live on a single job board and get reposted within the same week. Legitimate reqs that fit that profile will pattern-match to deception in the datasets that researchers, watchdog startups and eventually regulators run against public posting data.
Your Legal Team Is Part of the Hiring Stack
Even the people writing about the topic hedge in practice. "We're small, so we're just staying away from AI when we hire," Parra-Orlandoni said of her own company, conceding that opting out is less practical for enterprises. Big companies, she noted, "have large legal teams." More simply stated, small companies can avoid this risk by staying away from AI in the hiring process. Large employers can only manage it, and the legal team is now part of the hiring stack.
Parra-Orlandoni put the dilemma plainly in the Harvard Business Review this month, with co-author Paulo Carvão: "The obligations governing enterprise AI are still being written. The steps required to achieve a defensible posture are not. The gap between those two sentences is exactly where the work is."
Editor's Note: AI regulation is being formed before our eyes:
- Your Hiring Software May Already Violate EU Law — While the most consequential obligations of the EU AI Act may have been pushed off until December 2027, HR teams shouldn't see it as a reprieve.
- Why AI Hiring Lawsuits Are About to Explode — AI is reshaping hiring — and the courtroom. Job seekers are suing over biased screening tools, and experts say a wave of lawsuits is just beginning.
- Your AI Notetaker May Already Be Breaking the Law — AI meeting notetakers are standard workplace tools. A new lawsuit suggests they shouldn't be treated that way.