She had reviewed forty-three applications that morning.
Her dashboard showed – forty-three candidate profiles assessed, ranked, and moved through the pipeline before lunch by an AI model. Sarah had been a recruiter for eleven years. her experience told her what a good hire looked like. She knew when a CV didn’t tell the whole story. She knew the difference between a candidate who looked right on paper and one who would actually work.
One profile had made her pause. She noted strong experience, the kind of track record she’d have flagged to a hiring manager herself a few years ago .. but that profile sat outside the top tier, below candidates who matched a narrower, thinner profile. She read it again and pondered; her experience told her something in the ranking was wrong.
Even given that doubt, she moved things forward anyway. Because that was the job. The score was the score. The system had processed the application, weighted the variables, and surfaced a shortlist. Her job, as far as anyone had designed it, was to move the shortlist forward. Not to question how it was built. Not to ask what variables were driving it. Not to understand why a candidate with strong experience kept landing outside the top tier while candidates who matched a narrower profile kept appearing at the top.
She had a title that implied judgment. She had a process that left no room for it.
What she didn’t know, because nobody had told her, was what she was actually authorised to do when the ranking disagreed with her judgment.
The answer, it turned out, was nothing.
The governance programme nobody built
88% of companies now use AI in some form of candidate screening. Most of them have also done something else: they have built a governance programme around it. Ethics policies. Bias auditing commitments. Vendor due diligence checklists. Documentation of the system’s intended use cases and known limitations.
What almost none of them have built is what the law is now starting to demand by name. In May 2026, Colorado signed SB 26-189, which repealed and replaced its original AI Act. And at the centre of the new framework sits a requirement called “meaningful human review.” The statutory definition is worth reading slowly, because it describes the exact thing most organisations don’t have. A reviewer must be an individual with the authority to approve, modify, or override the decision. Must consider the relevant evidence. Must be trained for the role. And … the line that should be on the wall of every HR leadership team in the country – must not default to the system’s output.
A recruiter who simply ratifies an AI-generated ranking does not meet that standard. That is not a description of a bad recruiter. It is a description of the average recruiter in the average enterprise hiring workflow today. Not because they lack judgment, because nobody designed what genuine deliberation looks like, what authority they have to act on it, or what protection exists if they do.
The governance programme exists. The human decision layer was never built.
What this actually looks like
In February 2023, Derek Mobley filed suit against Workday, one of the dominant enterprise HR platforms in the United States, used by more than 10,000 organisations. Mobley – a Black man over 40 with a disability – had applied to over 100 jobs at companies using Workday’s AI screening tools since 2017. He was rejected every time.
One rejection arrived at 1:50 a.m.
Fifty-five minutes after he submitted the application at 12:55 a.m. No human shortlister was awake. No recruiter had read it.
The AI was the decision-maker, and there was nothing else in the loop.
The case has since been granted preliminary collective certification as a nationwide class action, covering applicants aged 40 and over screened through Workday’s tools since September 2020. To grasp the scale: Workday disclosed in its own filings that 1.1 billion applications were rejected through its system during the relevant period. The court has ordered Workday to hand over a list of the employers using its AI screening features so those applicants can be notified — more than 10,000 companies potentially implicated. Quite unbelievable.
The precise mechanism is still being established in discovery. But the pattern is a familiar one. A system optimising for predictive accuracy. A group of variables that proxy for a protected characteristic such as graduation year, length of work history, dated technical skills, that infer age without ever naming it. A discriminatory pattern running at scale, invisible inside aggregate accuracy numbers that look fine, until a plaintiff’s attorney or a regulator builds the case from the outside.
The question available to ask at any point was the one nobody asked: what is this variable actually doing, and who inside this organisation is positioned to find out before the pattern runs for years?
Three layers, same failure
The sensing layer in enterprise hiring includes CVs, work history, skills assessments, reference data, increasingly video interview analysis and behavioural signal. Hiring teams now have an incredible amount of data about candidates.
The reasoning layer is where most of the investment has gone. Matching algorithms, predictive scoring, ranking engines. Systems designed to find the candidates most likely to succeed based on historical patterns of who got hired and performed well. That sophistication is exactly what makes the failure dangerous. The system is reasoning and optimising for fit. A proxy for race or age that improves predictive accuracy gets kept, because nothing in the model’s objective function asks whether it should be.
The human layer is the critical layer, it is where these problems are flagged, and not after a class action is certified. Not after a court orders the release of customer lists. Before the tool went live. This is a role with the mandate and authority to interrogate what each variable is doing and why, and halt where and when needed.
And this is the glaring missing piece.
Colorado’s law now demands it by name. A reviewer who simply ratifies what the system already decided is not exercising meaningful human review. That is the law making explicit what should have been a design decision from the start.
The governance confusion that makes this worse
Here is the governance programme most organisations have actually built:
Ethics policy. Bias audit schedule. Vendor assessment framework. Steering committee. Quarterly review cadence. Documentation that a human is present in the process.
That is not the human decision layer. These are guardrails. And guardrails and a spine are not the same thing.
Guardrails contain behaviour after the fact. They review, audit, and correct. A spine determines behaviour before the fact. It decides who has authority, what they’re empowered to challenge, and what protection they have for using it. You can have an extensive governance programme and no human decision layer. The Workday case is what that looks like at scale.
The organisations responding to the Workday certification notice right now are not asking whether their governance programme was adequate. They are asking whether their recruiter actually had the authority, the training, and the protection to override what the system decided, and whether anyone designed that before the tool went live.
Most of the answers coming back are the same as Sarah’s dashboard. The score was the score.
Enforcement from the outside not the inside
Colorado’s new framework takes effect January 1, 2027, enforced by the state Attorney General, with enforcement holding until rulemaking is complete. And it is worth noting what Colorado actually did. It started in 2024 with a sweeping, risk-based law which included duties of care, mandatory risk assessments, impact reviews, and then, under pressure, retreated to a lighter regime built on disclosure and consumer rights. But the thing it kept, the floor it would not drop below, was meaningful human review. Even as the regulation got narrower, the human with real authority over the decision stayed in.
Colorado is not alone. Multiple states are moving in the same direction. The EU AI Act classifies hiring as high-risk, with human-oversight obligations. And in the Workday case, the EEOC filed an amicus brief arguing that the vendors who build these tools can be held liable alongside the employers who deploy them ..
That you cannot hide behind the automated nature of the decision.
What legislators are reaching for is something that should have been designed from the beginning. Not a checkbox. Not a human rubber stamp positioned after the AI has already ranked the shortlist. A genuine decision authority — someone with the training, the tools, the protection, and the standing to challenge the machine when judgment demands it.
The law can mandate that role into existence. It cannot design what that role actually requires.
This is a critical point.
The question isn’t whether your hiring platform has a bias audit. It’s whether the recruiter sitting in front of that shortlist has been given anything more than a title and a dashboard, and what happens to her if she pushes back on what the score says.
Has your organisation designed the human layer .. or just assumed it’s there?
If you’re not sure, that’s usually your answer.
I write Decision Layer Weekly for people working on exactly this gap: Subscribe here. And if it’s live for you right now, reach me directly: mattsheehan@spatialnext.io
Matt Sheehan
Matt is a geographer and AI strategist with 25 years at the intersection of geospatial intelligence and decision-making. He maps the architecture connecting three layers most organisations haven’t yet seen together: the sensing layer the geospatial industry has built, the causal reasoning layer now arriving, and the human decision layer nobody is designing. The third layer is where most deployments fail. And where Matt has his primary focus.