In Arrears

At 1:30 in the morning, on a weekend, Derek Mobley got an email about a job he had applied for earlier that week. Reading it, he understood that no human had sent it. No person was awake to reject him at that hour. The timestamp was the tell.

That timestamp is now part of the evidentiary record in a federal collective action that reaches, by the figure cited in court filings, roughly 1.1 billion job applications.

I want to be precise about what that case is and isn’t, because the whole argument depends on it. Mobley v. Workday alleges that algorithmic screening tools disproportionately rejected applicants by age, race, and disability. As of now it is a procedural posture, not a verdict. The claims survived dismissal; a court has allowed them to proceed. No one has been found liable of anything. The exposure is real. The judgment does not yet exist, and an essay that forgets that distinction commits the same error it’s about to diagnose.

But two of the court’s rulings already matter regardless of how it ends.

The accountability that wouldn’t transfer

The first is that the court declined to let Workday stand outside the frame. Workday’s defense was the natural one: we don’t make hiring decisions, we provide software, the employer decides. The court’s answer was that an employer’s customers “delegate traditional hiring functions, including rejecting applicants” to the tool — which made the vendor, plausibly, the employer’s agent for the purposes of anti-discrimination law. You cannot escape liability, the order reasoned, by delegating a traditional function to a third party. Whether that third party is human or automated is irrelevant.

Read that slowly, because the word “agent” is doing real work here, not a pun’s worth. In agency law an agent is one who acts on another’s behalf — and the legal question and the technical one collapse into a single question: does routing an act through a proxy dissolve your responsibility for it? The court said no. “We just provide the software” is the vendor’s version of “the agent did it” — the same evasion, one layer up. The accountability didn’t transfer to the tool, because a tool has nothing to hold it with. It stayed in the chain, and the court refused to let any link shed it. The deploying employers, by most readings, are next.

The skepticism you deleted was the defense you deleted

The second thing the case establishes is quieter and sharper, and to see it you have to get the order right — because the order is where most readings go wrong, including, in an earlier draft, mine.

The timestamp is not the violation. A 1:30 a.m. automated rejection is, by itself, perfectly legal; the law does not require that a human stay awake. What’s alleged to be unlawful is the outcome — that the screen rejected protected groups at a disproportionate rate. The disparity is the violation. The timestamp is what makes the disparity attributable: it is the plaintiffs’ evidence that the skewed outcome came from a process running with no one positioned to catch it. So the sequence is strict. First the outcome has to be skewed. Then the absence of oversight turns a bad outcome into an indefensible one.

Get that sequence right and the lesson sharpens. There’s a kind of efficiency that works by removing the person who would have said this feels wrong — the review step, the second look, the human in the loop you cut because it was slow and it was expensive and the model was usually right. That removal reads as pure savings on the day you make it. What Mobley surfaces is what the deleted step was actually worth: not as a legal requirement, but as the thing that — if the outcomes had ever gone bad — would have caught them while there was still time, and left a record that you did. You didn’t only lose the second opinion. On the day a disparity appeared, you deleted any evidence that one was ever sought.

Here is where the comforting version of this essay would land — so put a human back in the loop and you’re covered — and here is where it would be wrong, three times over.

Wrong, first, because the liability is outcome-based. A disparate-impact claim needs no proof of intent; a neutral practice that disproportionately harms a protected group is enough. Adding a human does not cure a skewed outcome. A reviewer who rubber-stamps a biased process produces the same numbers and is discoverable, in the logs, as a rubber stamp.

Wrong again because the record cuts both ways. The bias audit you ran, that flagged the disparity, that you shipped over anyway — that is not your shield. That is the plaintiff’s first exhibit. But read that carefully, because it’s the one line here that can be misused: it does not make ignorance a shelter. Under outcome-based liability, not looking buys nothing — the skewed outcome is the violation whether you audited or not, so the deployer who refused to test is exactly as liable, only blind to it. The audit never created the exposure; the outcome did. What the ignored audit leaves behind is a record of having known. What willful ignorance leaves behind is the guarantee you reach the docket having never seen it coming. Neither is a defense.

And wrong, finally, because governance is only a defense if it acted. The contemporaneous record earns its standing by what it shows you did with what it told you. A log that proves a human looked and changed nothing proves the looking was theater.

