Is Your ATS a Credit Bureau Now? The Eightfold FCRA Lawsuit

An AI applicant scoring tool can fall under the Fair Credit Reporting Act if it assembles outside data about candidates into an employment-eligibility “report” and hands that report to employers. That is the novel claim in Kistler v. Eightfold AI, a class action filed in January 2026 that asks a question most founders have never considered: is your hiring software quietly acting as a credit bureau? If a court agrees, the consumer-reporting duties most companies associate with background checks, disclosure, consent, a copy of the report, and a formal dispute window, could apply to covered AI screening reports; this would not automatically cover every ATS.

This is a different legal theory from the bias lawsuits you have read about, and it is arguably more dangerous because it does not require anyone to prove the algorithm was unfair. Secrecy alone is not sufficient: the claimant must establish the law’s applicability and a breach of the relevant duties. Below is what the case actually claims, how the FCRA test works, and what a defensible AI hiring pipeline looks like when a human, not a hidden score, owns every rejection. (This is general information, not legal advice. Talk to counsel about your specific stack.)

The headline: AI is allegedly running secret “credit reports” on job seekers

The short version: a federal class action alleges that an AI hiring platform built secret eligibility reports on applicants and rejected them without ever telling them. Kistler v. Eightfold AI was filed on January 20, 2026 in the Superior Court of California, Contra Costa County (No. C26-00214), then removed to federal court as Kistler et al. v. Eightfold AI Inc., No. 3:26-cv-01768 (N.D. Cal.). The named plaintiffs are Erin Kistler and Sruti Bhaumik, suing on behalf of a putative class of job applicants.

What makes this more than another HR-tech complaint is who signed it. The case is brought by plaintiff-side firm Outten & Golden LLP together with the nonprofit Towards Justice, and counsel of record includes Jenny R. Yang, the former Chair of the U.S. Equal Employment Opportunity Commission. Towards Justice has called it the first case from its AI in the Workplace Accountability Project. A former EEOC chair putting her name on a complaint is not an accident. This is a deliberate, strategic test case, and it is meant to set precedent.

The human stakes are simple. As Kistler puts it in the firm’s release: “I’ve applied to hundreds of jobs, but it feels like an unseen force is stopping me from being fairly considered.” Yang frames the legal harm: “Qualified workers across the country are being denied job opportunities based on automated assessments they have never seen and cannot challenge.”

What the lawsuit actually claims

The complaint alleges that Eightfold’s platform scores applicants and discards many of them before a human ever looks. According to the filing, Eightfold uses a proprietary large language model to generate a “Match Score” that rates each applicant on their “likelihood of success” in a role. The complaint states the Match Score “ranges from 0 through 5” in tenth-point increments (¶74). Crucially, it alleges that applicants are “often discarded before a human being ever looks at their application.”

The complaint also describes the data feeding that score. For each named plaintiff, it alleges Eightfold gathered “consumer report information including personal data, information regarding her education and work experience, social media profiles, location data,” plus inferences and “comparator applicant data drawn from millions of other individuals’ resumes and profiles” (¶~100, ¶~107). The platform’s reach, the complaint says, is enormous: it quotes Eightfold’s own marketing that its model incorporates “more than 1.5 billion global data points,” including the profiles of “more than 1 billion” people.

One caveat worth stating plainly: those billion-plus figures are Eightfold’s described training and reference corpus, repeated in the complaint, not a verified count of individuals whose data was misused. The accurate way to say it is that the model is trained on a corpus Eightfold says includes profiles of more than a billion people. The scale is an allegation, not a finding.

Here is what the lawsuit pointedly does not claim: that the algorithm is biased. It does not plead the discrimination theories associated with Title VII, the ADEA, or the ADA. The complaint pleads violations of the federal FCRA, California’s Investigative Consumer Reporting Agencies Act (ICRAA), and California’s Unfair Competition Law (UCL), with a demand for a jury trial. The theory is procedural, not about outcomes. The argument is that a scoring system existed in secret and was deployed without the process the law requires. A defendant could, in theory, have a perfectly fair algorithm and still lose this case.

Is an ATS a consumer reporting agency under the FCRA?

An applicant tracking system can fall under the FCRA if it assembles third-party or inferred data about candidates into an employment-eligibility “consumer report” and furnishes it to employers. Processing an employer’s application data alone is not a blanket exemption for every external software vendor; the statutory definitions and actual relationships matter. But AI tools that pull in scraped social media, location data, and comparator profiles blur that line, and that blur is the entire fight in this case.

The statute defines a “consumer report” broadly (15 U.S.C. §1681a) as any communication by a consumer reporting agency bearing on a person’s character, reputation, personal characteristics, or mode of living, when used to establish eligibility for employment. The complaint argues that assembling outside and inferred data into an employment-eligibility score puts Eightfold squarely inside that definition and makes it a consumer reporting agency (CRA).

