Question 1

Does FCRA apply to AI hiring tools?

Accepted Answer

Yes, if the AI tool produces a consumer report as defined under 15 U.S.C. § 1681a(d). Any AI hiring tool that scores, ranks, filters, or recommends candidates using collected data about their character, reputation, personal characteristics, or mode of living likely qualifies as producing a consumer report. The Kistler v. Eightfold AI class action, filed January 20, 2026 in Contra Costa County, California, argues that Eightfold's platform does exactly this. If the court agrees, millions of employers using AI screening tools become FCRA-covered entities subject to disclosure, authorization, and adverse action requirements.

Question 2

What makes an AI hiring score a consumer report?

Accepted Answer

Under FCRA (15 U.S.C. § 1681a(d)), a consumer report is any written, oral, or other communication of information by a consumer reporting agency bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for employment. AI hiring tools like Eightfold, HireVue, and Workday aggregate data on workers and generate scores that employers use to make hiring decisions. This fits the FCRA definition of a consumer report used for employment purposes. The Kistler lawsuit argues that Eightfold's maintenance of over 1 billion worker profiles makes it a consumer reporting agency under the statute.

Question 3

What FCRA disclosures do employers need for AI screening?

Accepted Answer

Under 15 U.S.C. § 1681b(b), employers must provide a clear and conspicuous standalone written disclosure to applicants before obtaining a consumer report for employment purposes. The disclosure must be a standalone document and cannot be included as part of the employment application or bundled with other documents. Additionally, employers must obtain written authorization from the applicant before procuring the report. If an AI score leads to an adverse employment decision (such as a rejection), 15 U.S.C. § 1681m(a) requires a two-step adverse action process: a pre-adverse action notice with a copy of the report and a summary of rights, followed by a final adverse action notice after a reasonable waiting period.

Question 4

Can employers be sued for using AI scoring tools?

Accepted Answer

Yes. The Kistler v. Eightfold AI class action, filed January 20, 2026, demonstrates the litigation risk. The plaintiffs allege that Eightfold operates as a consumer reporting agency without FCRA compliance, and that employers using the platform without proper disclosures and authorization are violating federal law. Under 15 U.S.C. § 1681n, willful violations of FCRA can result in statutory damages of $100 to $1,000 per violation, plus punitive damages and attorney fees. Class action status means potential damages multiply across every affected applicant. The involvement of former EEOC Chair Charlotte Burrows as lead counsel signals that this theory of liability has serious backing from enforcement circles.

Question 5

What is the Kistler v. Eightfold AI lawsuit about?

Accepted Answer

Kistler et al. v. Eightfold AI Inc. is a class action lawsuit filed on January 20, 2026 in Contra Costa County Superior Court, California. The plaintiffs allege that Eightfold AI operates as a consumer reporting agency under FCRA because it maintains profiles on over 1 billion workers, collects data about their professional backgrounds, and generates candidate scores used by employers for hiring decisions. The lawsuit argues that Eightfold failed to comply with FCRA requirements including proper disclosures, applicant authorization, and adverse action procedures. The case is particularly notable because former EEOC Chair Charlotte Burrows serves as lead counsel, which legal analysts interpret as a signal of potential federal enforcement direction.

Question 6

How does the Eightfold lawsuit affect my company?

Accepted Answer

If the court rules that Eightfold's platform qualifies as a consumer reporting agency, the implications cascade to every employer using Eightfold or similar AI hiring tools. Your company would become a FCRA-covered entity subject to mandatory pre-use disclosures, written applicant authorization, and adverse action procedures. Noncompliance carries statutory damages of $100 to $1,000 per willful violation, and class action exposure could be significant. Even before a ruling, the lawsuit signals where regulators and plaintiffs' attorneys are heading. Employers using tools like Eightfold, HireVue, Pymetrics, and Workday should begin FCRA compliance now rather than waiting for litigation outcomes. EmployArmor helps employers audit their AI vendor stack and generate required FCRA documents.

Question 7

Do applicants need to authorize AI screening before it is used?

Accepted Answer

Under 15 U.S.C. § 1681b(b), written authorization from the applicant is required before a consumer report can be obtained for employment purposes. If AI hiring scores qualify as consumer reports under FCRA, then yes, employers need written applicant authorization before running any AI screening that produces such a score. In California, ICRAA (Cal. Civ. Code § 1786.10 et seq.) adds additional consent requirements for investigative consumer reports, which may apply to AI tools that go beyond simple scoring to provide detailed candidate profiles. The authorization form must specifically identify the AI vendors being used and the types of data they collect. EmployArmor generates these authorization forms tailored to your specific vendor list.

Question 8

What should our AI vendor contracts include for FCRA compliance?

Accepted Answer

AI vendor contracts should address five key areas for FCRA compliance. First, audit rights: the contract should specify how candidate scores are calculated and give employers access to the underlying data and methodology. Second, data source transparency: vendors must disclose what data they collect, from where, and how it factors into scores. Third, liability indemnification: the contract should allocate liability if the vendor's data or scoring methodology causes an FCRA violation. Fourth, candidate data deletion rights: FCRA and state laws like California's ICRAA give candidates rights to access and request deletion of their data. Fifth, adverse action process support: vendors should support employers in fulfilling the pre-adverse and final adverse action notice requirements under 15 U.S.C. § 1681m(a). Most AI vendor contracts are silent on these obligations, which is a major gap. EmployArmor's vendor contract gap analysis flags these issues before they become liabilities.

Question 9

How is AI hiring different from traditional background checks under FCRA?

Accepted Answer

Both AI hiring scores and traditional background checks can qualify as consumer reports under FCRA if they meet the statutory definition in 15 U.S.C. § 1681a(d). The critical difference is in compliance maturity. Traditional background check providers like Sterling, HireRight, and GoodHire have operated as consumer reporting agencies for decades. They understand FCRA requirements, build disclosures into their workflows, support adverse action processes, and carry errors and omissions insurance. AI hiring vendors like Eightfold, HireVue, and Workday do not position themselves as consumer reporting agencies and typically do not include FCRA compliance features in their products. If the Kistler court agrees these tools produce consumer reports, the compliance burden falls entirely on the employer. This is the new FCRA frontier that most employers have zero preparation for.

Question 10

What happens if an AI score leads to a rejection?

Accepted Answer

Under 15 U.S.C. § 1681m(a), if a consumer report (including potentially an AI hiring score) is a factor in an adverse employment decision, the employer must follow a two-step adverse action process. Step one: before taking final action, the employer must provide the applicant with a pre-adverse action notice that includes a copy of the report (or the score and methodology), a statement of their rights under FCRA, and notice of their right to dispute the information. Step two: after a reasonable waiting period (typically 5 business days), if the employer proceeds with the rejection, they must send a final adverse action notice that includes the name and contact information of the consumer reporting agency (or AI vendor), a statement that the vendor did not make the adverse decision, and notice of the applicant's right to obtain a free copy of the report and to dispute its accuracy. California's ICRAA (Cal. Civ. Code § 1786.40) adds additional adverse action requirements. EmployArmor generates both pre-adverse and final adverse action notice templates tailored to your AI vendors.

AI Hiring FCRA Compliance: What Employers Must Know

Frequently Asked Questions

Related Laws and Tools

Get Compliant Before the Ruling