The cost you can’t pay late

So strip away the comfortable read and what survives is narrow and unforgiving: governance is a defense only when it is contemporaneous, honest, and acted-upon. And that combination has a property the rest of the bill does not.

You can pay almost everything in arrears. The settlement, the back pay, the fine — all payable late, with interest, which was the whole subject of the last field note. One thing is not payable late, and it’s worth being exact about which thing, because the obvious version of this claim is wrong.

The raw outcomes survive. Anyone can run the statistics on historical hiring data years later — it’s how this lawsuit exists at all, assembled entirely from rejections reconstructed after the fact. If those numbers come back clean, no missing log can hurt you: there was nothing to catch. But that defense rests on a quiet assumption — that the raw data still exists to be run. Four years of routine purging, truncation, or privacy-driven anonymization can erase the very record that would have exonerated you, and “clean in aggregate” is not the same as clean everywhere: a globally balanced average can still hide a single toxic node — one region, one sub-brand, one screen — that a plaintiff only has to find. Lose the data and you’ve lost the second timestamped asset; now the absence of outcomes and the absence of logs read together as spoliation, which is worse than either alone. What you cannot reconstruct is narrower than the whole record, and it matters on only one path — the one where the outcomes were skewed and you were positioned to know. On that path the data is the plaintiff’s, not yours. Your defense is the contemporaneous record that you saw the disparity and acted on it while it was still 2022 — and that record cannot be built in 2025, because the thing that made it a defense was that it existed in 2022. The absence of it, on a process that did produce a disparity, does not read in litigation as a compliance gap. It reads as negligence.

That is the line the last essay didn’t reach. The Unpriced argued you could still pay the cost late, just dearer. This one is narrower and harder: the penalty is payable in arrears; the proof that you acted is not. Contemporaneity is the one currency you can’t borrow against after the fact, and the moment you need it is precisely the moment it’s too late to acquire.

The retreat that isn’t one

Which brings me to the part that makes this urgent instead of merely true — and to the trap I expect a lot of capable people to walk into this year.

In the same stretch of weeks that the court let this case advance, the federal enforcer walked away from the theory the case runs on. The EEOC pulled its AI-hiring guidance in early 2025, reoriented its enforcement plan toward overt discrimination, and — by its own announced priorities and a Justice Department legal opinion — moved to rein in disparate-impact liability itself, directing staff to close investigations resting on it alone. Take that at face value and the conclusion writes itself: the risk is over, stand the governance down.

It is the wrong conclusion, and the shape of the error is familiar. The risk didn’t retreat. It changed venue. Here is the mechanism the headlines skip: Title VII, the ADEA, and the ADA carry private rights of action that Congress wrote into the statutes themselves. An agency can drop a theory from its enforcement priorities; it cannot repeal a law or strip a federal court of jurisdiction over a liability Congress created. Mobley was never an EEOC matter — it’s a private plaintiff suing under those statutes, and it proceeds whether or not the agency is interested. When a regulator steps back, enforcement doesn’t end. It privatizes — from agency action, which is singular and negotiable and arrives with a cure period and a settlement desk, to private litigation and a thickening patchwork of state regimes, which offer none of those conveniences.

The cost didn’t vanish when the regulator looked away. It moved off the regulatory ledger and onto a docket. That is the same motion as everything else in this series: a cost that looks retired because the column that tracked it went quiet. The organization that defunds its AI governance in 2026 on the theory that no one is enforcing anymore is writing the unhedged option one more time — and the counterparty it’s writing it to is a plaintiffs’ bar holding a billion-application class and a discovery request for the audit logs it just stopped keeping.

The regulator’s retreat is not the risk’s retreat. The liability privatized. The defense kept its terms. It is still the contemporaneous record — the audit you ran and answered, the review that actually reviewed — and it is still the one thing you cannot produce after you need it.

The cost moved venues. The defense kept its price. And the record either exists before the question is asked, or it never exists at all.

Somewhere a system is rejecting an application at 1:30 in the morning. That, by itself, is nothing — the hour proves no wrong. The only question that will matter, if the outcomes ever turn out to have been skewed, is whether anyone can show a human was ever meant to be awake.