Whether that argument wins comes down to a few contested questions:

• Is the data first-party or third-party? The FCRA generally exempts a company reporting “solely as to transactions or experiences between the consumer and the person making the report.” Whether that exclusion applies requires examining whose transactions or experiences the report describes. Plaintiffs argue Eightfold pierces that exemption because it ingests scraped and inferred outside data.
• Is the score “furnished to a third party”? A CRA furnishes reports to others. Eightfold may argue the Match Score stays inside the employer’s own hiring workflow and is never handed off.
• Is an LLM “match score” even a consumer report? Eightfold may argue a predictive analytic is not the kind of assembled report Congress regulated in 1970.

This article describes the complaint’s allegations, not a finding that Eightfold violated the law. The plaintiffs’ case page provides their account. Applicability to a particular vendor and report depends on the facts and statutory definitions.

Eightfold vs. Workday: two different ways your AI hiring stack can get you sued

If you only track one AI hiring lawsuit, you are exposed to the other. Kistler v. Eightfold and Mobley v. Workday are heard in the same federal court but run on opposite theories, and your pipeline has to satisfy both.

The Workday case is about whether your tool discriminates. We covered it in depth in what the Workday AI hiring lawsuit means for every ATS. The Eightfold case is about whether your tool followed consumer-reporting process. They are two separate failure modes of the same underlying design: the opaque, automated, no-human-in-the-loop pipeline that scores and discards candidates before anyone reads the file. Fix the design and you reduce exposure on both fronts.

What FCRA “adverse action” would mean if your screening tool is a CRA

If a court decides your AI vendor is a CRA, the consumer-reporting duties do not just land on the vendor. They land on you, the employer, as a “user” of consumer reports. That is the part founders miss. Reportedly, Eightfold’s customers include Microsoft, Morgan Stanley, Starbucks, BNY, PayPal, Chevron, and Bayer (these companies are not defendants), but the FCRA imposes obligations on every employer that uses a covered report.

Those obligations come in four buckets:

1. Disclosure. A clear, conspicuous written notice that a consumer report will be obtained, in a standalone document.
2. Authorization. The applicant’s written consent before obtaining the report.
3. Pre-adverse-action notice. Before you reject, give the candidate a copy of the report plus a “Summary of Your Rights Under the FCRA,” and an appropriate opportunity to review and dispute it; five business days is a common practice, not a universal period specified by the FCRA.
4. Final adverse-action notice. After you reject, notify the candidate, identify the CRA, state that the CRA did not make the decision, and disclose the right to a free copy of the report within 60 days and the right to dispute its accuracy.

The plaintiffs allege they received none of the required protections. First establish whether the report and use are covered, then implement the applicable procedure. A human making the final decision does not remove these obligations. FTC guidance for employers.

This is not a hypothetical risk. In 2023, the EEOC settled with iTutorGroup for $365,000 over software that auto-rejected older applicants. That was an anti-discrimination case, not an FCRA case, so the theory differs, but the lesson holds: auto-reject liability is real, and regulators and plaintiffs are actively looking for it.

Oversight does not replace the required procedure

Assign responsibility for decisions, record reasons, and check the information on which ratings rely. Human review can help detect mistakes, but it is not an exemption from FCRA duties or discrimination law. Opening a CV does not prove that someone read it.

Separately assess the laws that apply to the hiring process, including the EU AI Act for high-risk hiring systems. Human oversight is not synonymous with a manual click before every decision. Update, September 7, 2026: following the July 27, 2026 amendment, the application date for Annex III high-risk systems, including specified employment uses, is December 2, 2027. European Commission, consolidated regulation.

Questions for your team and vendor

1. What data does the vendor collect, infer, and supply, including information outside the application?
2. Which scores or rules can trigger automatic actions, and who checks errors or disputed information?
3. Can you reconstruct ratings, automated actions, responsible people, and decision reasons?
4. If FCRA applies, are the standalone disclosure, authorization, and adverse-action procedures in place? A general application checkbox or privacy-policy link does not replace them.
5. Which obligations belong to the vendor and which to the employer? Contractual assurances do not remove the user’s statutory duties.
6. How can applicants report errors, and who handles those reports before a final adverse decision?

Using Kit

Kit summarizes applications and parses CVs. Reviewers record ratings and recommendations, but not every state change requires separate human approval. Votes can advance an application, a lead veto can cause rejection, and authorized MCP tools can change application state. Unresolved cases enter the decision queue.

Review and action history help the team inspect what happened. They do not automatically prove that a person read the CV or made every decision. Kit’s consent configuration is not a complete FCRA workflow, and a recorded rationale does not replace required notices.

Ask vendors about data sources, decision rules, corrections, and history. A single answer about auto-rejection does not establish legal compliance. Try Kit to inspect how those records are available in practice.