Most HR departments run a disciplined background check process. First, they provide the applicant with notice of the check and obtain the applicant's written permission. If information in the report may affect an employment decision, the employer provides the applicant with a copy and an opportunity to respond before making a final decision. That machinery is well-built and well-documented. It is also too late, because the screen that eliminates the largest number of applicants now happens weeks earlier. What's more, the same statute may already cover it.

The half of the FCRA that belongs to you

The Fair Credit Reporting Act imposes two separate sets of duties. One set governs the company that assembles and sells the report. The other governs the employer that uses it, and HR compliance is built almost entirely around it: disclosures, notices, a summary of the candidate's rights, a reasonable interval, and a final adverse action notice. See 15 U.S.C. § 1681b(b)(2) and (b)(3).

Those duties run to the employer directly, so no vendor performs them for you and no indemnity discharges them. They also attach to the decision rather than to the vendor's paperwork. The statute's employment definition of “adverse action” reaches any decision for employment purposes that adversely affects a prospective employee, like a rejection that ends a candidacy.

Where the gap opens

Compare the two screens your process runs. The background check comes after a conditional offer, and through a vendor everyone in the building agrees is a consumer reporting agency. It has notice built around it. The algorithmic screen runs on every applicant, produces a score, and ends most candidacies without a letter, a copy, or a route to correct the underlying data.

Those two screens perform the same core function. Only one of them has a workflow. If a match score is a consumer report, your § 1681b(b) duties attach at the point of the automated rejection, where no notice exists today. Volume makes the gap expensive rather than merely awkward: the affected population is everyone who applied, not the few who received an offer.

What the pending case decides, and what it does not

Kistler v. Eightfold AI is the case to supply the answer. Two rejected applicants allege that an AI talent platform operated as an unregistered consumer reporting agency. It names the vendor rather than the employer, and the motion to dismiss has been under submission since the reply was filed on July 9, with the court having vacated the scheduled August hearing and taken the motion on the papers, so there is no ruling and nothing on the calendar. The case remains at the pleading stage, the court has made no findings, and the vendor disputes much of the complaint.

The eventual ruling will not create an obligation, because Section 1681b(b) already says what a user of consumer reports owes a candidate. What it may resolve, however, is whether these scores are consumer reports. If a court says they are, the answer describes a duty that applied all along, to candidates who have already been rejected. That asymmetry is the argument for acting before the ruling rather than after it. We covered the vendor side of this exposure, and the contract terms that fail to cover it, when the suit was filed.

Retrofitting the workflow

The work is narrower than an AI governance program, and it comes down to five questions, all of them answerable inside HR:

1. Where does a score, rather than a person, end a candidacy? That decision point is the one the statute would reach.
2. Does your own process language call that an adverse action? If the term appears only in the background-check procedure, the gap is already documented in your policies.
3. Can your ATS emit notice at that volume? A duty you cannot operationalize at scale is a budget question, and it is better raised before it is urgent.
4. Can you produce the score itself? You cannot disclose or let a candidate dispute a number the vendor holds and will not release.
5. How long is any of it retained? Nothing can be noticed or corrected after it has been purged, and retention schedules built for resumes were not built for this.

The through-line is the one we drew on the fraud side of the same funnel, where employers facing synthetic identity candidates are judged on the verification steps they can prove they took, because reasonableness is established by the records created before anyone asks for them.

The Bottom Line

• Your user-side duties do not depend on the ruling. Section 1681b(b) already allocates them to the employer, and the open question is only whether these scores fall inside it.
• Find the automated decision point and treat it as a candidate for notice. The tooling that gates applicants before human review is where the workflow stops short.
• A vendor indemnity does not perform your notice. User obligations are not delegable to the company that sold you the tool.
• Fix retention before you fix notice. A score you no longer hold cannot be disclosed, corrected, or defended.

For questions about AI hiring tools, the FCRA, and algorithmic employment decisions, please contact the Jones Walker Privacy, Data Strategy and Artificial Intelligence team. Stay tuned and subscribe for continued insights from the AI Law and Policy Navigator.