A growing number of employers are using AI tools to evaluate job applicants, predict performance, and rank candidates before human review. Most of those employers have a separate, well-developed process for traditional background checks. The two systems often live in different parts of the organization, with different vendors and different compliance owners.
A 2024 guidance document from the Consumer Financial Protection Bureau (since withdrawn) and a class action lawsuit filed in California both raised the question of whether those two systems may fall under the same federal law. The Fair Credit Reporting Act, written in 1970 to regulate how companies assemble and sell information about consumers, may apply to the AI scoring and ranking systems many employers have adopted in the last few years.
For HR, compliance, and legal teams, the question is no longer hypothetical. It is whether a tool that has already been deployed creates the same obligations as a traditional background check.
What the CFPB previously said (now-withdrawn guidance)
In October 2024, the CFPB issued Consumer Financial Protection Circular 2024-06. The Circular was later withdrawn in 2025 as part of a broader federal effort to pull back on certain guidance. It is not current federal guidance, and is referenced here only as historical context for the questions regulators and lawmakers have been examining.
The now-withdrawn Circular raised the question of whether an employer could make employment decisions using background dossiers, algorithmic scores, and other third-party consumer reports without adhering to the FCRA.
The Circular previously took the position that background dossiers compiled from public records, employment history, or similar data sources could be considered consumer reports under the FCRA. It also raised the same question for reports that convey scores about a worker’s risk level or performance. Under that view, the third parties producing those reports could meet the consumer reporting agency definition, with the obligations that designation carries, including procedures intended to assure maximum possible accuracy, disclosure of information in a worker’s file on request, and investigation of disputes alleging inaccuracies.
The now-withdrawn Circular framed two questions for evaluating an employer’s use of a tool:
- Is the data being used for employment purposes, meaning evaluating a person for employment, promotion, reassignment, or retention?
- Is the report coming from an entity that assembles or evaluates consumer information to produce reports for employers?
If the answer to both is yes, the Circular suggested the FCRA could apply. It also noted that a third-party software developer could meet the consumer reporting agency definition if the developer assembles or evaluates worker data to produce reports used in employment decisions.
While the Circular should not be treated as current federal guidance, the underlying issue remains worth monitoring as AI hiring laws and state-level policies continue to develop.
What the lawsuit alleges
On January 20, 2026, two job applicants filed a class action lawsuit in Contra Costa County Superior Court against Eightfold AI, the developer of an AI recruiting platform used by employers to evaluate job candidates. The plaintiffs allege the platform created what they call hidden credit reports about job seekers without complying with consumer reporting agency requirements.
According to the complaint reported by Fisher Phillips, the platform allegedly:
- Gathered information from third-party sources, including LinkedIn, GitHub, Stack Overflow, and public sources.
- Analyzed data from more than 1.5 billion global data points, including profiles of over 1 billion workers.
- Created inferences about applicants’ preferences, characteristics, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
- Ranked candidates on a 0 to 5 scale based on predicted likelihood of success in the role.
- Provided those assessments to employers, who used them to filter candidates before any human review.
The plaintiffs argue these assessments meet the FCRA definition of a consumer report and that the company failed to follow the statutory requirements that apply to companies producing such reports, including written disclosure and authorization, pre-adverse action procedures, and certifications obtained from the employers using the tool.
This case raises questions about how AI hiring tools may be evaluated under existing FCRA and employment law frameworks, separate from claims about bias or discrimination. The case is in its early stages, and the legal questions are novel enough that a definitive answer is likely years away. What is observable now is that plaintiffs’ counsel have continued to file these cases, and outcomes vary. Recent litigation and prior regulatory activity show this is an area employers using AI screening may want to monitor with their internal compliance team or legal counsel.
What the FCRA requires when it applies
When a third-party report is used for employment purposes, the FCRA establishes a defined process. The same obligations have applied to traditional background checks for decades. They generally include:
- A clear and conspicuous written disclosure to the applicant, in a stand-alone document, that a consumer report will be obtained for employment purposes.
- The applicant’s written authorization to procure the report.
- A pre-adverse action notice before any negative employment decision based on the report, with a copy of the report and the CFPB’s Summary of Your Rights Under the Fair Credit Reporting Act.
