Screening
An AI Candidate Score Can Be a Consumer Report, Which Changes Your Notices
The Fair Credit Reporting Act can reach a vendor's AI candidate score: the statute turns on who assembled the information, not on how modern the method is. A third party that collects data about applicants and returns a score or assessment to employers can be acting as a consumer reporting agency, making its output a consumer report for employment purposes. That brings a standalone written disclosure, written authorization, a pre-adverse-action notice with a copy of the report, and a final adverse-action notice. Have counsel classify the specific vendor output.
The takeRead a stack of AI hiring compliance checklists and they cover Title VII and the state AI statutes. The FCRA appears in almost none of them, which is odd, because most recruiting teams already run a compliant notice process for background checks and could extend it in an afternoon. The regime with the clearest private right of action and the best-established plaintiff playbook is the one sitting outside the AI conversation entirely. That is a gap in the checklists, not a gap in the law.
Where Olive fits
Open a role and see what the work shows
Olive returns six findings on one candidate, each written by a human reviewer and anchored to a timestamped excerpt from the session, with outcomes stated as demonstrated, partly demonstrated or not demonstrated rather than as a number. The candidate is granted the identical report, free, on every tier.
Rank your shortlistWhen does a vendor's AI score become a consumer report?
When a third party assembles or evaluates information about the person and gives it to you for an employment decision. The hinge is the arrangement, not the algorithm. A consumer financial regulator said in 2024 that an entity could assemble or evaluate consumer information within the meaning of consumer reporting agency if it collects consumer data to train an algorithm producing scores about workers for employers 1.
The practical split falls roughly here. A vendor that maintains its own corpus of candidate information, or draws on data from outside your applicant pool, and returns a judgment about the person is doing something a consumer reporting agency does. A tool that runs a computation only over records your applicants gave you, and holds nothing about anyone else, usually is not, because nobody outside the company assembled anything.
The interesting cases sit between those poles. A vendor that enriches your applicant records with public web data. A platform that scores this applicant partly against the outcomes of candidates at other customers. A sourcing tool that builds a profile of someone who never applied to you. Each of those looks more like assembly than computation.
Do not settle this from a product page. Ask the vendor in writing what data sources feed the output and whether any of them originate outside your own systems, then have counsel classify the answer. The classification is specific to the product and to how you use it.
What the FCRA requires before and after an adverse action
Four steps, in order, and none of them are hard once the process exists. Before the report is obtained, a clear and conspicuous written disclosure in a document that consists solely of that disclosure, plus the applicant's written authorization 2. Before taking adverse action based in whole or in part on the report, a copy of the report and a written description of the consumer's rights 2. Then the final adverse-action notice 7.
The middle step is the one that matters most and gets skipped most. The pre-adverse-action notice exists so the person can see what was said about them and dispute it before the decision lands, which means a gap has to be left between the two notices. A pre-adverse notice and a rejection sent in the same hour satisfies the form and defeats the purpose, and that is the pattern plaintiffs' firms look for.
Two details worth building into the process rather than remembering:
1. The disclosure stands alone. Burying it inside an application form or an offer letter is the single most litigated defect in this area. 2. A copy of the report means the report. If the vendor will not hand over what it gave you in a form the applicant can read, you cannot perform the step, and that is a procurement problem to solve before signing rather than after a complaint.
What you tell the candidate matters beyond compliance. What you owe a candidate who asks why the AI screened them out covers the version of this conversation that happens whether or not the statute applies.
Why a withdrawn circular still matters
Because the guidance was withdrawn and the statute was not. The circular setting out this reading of the FCRA was published in November 2024 and then withdrawn on May 12, 2025, in a notice retiring 67 guidance materials at once 3. Agency guidance never had the force of law. The Fair Credit Reporting Act's employment provisions are unchanged, and they carry a private right of action, which is the part that decides most outcomes.
This is the second federal agency in 2025 to pull its AI-adjacent hiring guidance while the underlying law stayed exactly where it was. The EEOC removed its two AI technical assistance documents in late January 2025 4. Neither removal repealed anything. What both removals changed is where a compliance team can point when explaining a decision internally, which is a real cost and a different one from legal exposure.
The litigation has not paused for any of it. A Fair Credit Reporting Act case against an AI recruiting platform reached the Northern District of California on March 2, 2026, removed there by the defendant from a California state court 5. Nothing has been adjudicated on the merits, so read it as evidence about where claims are being brought rather than about who wins. Set it beside the discrimination case teams already know: Mobley v. Workday, filed February 2023, where a July 2024 order let disparate-impact claims proceed against the vendor on an agent theory and the court granted preliminary collective certification of the age claim on May 16, 2025 6.
Two different statutes, two different theories, one shared premise: the employer using the tool is in the room either way.
Ask the vendor four questions before the renewal
Ask them in email, not on a call, so the answers exist in writing when you need them. These four separate a product that has thought about the FCRA from one that has not, and the second kind is common because the category grew up inside HR tech, a long way from consumer reporting.
1. What data sources produce this output, and do any of them originate outside our own systems? The answer drives the classification. A vague answer is itself an answer. 2. Do you consider yourself a consumer reporting agency for this product, and if not, on what basis? Ask for the reasoning behind the answer. A vendor that has never been asked will tell you so by how it responds. 3. Can we obtain, in a readable form, exactly what you gave us about a specific applicant, within a working day? Without this, the pre-adverse-action step cannot be performed at all. 4. What is the dispute path for an applicant who says the information is wrong, and who resolves it? If the answer is that the applicant should contact you, and you have no way to correct the vendor's record, the loop does not close.
