Question 1

Does FCRA apply to AI hiring tools?

Accepted Answer

FCRA applies to AI hiring tools that use, incorporate, or generate consumer report data about applicants — including AI platforms that source data from third-party databases, public records, or consumer reporting agencies. The Kistler v. Eightfold AI lawsuit (January 2026) alleged that Eightfold's AI talent platform constituted a consumer reporting agency under FCRA, which would require employers using it to comply with adverse action notice, consent, and disclosure requirements.

Question 2

What is the Eightfold AI lawsuit about?

Accepted Answer

Kistler v. Eightfold AI, filed in January 2026, alleged that Eightfold's AI talent intelligence platform — used by employers to screen, rank, and evaluate candidates — qualifies as a consumer reporting agency under the Fair Credit Reporting Act. If the court agrees, employers who used Eightfold without FCRA-compliant consent forms, adverse action notices, and disclosure procedures would have retroactive liability. The case is being watched as a test of how FCRA applies to AI hiring platforms broadly.

Question 3

What is an adverse action notice under FCRA?

Accepted Answer

An adverse action notice is a required communication to a job applicant or employee informing them that a consumer report was used to make a negative hiring decision. Under FCRA, the process has two steps: (1) a pre-adverse action notice providing the report and a summary of rights, followed by a reasonable waiting period (typically 5 business days); and (2) a final adverse action notice confirming the decision, identifying the consumer reporting agency, and explaining dispute rights. Employers must send both notices to comply.

Question 4

How long do employers have to send an adverse action notice?

Accepted Answer

FCRA requires employers to send the pre-adverse action notice before taking the adverse action, with a reasonable time period — typically interpreted as 5 business days — for the applicant to dispute inaccuracies. The final adverse action notice must follow the decision itself. Failure to provide either notice, or compressing the timeline, is a separate FCRA violation from any underlying screening issue.

Question 5

What is California's ICRAA and how is it different from FCRA?

Accepted Answer

California's Investigative Consumer Reporting Agencies Act (ICRAA) provides additional protections beyond FCRA for California applicants and employees. Key differences include: (1) stricter consent requirements before conducting an investigative consumer report; (2) broader definition of what qualifies as an investigative consumer report; (3) additional disclosure obligations including providing the applicant a copy of the report; and (4) a private right of action with statutory damages. California employers using AI hiring tools with third-party data must satisfy both FCRA and ICRAA.

Question 6

Which AI hiring tools are most likely to trigger FCRA?

Accepted Answer

AI hiring tools most likely to trigger FCRA are those that: (1) aggregate candidate data from third-party sources including public records, social media, or professional databases; (2) generate a score, ranking, or recommendation about an individual using externally sourced data; (3) are provided by a third-party vendor rather than built in-house; or (4) explicitly describe their product as using consumer data. Tools in this category include AI talent intelligence platforms (like Eightfold), AI-powered background screening enhancers, and social media screening tools that generate candidate scores.

Question 7

What consent is required before using a consumer report in hiring?

Accepted Answer

Before obtaining a consumer report for employment purposes, FCRA requires: (1) a clear and conspicuous written disclosure to the applicant that a consumer report may be obtained; (2) the disclosure must be in a standalone document (not buried in an application or acknowledgment form); and (3) written authorization from the applicant. California's ICRAA requires additional consent disclosures. The authorization must be obtained before the report is requested — retroactive consent does not satisfy FCRA requirements.

Question 8

What are the penalties for FCRA violations in AI hiring?

Accepted Answer

FCRA violations can result in: (1) statutory damages of $100 to $1,000 per violation for negligent non-compliance; (2) up to $5,000 per violation for willful violations; (3) actual damages (lost wages, emotional distress); (4) punitive damages for willful violations; and (5) attorney's fees, which are frequently awarded and can exceed the underlying damages. Class action exposure is significant — a large employer using a non-compliant AI tool with thousands of applicants faces per-violation liability that multiplies quickly.

Question 9

What happens if a candidate disputes information in a consumer report?

Accepted Answer

When a candidate submits a dispute about inaccurate information in a consumer report, employers must: (1) pause the adverse action process and not make a final adverse hiring decision while the dispute is active; (2) reinvestigate the disputed information with the consumer reporting agency within 30 days; (3) provide the candidate with the results of the reinvestigation; and (4) if the information is corrected or deleted, reconsider the hiring decision. Failing to pause and reinvestigate is an independent FCRA violation.

Question 10

How do I know if my AI hiring vendor is a consumer reporting agency?

Accepted Answer

Ask your AI hiring vendor directly: Do you source or aggregate data about individuals from third-party databases? Do you generate scores or recommendations about individuals using external data? Are you registered or classified as a consumer reporting agency? Review your vendor's terms of service and data practices documentation. The FTC and CFPB have published guidance on which types of data-driven services qualify as CRAs. If there is any ambiguity, treat the tool as FCRA-covered and implement the required disclosures and notice workflows to avoid liability.

FCRA and AI Hiring: What Employers Must Know

Frequently Asked Questions

Related AI Employment Laws

Audit Your AI Tools for FCRA Risk