Does FCRA apply to AI hiring tools?

It depends on the data source. If the tool uses only what the candidate submitted directly, FCRA generally does not apply. If it draws on external data (employment databases, social media, public records), the output may be a consumer report under FCRA, requiring written disclosure, written authorization, and adverse action notices before rejecting a candidate.

What is the Eightfold AI FCRA lawsuit?

A class action filed January 2026 alleging that Eightfold AI compiled profiles on over 1 billion workers from external data sources without providing the disclosures required by the Fair Credit Reporting Act. Employers who used Eightfold-sourced candidate information may face FCRA exposure because they benefited from a consumer report without following the required notice process.

What notices does FCRA require before rejecting a candidate?

Three steps: (1) before ordering a consumer report, a standalone written disclosure plus written authorization from the candidate; (2) before adverse action, a pre-adverse action notice with a copy of the report and CFPB Summary of Rights, plus a waiting period to dispute; (3) a final adverse action notice if you proceed. Missing any step is a violation.

Does New York City's AI hiring law apply to me?

New York City Local Law 144 requires employers and employment agencies using automated employment decision tools for NYC roles to conduct a bias audit before using the tool and to publish a summary of the results annually. This applies if you are hiring for positions based in New York City, regardless of where your company is headquartered.

FCRA and AI Hiring: The Disclosure Requirem…

TL;DR: FCRA and AI Hiring: The Disclosure Requirement Most Companies Are Missing (2026), a practical compliance guide for enterprise and HR teams in 2026.

FCRA and AI Hiring: The Disclosure Requirement Most Companies Are Missing (2026)

Most HR teams think of the Fair Credit Reporting Act as background check law, something that applies when you order a criminal history report or credit check on a finalist candidate. The Eightfold class action, filed January 2026, has put AI hiring tools squarely inside FCRA's scope and changed what that assumption costs.

If your AI screening vendor uses any data sourced outside the candidate's own application (employment history databases, social media profiles, public records, or aggregated workforce data), you may be subject to FCRA's notice and authorization requirements without knowing it. The gap between "we use an AI tool to screen resumes" and "we run consumer reports on applicants" is narrowing fast.

This guide explains when FCRA applies to AI hiring tools, what compliance looks like in practice, and what you need to add to your process before the next hire.

How FCRA applies to AI hiring tools

The Fair Credit Reporting Act requires certain procedures whenever an employer uses a "consumer report" obtained from a "consumer reporting agency" (CRA) to make employment decisions. Those terms have legal definitions, and the definitions matter here.

A consumer report is any written, oral, or other communication of information that bears on a consumer's creditworthiness, credit standing, character, general reputation, personal characteristics, or "mode of living." The "mode of living" and "general reputation" language is broader than most HR teams realize. It is not limited to credit data.

A consumer reporting agency is any person who regularly assembles or evaluates consumer credit information or other information about consumers for the purpose of furnishing consumer reports to third parties. The traditional CRA is a background check company: Checkr, Sterling, HireRight. The new question is whether an AI platform that builds candidate profiles from external data qualifies as a CRA.

In October 2024, the CFPB issued Circular 2024-06, stating that the FCRA applies to third-party background dossiers and algorithmic or "black box" scores used for hiring and other employment decisions, and to the employers who use them. The background check label is not required. The function is what matters. The circular was issued without notice-and-comment rulemaking, so it lacks the force of law and could be rescinded, but it had not been rescinded as of mid-2026, and the Eightfold litigation advances the same theory through the courts rather than the agency.

The Eightfold lawsuit builds on that position directly. The January 2026 class action alleges that Eightfold compiled profiles from external sources (including LinkedIn data, employment databases, and public records) and scored over one billion workers without their knowledge. The argument: this output is a consumer report. Eightfold is a CRA. Employers who used that output without the required disclosures violated FCRA.

The test for your own tools is simple to state, if not always simple to answer: does your AI screening vendor use any data about the candidate that the candidate did not directly provide in their application? If yes, FCRA may apply.

Document signing and employment agreement process

What FCRA requires if it applies

FCRA compliance in employment follows four steps. Each step is required. Missing one is a violation, not a partial compliance.

Step 1: written disclosure and authorization before ordering

Before you obtain any consumer report, you must give the candidate a standalone written disclosure stating that you may obtain a consumer report for employment purposes. The disclosure must stand alone. You cannot bury it in a general job application, a terms-of-service acknowledgment, or an onboarding packet. It must be a separate document.

You must also obtain written authorization from the candidate before ordering the report. No authorization, no report. This applies even if you view the AI output as just part of your normal ATS workflow. If the AI is drawing on external data, the authorization requirement applies to the pull of that data.

Step 2: pre-adverse action notice before rejecting

If you plan to take an adverse action based on a consumer report (rejecting the candidate, rescinding an offer, or removing someone from consideration), you must provide a pre-adverse action notice before making the decision final. That notice must include:

A copy of the consumer report
A copy of the CFPB's "A Summary of Your Rights Under the FCRA" (a standardized document available from the CFPB website)
A waiting period, typically treated as at least five business days, giving the candidate an opportunity to dispute inaccuracies

You cannot send the rejection and the notice simultaneously. The notice comes first. You wait. Then you decide.

