Selling an HR tech company after Mobley: AI liability in diligence

Why Mobley changed HR tech diligence#

Mobley v. Workday changed HR tech diligence because it put a direct question to every acquirer: can the software vendor, and not only the employers using its tools, face liability when automated screening is alleged to discriminate? The case's procedural status keeps moving, so get a current summary from counsel rather than relying on press coverage.

Whatever the final outcome, buyers now price the possibility. Diligence teams that once asked only about security and privacy now ask which features make or shape hiring decisions, what testing was done, and how customer contracts allocate responsibility. Sellers who answer with documents keep control of the timetable.

Insurance adds pressure. Buyers who rely on representations and warranties insurance may find underwriters asking about AI risk or proposing exclusions, which can push the buyer toward a special indemnity or escrow instead. Ask your banker and counsel early how they expect underwriters to treat your AI features.

Seller checklist: what to assemble before the data room opens#

The seller checklist covers the documents buyers request once AI liability is on the agenda. Assemble them before the data room opens, because reconstructing testing history under deadline pressure produces weaker answers and invites follow-up requests.

• 1Inventory of every feature that ranks, scores, filters, recommends or rejects candidates or employees.
• 2For each feature, the inputs used, the model or rules behind it, and who sets thresholds and defaults.
• 3Training data account: sources, dates, contract permissions and whether customer applicant data was used.
• 4Bias and adverse impact testing records with dates, methods, results and the changes that followed.
• 5Human review controls, including defaults customers can and cannot change.
• 6Customer contract summary covering AI clauses, compliance allocation, indemnities and liability caps.
• 7Complaints, regulator inquiries, demand letters and litigation involving AI features.
• 8AI governance policies and named owners for model changes and incident response.
• 9Insurance policies and any notices already given under them.

The model inventory buyers expect to see#

The model inventory buyers expect is a plain table that lets a non-specialist see where automation touches an employment decision. Keep it factual and current; an inventory that omits a feature later found in the product does more damage than the feature itself.

Customer contracts and the indemnity question#

Customer contracts decide much of the exposure, because they allocate compliance duties, indemnities and liability caps between you and the employers using your product. Buyers will read your standard terms and every negotiated exception, so summarize them before they do.

Negotiated enterprise contracts are where surprises sit. A large customer may have won a broad indemnity years ago; list such exceptions in a schedule so the buyer hears about them from you first.

Training data and candidate data rights#

Training data and candidate data rights are the second strand of AI diligence: buyers want to know what data trained your features and whether you had the right to use it. Applicant data is personal data, and contracts with employers often limit its use to delivering the service.

California shows how the ground has shifted. The CCPA's temporary exemptions for employee and business-to-business personal information expired on January 1, 2023, and the California Privacy Protection Agency began preliminary rulemaking on April 20, 2026 on how the law applies to employees, job applicants and independent contractors. Expect buyers to ask how you handle applicant rights requests across customer accounts.

Keep a clear line between applicant data, which belongs to customers and their candidates, and your own engineering, support and product records. That line also decides what, if anything, could be licensed later without candidate risk.

Show buyers how you track changing rules#

Buyers want to see how you track changing rules on AI in employment, because a snapshot taken at signing may be stale by closing. Federal anti-discrimination laws apply to hiring whatever tools are used, and state and local rules, such as New York City's law on automated employment decision tools, add notice and audit duties for employers that often flow down to vendors.

Colorado shows how quickly the map moves. Its AI Act, signed in May 2024, was delayed once and then repealed and reenacted in a narrower form in May 2026, effective January 1, 2027. A short register listing each rule, its status, the features it touches and the responsible owner persuades buyers more than a long memo.

Illustrative example: a candidate scoring vendor prepares for sale#

Illustrative: a fictional vendor of interview scheduling and candidate scoring software for hourly-workforce employers hires a banker to run a sale. Its product ranks applicants with a model trained on historical hiring outcomes, and an auto-advance feature moves top-ranked applicants to interviews.

Before launch, the founder and outside counsel build the model inventory, gather adverse impact tests run across several releases, and find a small number of enterprise contracts with uncapped indemnities. They schedule those contracts, document that auto-advance was always customer-configurable, and summarize how training data permissions were obtained.

When the buyer's counsel raises Mobley on the first diligence call, the seller answers with the inventory, the test history and the contract schedule. The buyer still negotiates a specific indemnity for the scheduled contracts, but the process stays on its timetable.

How SourceX fits around an HR tech sale#

SourceX does not advise on M&A, but HR tech founders often ask whether licensing records before or after a sale creates new diligence questions. In the SourceX five-step transaction, candidate and employee personal data held for customers is generally excluded in the Rights step, and assessment focuses on the vendor's own engineering, support and product records.

Where a license exists, the SourceX Evidence Packet gives an acquirer a dated account of where the records came from, which licensing rights and permitted uses applied, how privacy was handled and who authorized the release, which is the kind of evidence AI diligence now expects.