I Swear, Your Honor, The Algorithm Did It.
Running a decision through an AI does not make it the AI’s decision. Regulators have already proven that, twice, with a bill attached.
n 2022, a woman applied for an online tutoring job. The company’s software rejected her automatically. She applied again, an identical application, one field changed: a more recent year of birth. This time the system offered her an interview.
Nothing about her qualifications changed. Nothing about the role changed. The only thing that moved was a number that, by law, is not allowed to decide whether she gets a chance. The software had been configured to reject women over 55 and men over 60, and it did so silently, to more than two hundred applicants.
That company was iTutorGroup. In August 2023 it paid $365,000 to settle the EEOC’s first-ever AI discrimination case. And the resubmitted application is the most important fact in it, because it shows this was never a mysterious emergent bias buried in a black box. It was a rule. A person chose the threshold. The software just enforced it at scale.
The move has a name
What iTutorGroup did when challenged is a pattern now common enough to name: decision-laundering. An organization runs a consequential decision through an AI, and when the decision turns out to be illegal or indefensible, it points at the system. The algorithm did it. As if the software, and not the company that bought it, configured it, and switched it on, had made the call.
Decision-laundering is attractive for the same reason money-laundering is. It puts distance between an actor and a consequence. The model feels objective, so the bias reads as math rather than choice. Responsibility diffuses: the quants own the model, not the board; HR treats the tool as a vendor product, not as a hiring decision; everyone can point somewhere else. The decision still gets made. It just arrives with no fingerprints.
The problem is that regulators do not accept the laundering. They look straight through the model to the outcome, and then they look for the owner.
How the laundering actually happens
To see why “the algorithm did it” is not just legally weak but factually false, look at how the bias gets in. It is almost never the model’s invention. It is the organization’s own, passed through and given a clean face.
It enters two ways. The first is inheritance. A model trained on a company’s past decisions learns the patterns in those decisions, including the discriminatory ones. Feed it years of who you hired and who you rejected, who you approved and who you turned away, and it will reproduce that history with statistical confidence and present it as prediction. The Massachusetts Attorney General said exactly this about the lender Earnest: its models were trained, in the AG’s account, on arbitrary and discretionary past human decisions. Human bias went in, was encoded as statistics, and came back out wearing the authority of an algorithm.
The second is proxies. A model does not need the protected trait to discriminate on it. It finds correlates, a zip code, a school, a cohort-default-rate variable, an immigration-status flag, that stand in for age or race or national origin. This is why “we never told it to consider age” is not a defense. The system found age anyway, because age was latent in the data it was given. Removing the label does not remove the pattern.
Then framing finishes the job. Treat the system as a neutral tool rather than a decision-maker, and no one feels responsible for auditing it. The output looks like math, so it escapes the scrutiny a human manager making the same call by hand would attract. iTutorGroup’s screening was treated as a tool. It was a decision, made two hundred times.
The second case makes the remedy explicit
That Earnest matter is worth reading in full, because of what the regulator demanded. In July 2025 the Massachusetts Attorney General reached a $2.5 million settlement with the student lender over AI underwriting alleged to produce disparate harm to Black, Hispanic, and non-citizen applicants, including through an immigration-status knockout rule, with the company faulted for never testing its models for disparate impact.
Now look past the fine. The AG ordered Earnest to implement a detailed corporate governance structure, develop and maintain written policies for responsible AI use, and report on its compliance on an ongoing basis. The state’s remedy for a laundered decision was to force the company to install an owner for it. That is the entire argument of modern AI governance, ordered by a law-enforcement office as a consent term. The regulator did not just punish the bias. It prescribed accountability.
Why “the algorithm did it” has no standing
Put the two cases together and the rule is plain. In both, an AI made a consequential decision about a human being. In both, the decision was unlawful. And in both, the fact that software executed it changed nothing about who was responsible. The deployer owned the outcome, fully, exactly as if a manager had made the same call by hand.
This should not surprise anyone, because in both cases a human did make the call. Someone set the age threshold. Someone wrote the knockout rule. Someone chose the training data and decided not to test it. The AI was the instrument, not the author. “The algorithm did it” is the corporate cousin of “I was only following orders,” and it carries the same weight, which is none.
What the model actually buys an organization is not objectivity. It is speed and distance: the same biased decision, made faster, against more people, with a story attached about why no one is to blame. That is not a mitigating factor. It is an aggravating one, because the harm is now systematic, and the people running the system were more confident in it precisely because it looked technical.
This is also why the defense is being closed across domains, not just one. Employment regulators, state attorneys general in lending, and securities regulators on AI disclosures are converging on the same position: the entity that deploys the system answers for what it decides. There is no agency where “a model did it” has found purchase.
The line between automation and laundering
None of this is an argument against automating decisions. Plenty of consequential decisions can and should be assisted or made by machines. The argument is about who answers for them.
Automation is legitimate when a named human owns the rule the system applies, can explain it, and can defend the outcome to a regulator, a customer, or a court. It becomes laundering the moment no one can. The dividing line is not how advanced the model is or how much data trained it. It is whether a person stands behind what it decides. One is delegation, which is normal and fine. The other is evasion wearing the costume of efficiency.
The governance question, again
The instinct after reading these cases is to ask whether the model was accurate, or fair, or well-tested. Those are real questions, but they are not the first one. The first question is who owns the decision the model makes.
Because the failure in both cases was not fundamentally a modeling failure. It was an ownership vacuum. No named human was accountable for the outcomes the system produced, empowered to see the rule it applied and answer for it. Into that vacuum the model became the de facto decision-maker, and “the algorithm” became the answer to every question about why.
So the test for any organization is concrete. For every consequential decision your AI touches, hiring, lending, pricing, eligibility, termination, name the human accountable for the outcome and ask whether they can explain the rule the system is applying. Not the architecture. The rule. Why this applicant and not that one. If the answer is “the model handles that,” you have not automated a decision. You have laundered one. And as iTutorGroup and Earnest both learned, you own it anyway.
The algorithm did not do it. Someone chose to let it, and chose not to look. That someone is you, and a regulator will find them even if your org chart cannot.
AI operates. You own the decision, including the one you handed to a machine.
For every consequential decision your AI touches, can you name the human who owns the outcome and explain the rule? Tell me where the gaps are in the comments.
This is the question my work begins with. When AI makes consequential decisions and no named human owns them, that gap is what we help close.
Sources
U.S. Equal Employment Opportunity Commission, “iTutorGroup to Pay $365,000 to Settle EEOC Discriminatory Hiring Suit,” August 9, 2023. The EEOC’s first AI-discrimination settlement. iTutorGroup’s hiring software automatically rejected female applicants over 55 and male applicants over 60, violating the Age Discrimination in Employment Act. The charging party was rejected, then offered an interview after resubmitting with only a more recent date of birth. https://www.eeoc.gov/newsroom/itutorgroup-pay-365000-settle-eeoc-discriminatory-hiring-suit
Office of the Massachusetts Attorney General, “AG Campbell Announces $2.5 Million Settlement With Student Loan Lender For Unlawful Practices Through AI Use,” July 2025. Earnest Operations’ AI underwriting models allegedly produced disparate harm to Black, Hispanic, and non-citizen applicants, including via an immigration-status knockout rule, with no disparate-impact testing and models trained on prior discretionary human decisions. The settlement requires a formal AI governance structure, written policies, and ongoing compliance reporting. https://www.mass.gov/news/ag-campbell-announces-25-million-settlement-with-student-loan-lender-for-unlawful-practices-through-ai-use-other-consumer-protection-violations