Step 3: final adverse action notice

After the waiting period, if you proceed with the rejection or other adverse action, you must send a final adverse action notice. This notice must include the name, address, and phone number of the CRA that provided the report, a statement that the CRA did not make the adverse decision and cannot explain why the decision was made, and a statement of the candidate's right to dispute the report's accuracy and completeness.

Step 4: record retention

Federal FCRA requires you to retain authorization forms and adverse action notices for two years. California imposes longer retention periods for some employment records (up to seven years). Check your state's requirements. If you are using AI tools across multiple states, apply the strictest retention period across your record set.

Questions to ask your AI vendor

Get written answers to these before using any AI screening tool that draws on sources beyond the candidate's direct submission.

Does your tool use any data about candidates that candidates did not provide directly in their application?
What external data sources does your tool use or access? Name them specifically.
Have you obtained legal counsel on whether your tool's output constitutes a consumer report under FCRA?
Do you operate a FCRA compliance program? If yes, can you provide documentation?
If your output triggers FCRA, what documentation will you provide to support our adverse action notices?

A vendor that cannot answer question 1 is a red flag. A vendor whose answer to question 1 is "yes" without a clear FCRA compliance framework attached is a higher risk than a traditional background check vendor you can verify is FCRA-certified.

Document the vendor's responses in writing. If a dispute arises later, written vendor representations become part of your compliance record.

For a broader vendor review process covering bias audits, data governance, and discrimination exposure, see the AI vendor due diligence checklist.

When FCRA clearly does not apply

Not every AI use in hiring triggers FCRA. These scenarios generally fall outside its scope:

You review only the candidate's own resume and application materials, meaning what the candidate submitted directly, with no external data enrichment. Your AI tool performs sentiment analysis on interview recordings using only what the candidate said and did in the interview. You use AI to score responses to standardized questions the candidate answered in your own assessment. You use AI to summarize notes from human-conducted interviews, drawing only on those notes.

The common thread: FCRA applies when a third party assembles information about the candidate from external sources. If your AI is processing only what the candidate themselves provided, you are outside the consumer report framework.

When in doubt, ask your vendor question 1 above. If they cannot tell you definitively that no external data is used, treat it as potentially triggering FCRA and proceed with disclosures.

State laws that go further than FCRA

FCRA is the federal floor. Several state and local laws add requirements on top.

California's Investigative Consumer Reports Act (ICRAA) requires additional disclosures when a report includes information gathered from personal interviews. Candidates must be told they have the right to request a copy of the report within three years. If your AI vendor gathers information through any form of interview-style data collection or network-based intelligence, ICRAA may apply.

New York City Local Law 144 takes a different approach. It does not address FCRA disclosure directly, but requires an independent annual bias audit of any automated employment decision tool used for NYC-based roles, with results published publicly. The audit must cover disparate impact across race, sex, and intersectional categories. This is not an FCRA requirement. It is a separate obligation that applies regardless of what data the tool uses.

Illinois has the most specific rules for AI video analysis. The Illinois AI Video Interview Act (amended effective January 1, 2026) requires employers to notify applicants before using AI to analyze video interviews, obtain written consent, and prohibits using AI as the sole factor in a hiring decision. This applies to any employer hiring Illinois residents, not just Illinois-based companies. The Illinois AI employment disclosure law has the full compliance details.

Illinois is watching as a model for other states. Several 2026 legislative sessions have introduced similar bills.

For the Workday AI lawsuit and the discrimination liability angle, which is separate from but overlapping with FCRA, see that article's seven-step HR checklist.

Copy-paste FCRA disclosure templates

These templates cover the federal FCRA baseline. Have employment counsel review before use, particularly if you operate in California, New York, or any state with additional investigative consumer report requirements.

Template 1: standalone FCRA disclosure

[Company name] may obtain a consumer report on you for employment purposes. This report may include information about your background, employment history, education, and other information about your character and general reputation. [Company name] may use this report in connection with your application for employment. Your authorization is required before any report is obtained.

Template 2: authorization form

I authorize [Company name] and its designated agents to obtain consumer reports and investigative consumer reports about me in connection with my employment application. I understand that I may receive a copy of any consumer report if I check the box below.

[ ] I request a copy of any consumer report obtained about me.

Keep the signed authorization form on file. If you take an adverse action later, you will need it.

For a complete picture of AI governance across your hiring process, see the HR AI governance and hiring decisions guide and the EEOC AI hiring guidance checklist. The FCRA and discrimination frameworks are distinct but they point to the same practical gap: most employers using AI screening tools have not mapped their process against either law.

The Eightfold case is the clearest signal yet that FCRA's reach into AI hiring is not a theoretical risk. Courts are certifying these claims. The time to fix your disclosure process is before a class is certified, not after.