One procurement note. Indemnification language is not a substitute for any of the four. An indemnity allocates money after a loss; it does not perform a notice, produce a report copy or fix a record, and it does not move a statutory duty off the employer who used the tool.
If you are running this conversation across several vendors at once, the questions that actually verify a screening vendor's claims covers the wider set. And if you have not yet listed which of your own tools are in scope for the state AI rules, whether your ATS already counts as regulated AI is the inventory that should come first. Confirm all of it with counsel before relying on any of it.
Common questions
Does the FCRA apply to a score our own team builds in-house?
Usually not, because the statute turns on a third party assembling or evaluating information about the person and furnishing it to you. A computation your own staff run over your own applicant records does not have that shape. Two things can change the answer: pulling in data from outside your systems, and using a vendor's infrastructure in a way that makes the vendor the one assembling. Neither is obvious from the org chart, so classify the data flow rather than the team that owns the project.
Is an AI resume summary a consumer report?
A summary of a document the applicant sent you, produced by a tool that holds no information about that person from anywhere else, is a poor fit for the definition. The picture changes once the tool enriches the record with outside data, compares the applicant against a population you did not supply, or returns a judgment about the person rather than a condensation of what they wrote. The test is where the information came from and what kind of statement comes out, not whether the output reads like prose or like a number.
We already run background checks. Can we just add the AI vendor to that process?
Often yes, and that is the cheapest path available. The notice machinery is the same: standalone disclosure, written authorization, pre-adverse-action notice with a copy of the report and a description of rights, then the final notice. Two adjustments are usually needed. The disclosure has to describe what is actually being obtained, and the pre-adverse-action step needs a report copy the vendor will genuinely produce for a named applicant. Confirm the wording with counsel rather than reusing the criminal-records template unchanged.
How long should we wait between the pre-adverse and final notices?
Long enough for the applicant to see the report and respond, which is the point of the step. The statute sets no fixed interval, and a common practice is around five business days, though practice is not law and counsel should set your number. What matters more than the exact figure is that the gap is real and that a dispute arriving inside it actually reaches a person who can pause the decision. A window nobody monitors is the same as no window.
Does a human making the final call take the score outside the FCRA?
No. The statute reaches a report used in whole or in part in an employment decision, so a human reviewing the output does not remove it from scope the way it can under some automated-decision rules. That difference catches teams who have already worked through the state AI statutes and assume the same reasoning transfers. It does not. Human review changes the analysis under some regimes and changes nothing under this one.
References
- 1. Consumer Financial Protection Circular 2024-06: Background Dossiers and Algorithmic Scores for Hiring, Promotion, and Other Employment Decisions, 89 FR 88875 govinfo.gov Supports the reading that an entity training an algorithm on consumer data to produce scores about workers for employers can be assembling or evaluating information as a consumer reporting agency, published at 89 FR 88875.
- 2. 15 U.S.C. 1681b(b) - Conditions for furnishing and using consumer reports for employment purposes uscode.house.gov Supports the standalone written disclosure and written authorization requirement, and the duty to give a copy of the report and a written description of consumer rights before adverse action.
- 3. Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal, 90 FR 20084 govinfo.gov Supports the withdrawal of Circular 2024-06 applicable May 12, 2025 as part of a notice retiring 67 guidance materials (8 policy statements, 7 interpretive rules, 13 advisory opinions and 39 other guidance items), published at 90 FR 20084.
- 4. Select Issues: Assessing Adverse Impact in Software, Algorithms, and Artificial Intelligence Used in Employment Selection Procedures Under Title VII of the Civil Rights Act of 1964 (archived capture, 2025-01-25) web.archive.org Supports the parallel that the EEOC's AI technical assistance was removed from its site in late January 2025 while the underlying law was unchanged.
- 5. Kistler v. Eightfold AI Inc., No. 3:26-cv-01768 (N.D. Cal.), docket, cause of action 15:1681 Fair Credit Reporting Act courtlistener.com Supports the existence of a Fair Credit Reporting Act case against an AI recruiting platform, docket 3:26-cv-01768, cause 15:1681, removed from Contra Costa County Superior Court to the Northern District of California on March 2, 2026, with no merits adjudication.
- 6. Mobley v. Workday, Inc., 3:23-cv-00770 (N.D. Cal.) clearinghouse.net Supports the contrasting discrimination case: filing date, the July 2024 order allowing disparate-impact claims against the vendor on an agent theory, and preliminary collective certification of the ADEA claim on May 16, 2025.
- 7. 15 U.S.C. 1681m - Requirements on users of consumer reports, subsection (a) duties of users taking adverse actions uscode.house.gov Supports the final adverse-action notice as a duty on the user of the report, separate from the pre-adverse-action step in 1681b(b).
7 sources, numbered by first appearance. How Olive sources claims
General guidance for hiring teams. What works at one company and one volume may not transfer to yours.
Olive assesses how a person works with AI. It does not detect AI-written documents, and it never produces a score, a ranking, or a match percentage for a person. Candidates read the same report the employer reads.