- An opportunity for the applicant to review and dispute the report before a final employment decision is made. Employers may want to review applicable federal, state, and local adverse action requirements with legal counsel to determine applicable timing.
- A final adverse action notice if the employer proceeds with the decision.
- Certifications from the employer to the consumer reporting agency confirming compliance with FCRA requirements, including that the report will not be used in a way that violates equal employment opportunity laws.
These requirements apply when a tool produces a report. If an AI vendor’s product meets the definition of a consumer report, those requirements may apply to the employer using the tool, whether the tool is marketed as a background check or as a recruiting platform.
Five questions HR and compliance teams may want to raise with legal counsel
Employers using or considering AI hiring tools can begin assessing exposure by asking the vendor and the internal team the following questions:
- Does the tool pull data from sources other than what the applicant directly provided in the application?
- Does the tool make inferences, predictions, or comparisons against external benchmarks, including data on other workers?
- Does the tool produce a score, rank, or recommendation that the employer uses to filter or evaluate candidates?
- Has the vendor provided the certifications a consumer reporting agency is required to obtain from an employer customer, and has the employer signed them?
- Does the candidate experience include a stand-alone FCRA disclosure, written authorization, and pre-adverse action notice before any negative outcome is finalized?
If a tool meets the description in questions one through three but the answer to four or five is no, that may be the gap worth raising with legal counsel.
How CIC supports employment screening
Corporate Intelligence Consultants is a consumer reporting agency under the FCRA. The full process exists to support consistent and defensible employment screening, including sample stand-alone disclosure language for employer review, authorization handling, sample pre-adverse action and adverse action notice documents for employer review, and the certifications a consumer reporting agency is required to obtain from each employer. Every report passes through human review by the research and QA team before it is released. Employers may want to review their forms and processes with legal counsel.
CIC does not score, rank, grade, clear, or fail any candidate. Reports provide reportable information that the employer reviews and uses to make hiring decisions. CIC strives to find ways to automate and enhance the screening process without sacrificing quality, and where technology assists, it operates under documented policy and human review.
The now-withdrawn CFPB Circular and the Eightfold complaint do not change what CIC does. They highlight that other tools may be evaluated under the same regulatory framework that consumer reporting agencies have been operating under for more than fifty years.
A short FAQ
Did the CFPB Circular have the force of law?
The Circular was a general statement of policy intended to promote consistency in enforcement across federal and state agencies. It did not create new legal requirements on its own. It has since been withdrawn, so it should not be referenced as current federal guidance. It is still informative as historical context for the questions regulators and lawmakers have been examining.
Is the Eightfold lawsuit settled?
No. The lawsuit was filed in January 2026 and is in its early stages. The legal questions involved are novel and likely to take years to resolve.
What if an AI vendor states that the FCRA does not apply to its product?
Employers conduct their own risk assessment, ideally with input from legal counsel. An AI vendor’s interpretation may not be the same one a regulator or court reaches. Even with the CFPB Circular withdrawn, the underlying FCRA questions about algorithmic scoring and background dossier products remain open and may continue to be tested in litigation.
How is CIC different from an AI hiring tool?
CIC is a consumer reporting agency operating under the FCRA framework. CIC provides reportable employment screening information for employers to review and use in hiring decisions and does not score or rank candidates. An AI hiring tool that scores or ranks candidates may also be subject to the FCRA, depending on how it operates, and is an area employers may want to review with legal counsel.
Closing thought
Employers that built robust FCRA compliance for traditional background checks have most of the system already in place. Extending that system to AI hiring tools means asking whether those tools meet the same definition the law applies to a consumer reporting agency, and confirming with legal counsel that disclosure, authorization, and adverse action procedures cover both.
CIC partners with employers to build structured screening programs that support consistent and defensible hiring decisions. To learn how CIC supports employment screening, explore CIC’s employment screening services or contact the CIC team.
This blog post is provided for informational and educational purposes only and does not constitute legal, regulatory, or compliance advice. The Fair Credit Reporting Act and related federal, state, and local laws are complex and continue to evolve. Corporate Intelligence Consultants is a consumer reporting agency and is not a law firm. Employers should review their own screening program, forms, and processes with their internal compliance team or legal counsel before relying on any information in this post.