Adverse Action Notices for AI Hiring
FCRA (15 U.S.C. § 1681m) requires a written adverse action notice before rejecting candidates based on AI-scored third-party data. The Eightfold AI lawsuit (January 2026) exposed how many employers skip this step entirely — creating massive class action liability.
EmployArmor generates FCRA-compliant adverse action notices, tracks the 5-day window, and manages candidate dispute workflows — automatically, for every AI hiring tool in your stack.
FCRA Adverse Action Requirements for AI Hiring
15 U.S.C. § 1681m creates four adverse action compliance obligations that apply whenever AI hiring tools use third-party consumer data to score and reject candidates.
When Adverse Action Applies to AI Tools
Under 15 U.S.C. § 1681m, adverse action requirements are triggered when: (1) the employer uses a consumer report to screen candidates, (2) the AI tool uses third-party data about candidates that wasn't directly obtained from the candidate, and (3) the candidate is rejected based on those AI scores. Tools like Eightfold that use scraped profile data to generate scores almost certainly produce consumer reports.
What the Notice Must Include
The pre-adverse action notice must include: a copy of the consumer report the employer used, the FTC's Summary of Consumer Rights under FCRA (16 C.F.R. § 698 model notice), and contact information for the consumer reporting agency. The post-adverse action notice must include the final adverse action decision, the agency's contact info, and the candidate's right to dispute the report within 60 days.
Timing Requirements
The employer must provide the pre-adverse action notice before finalizing the rejection, then wait at least 5 business days before sending the post-adverse action notice. The post-adverse action notice must be sent promptly after the decision is finalized. Automated AI screening that rejects candidates in real time without any notice period is a systematic FCRA violation.
Candidate Dispute Rights
After receiving an adverse action notice, candidates have 60 days to dispute the accuracy of the consumer report with the consumer reporting agency. Employers must pause the adverse action process if a dispute is received and cannot reuse the disputed report until the dispute is resolved. The candidate has the right to request the AI scoring methodology under FCRA's reinvestigation rules.
FCRA adverse action compliance built for AI hiring volume
When AI screening rejects thousands of candidates per month, manual adverse action notice management is impossible. EmployArmor automates the entire process — notice generation, 5-day tracking, dispute handling — for every rejection that triggers FCRA.
- Adverse action notice generator (pre- and post-action)
- 5-day deadline tracker with automated reminders
- Candidate dispute workflow with dispute resolution tracking
- FCRA applicability checker for AI hiring tools
- Class action risk assessment by tool type and candidate volume
- FTC model notice templates (16 C.F.R. § 698) pre-loaded
FCRA Adverse Action Requirements by Jurisdiction
Federal FCRA covers all employers. California and New York have state-level analogs with additional requirements.
| Jurisdiction | Status | Risk |
|---|---|---|
| Federal (All Employers) | FTC enforcement — class action exposure | High |
| California | State law adds additional requirements | High |
| New York | NY FCRA analog with broader scope | Medium |
| Minnesota | Proposed consumer reporting expansion | Low |
Updated March 2026. EmployArmor monitors all 50 states for consumer reporting and adverse action legislation.
Why AI Screening Tools Trigger FCRA
View AI hiring lawsuits tracker →Most HR teams think FCRA only applies to traditional background checks. It doesn't. FCRA applies to any "consumer report" — which is broadly defined as any communication by a consumer reporting agency bearing on a consumer's creditworthiness, character, general reputation, or personal characteristics for employment purposes.
When tools like Eightfold AI scrape professional profiles from LinkedIn, job boards, and public web sources to build a scoring model, they create consumer reports. When employers use those scores to reject candidates, FCRA adverse action requirements are triggered. The CFPB and FTC have both signaled they view AI hiring tools that use third-party consumer data as covered consumer reporting agencies or agents.
EmployArmor's adverse action tool integrates with your FCRA Compliance Tool and Vendor Risk Assessment to identify which AI tools in your stack trigger FCRA, and automates notice delivery for every affected candidate. See the AI hiring laws by state guide.
Frequently Asked Questions
When do FCRA adverse action requirements apply to AI hiring tools?
FCRA adverse action requirements under 15 U.S.C. § 1681m apply whenever an employer uses a 'consumer report' in a hiring decision that results in adverse action against a candidate. A consumer report includes any AI-generated scoring or assessment that is based on information gathered from third-party sources about the candidate. Tools like Eightfold AI, which scraped data from approximately 1 billion professional profiles, almost certainly trigger FCRA requirements when that scraped data is used to score and reject candidates.
What are the FCRA adverse action notice requirements?
Under 15 U.S.C. § 1681m, before taking adverse action based on a consumer report, the employer must: (1) provide the candidate with a copy of the consumer report used, (2) provide a written description of the candidate's rights under FCRA (the FTC's Summary of Consumer Rights), and (3) wait a reasonable period (typically 5 business days) before finalizing the adverse action. After taking adverse action, the employer must send a second notice identifying the consumer reporting agency used and informing the candidate of their dispute rights.
What is the Eightfold AI FCRA lawsuit?
In January 2026, a class action was filed against Eightfold AI alleging that its talent intelligence platform violated FCRA by using data scraped from approximately 1 billion professional profiles to create consumer reports used in hiring decisions — without obtaining candidate consent, without providing adverse action notices, and without permissible purpose disclosures required by 15 U.S.C. § 1681b. Employers who used Eightfold's AI screening to reject candidates without providing FCRA adverse action notices face independent liability alongside Eightfold.
What is the 5-day adverse action timing requirement?
The FCRA does not specify an exact number of days for the pre-adverse action waiting period, but regulators and courts have consistently applied a standard of at least 5 business days between providing the pre-adverse action notice (with the consumer report) and taking the final adverse action. This waiting period gives the candidate time to dispute any inaccuracies in the report before the employer finalizes the rejection. Failing to wait the required period — or skipping the pre-adverse action notice entirely — is an independent FCRA violation.
What penalties apply for FCRA adverse action violations?
Under FCRA, individual plaintiffs can recover actual damages, statutory damages of $100–$1,000 per violation, punitive damages, and attorneys' fees. Class actions under 15 U.S.C. § 1681n (willful violations) can result in class-wide statutory damages of up to $1,000 per class member, capped at the lesser of $500,000 or 1% of the employer's net worth. The FTC can also impose civil penalties under 16 C.F.R. § 698 for systematic FCRA violations. AI hiring tools that reject thousands of candidates without proper adverse action notices create massive class action exposure.
More questions? See our full adverse action notices for AI hiring FAQ.
Automate FCRA Adverse Action Notices for Every AI Rejection
AI screening rejects hundreds of candidates per month. Each one that uses third-party data triggers FCRA. EmployArmor automates every notice, tracks every deadline, and manages every dispute.