Overview
Workday Recruiting is the applicant tracking layer inside Workday’s HR platform: the software that receives your job application, ranks it, and in most cases rejects it before a person reads it. Workday acquired HiredScore in early 2024 and folded its automated candidate grading and re-ranking into the product. Since 2025 the same capability ships as “Illuminate” agents, including a Recruiter Agent that Workday announced in May 2025 and says has raised recruiter capacity by an average of 25%.
The scale is unusual even by enterprise software standards. In the Mobley litigation, Workday represented in court filings that roughly 1.1 billion applications were rejected through its tools during the period at issue. That figure is why this entry exists.
One structural fact shapes every score below. The customer is an employer. The person most affected by the product is a job applicant, who did not choose it, is rarely told it was used, and has no account, contract, or support line with Workday. Almost everything rated in this Index is something you opt into. This is something that happens to you.
What It Knows About You
Two very different populations sit inside the same platform.
For employees of a Workday customer, it is the system of record: salary, performance reviews, reporting lines, identity and right-to-work documents. For applicants, it holds a CV, work history, education, dates, contact details, and whatever a Workday candidate account accumulates as you apply to a series of unrelated employers that all happen to run the same software.
Workday’s published recruitment privacy statement describes deleting recruitment information somewhere between six months and four years after an unsuccessful application, with the period varying by local law and recruiting location.
The important part is not the retention window. It is who holds the controls. Workday’s privacy documentation puts the employer in the controller seat and Workday in the processor seat, so a rejected applicant who wants to know what score they were given has to ask the employer, and the employer usually does not hold the score in any form it could hand over. That gap was tested in court. In May 2026, Magistrate Judge Laurel Beeler declined to compel Workday to produce customers’ applicant data in the Mobley case, on the ground that the plaintiffs had not shown Workday controlled it.
On security, Workday’s record is better than the litigation record suggests. In August 2025 attackers stole OAuth tokens for Salesloft’s Drift integration and used them to pull data from the Salesforce environments of more than 700 organisations. Workday was among them. What the attackers reached was business contact information and support case metadata such as tenant and data centre names; Workday disconnected the app, invalidated tokens, and said core HR and payroll systems were not touched. For a supply chain compromise of that size, that is a narrow blast radius and it is worth saying so.
The Real Risks
The bias claims are live, certified, and specific. Mobley v. Workday was filed in the Northern District of California in 2023. On 16 May 2025, Judge Rita Lin granted preliminary certification of a nationwide collective under the Age Discrimination in Employment Act, covering applicants aged 40 and over who were denied employment recommendations through Workday’s platform since 24 September 2020. The court had already let the case proceed on the theory that Workday acts as an agent of its client employers, which pulls a software vendor inside the statutory definition of “employer” under Title VII, the ADEA, and the ADA. In July 2025 the court rejected Workday’s attempt to carve HiredScore out of the collective. On 22 June 2026 Judge Lin largely denied Workday’s motion to dismiss the third amended complaint, with California FEHA claims and a proxy-discrimination disability claim surviving. These remain allegations that have survived dismissal, not findings of discrimination, and the distinction matters.
Nobody outside the company can check whether the tool skews. In May 2026 the court denied the plaintiffs’ motion to compel production of Workday’s own bias-testing data, holding it protected by attorney-client privilege because Workday’s lawyers had curated the data and used the results in giving legal advice. That is an ordinary privilege ruling. Its practical effect is that the best evidence about whether an automated screen disadvantages older applicants sits in a form built to be unreachable, in the one case designed to test the question.
The transparency laws are thinner than their headlines. New York City’s Local Law 144 has required annual independent bias audits of automated employment decision tools since enforcement began in July 2023. A 2024 study by CAT Lab, Data & Society, and Consumer Reports put 155 investigators onto 391 employers and found 18 that had posted an audit report and 13 that had posted the required transparency notice. Colorado, which had passed the strongest state AI law in the country, repealed and replaced it in May 2026 with SB 26-189 before the original ever took effect, dropping the impact assessments and the duty of care in favour of disclosure and human review from January 2027. Illinois HB 3773 took effect on 1 January 2026 and requires employers to tell applicants when AI is used. Notice is now the realistic protection. Auditing is not.
Displacement is the sales pitch, not a side effect. Screening-time reduction is how the product is sold, and the roles it compresses are recruiting coordination and first-pass CV review. Workday applied the logic to itself in February 2025, cutting about 1,750 jobs, roughly 8.5% of staff, in a restructuring that CEO Carl Eschenbach’s memo tied to the company’s AI investment.
Alternatives
For employers evaluating this:
- Switching ATS vendors does not switch away from the risk. Greenhouse, iCIMS, SAP SuccessFactors, and Oracle all ship automated ranking now. Changing logos moves the exposure rather than removing it.
- Negotiate audit rights into the contract. The Mobley discovery rulings show what happens when they are absent: applicant data the vendor says it does not control, and bias testing the vendor’s lawyers own. Ask for the audit output as a deliverable before signing.
- Keep a human pass on rejections at the top of the funnel. Illinois-style notice plus a structured review of a sample of automated rejections is cheap and produces the record you will want if a claim lands.
- The low-tech option is genuinely viable below a certain size. If you hire fewer than about 50 people a year, a shared inbox and a written rubric applied by two people is slower, and every decision is explainable to the candidate and to a court.
For applicants, there is no opt-out to find. A referral or direct contact with a hiring manager routes around the screen; nothing else reliably does.
On leaving, the numbers are the argument. Published benchmarks put Workday implementation at roughly 1.5x to 4x first-year licence value, with mid-size deployments commonly quoted at $500K to $2M on top of annual licensing, and integration work running into six figures across a normal vendor estate. Multi-year terms with auto-renewal and early-termination penalties do the rest.
Our Verdict
D. High risk, and the risk falls mostly on people who never agreed to any of it.
Workday is competent software run by a company with a reasonable security posture and real contractual privacy commitments to the employers who buy it. None of that is the problem. The problem is that a screening system standing between roughly a billion applications and the people who submitted them is being litigated over age discrimination, and the evidence that would settle the question is privileged. Meanwhile the regulatory backstop that was supposed to force the answer into the open has been repealed in Colorado, is largely unenforced in New York City, and reduces to a notice requirement in Illinois.
What would move this rating up: publishing bias audit results rather than shielding them, giving rejected applicants the score and the reason on request, or an outcome in Mobley that tests the evidence in the open and clears the product. Any one of those would drop the bias score meaningfully. A settlement that seals the record would not.
Scored as of August 2026, while the case is in discovery. This entry will be revisited when it moves.