Quick answer: if your AI hiring tool pulls information about a candidate from more than one source and turns it into a score or a recommendation you use to make a hiring call, it might legally be a background check. Even if nobody who built it meant it to work that way. That's the whole risk. Let's get into why.
The federal law here is the Fair Credit Reporting Act, or FCRA. Most employers know it as "the background check law." But FCRA doesn't define who it covers by what a company calls itself. It defines it by what the company actually does.
Strip out the legal language and the rule is simple. A company that regularly gathers information about a person from more than one source, then hands that information, or a score built from it, to someone else who uses it for a decision about that person, is acting as a consumer reporting agency. Employment decisions count.
That's it. No mention of background checks anywhere in the actual definition.
That's exactly why a traditional screening company counts. It pulls court records, database hits, maybe an employer verification, bundles them together, and sends the result to you for a hiring decision. Multiple sources in, one product out, handed to a third party for a decision. That's the pattern the law is built around.
Now compare that to a tool that just isn't in this territory at all. Say you use a plain applicant tracking system that stores a resume the candidate typed in themselves, and nothing else. Nobody's assembling outside information about that person.
There's no second source, no score built off of it, nothing handed to a third party beyond the resume the candidate gave you directly. That tool almost certainly isn't a consumer reporting agency. It isn't the tool this article is about.
Here's where employers get comfortable, and where I think that comfort is misplaced. A lot of AI hiring and screening tools do something that looks a lot like the pattern above, just faster and with a slicker interface.
Think about a generic AI screening tool doing what these tools generally do. It pulls a candidate's work history, maybe public online activity, sometimes other data sources, and runs it through a model.
The output is a fit score or a risk score. You look at that score and decide whether the candidate moves forward.
Walk that through the functional test. Multiple sources of information about a specific person? Check. Assembled and evaluated by the tool, not just handed to you raw? Check. The output used by you, a third party, to make an employment decision? Check. Nothing in that sequence changes because a model did the assembling instead of a human analyst.
Picture it concretely. A tool pulls a candidate's employment history from a professional network, cross-references it against a public records database, and rolls the result into one "trust score" out of 100. You see the number, not the underlying records.
You decide whether to move the candidate forward based on that number alone. That's not a hypothetical edge case. That's a fairly ordinary description of what a lot of these products already do.
I don't think most AI hiring vendors are trying to dodge federal law. I think most of them never asked the question. The team that built the scoring model was hired to build a good model, not to read the FCRA line by line.
"It's AI, not a background check" is a marketing distinction. It's not a legal one. The law doesn't care what the tool is called on its landing page.
A lot of AI hiring tools include a line in their contract or terms of service saying something like "this platform is not a consumer reporting agency and does not provide consumer reports." I get why that line exists. It's there to limit the vendor's own liability.
Here's what that line doesn't do. It doesn't change what the tool actually does with a candidate's data. Whether something counts as a consumer report under federal law comes down to function, not to what a contract says about itself.
A company can call its product whatever it wants in the fine print. That label doesn't override the facts of how the tool works.
This matters for you specifically, not just the vendor. If the tool functions as a CRA and the paperwork says otherwise, you're the one who still has to meet the disclosure and consent rules on your side, contract language or not. A vendor's disclaimer doesn't protect you. It mostly protects them.
If a tool crosses that line, it doesn't just mean extra paperwork for the vendor. It means a specific set of obligations, and most of them land on you, the employer, not just the company that built the tool.
Most AI hiring tools I've seen aren't built to do any of this. They're built to score candidates fast, not to run a compliant adverse-action workflow. That gap is the exposure. FCRA's obligations on the employer side kick in whether or not the tool you're using was designed with them in mind.
And that's the part that should actually worry you. If the tool never counted as a CRA, none of this applies. But if it does, and you've been using it without any of the five steps above, that's not a small paperwork gap. That's the exact violation this law exists to catch.
You don't need a law degree to protect yourself here. You need better questions before you sign a contract, not after something goes wrong.
I'm not going to pretend every AI hiring tool is a hidden compliance trap. Plenty of them do one narrow thing, like parsing a resume you already have, and never touch outside data at all. Those aren't the problem.
The tools that quietly reach out and pull in more than what the candidate gave you are the ones to slow down on.
I'll be straight with you. This isn't a solved question with one clean answer that applies to every tool on the market. FCRA was written decades before anyone built a hiring algorithm, and regulators, courts, and employment lawyers are still working out exactly where the line falls for specific products.
What I can tell you with real confidence is the direction things are moving. Employment lawyers are increasingly flagging AI hiring and screening tools as a live FCRA exposure, not a theoretical one.
That's different from pointing to one ruling and calling it settled law. It's a field that's actively being watched, by people whose job is to watch it.
Unsettled doesn't mean safe. It means nobody can hand you a guarantee either way, which is exactly why waiting for a clean answer before you fix anything is a bad plan. Talk to an employment lawyer about your specific tools. Laws and interpretations here move fast, and I'm not going to pretend a general article can replace advice specific to your setup.
One more thing worth separating out. You've probably also heard about AI hiring tools getting scrutinized for bias, meaning whether the model screens out candidates unfairly along lines like race, age, or disability.
That's a real problem, with its own set of laws. It's not the same issue as this one. A tool can be perfectly unbiased and still be functioning as an unregistered consumer reporting agency.
Don't let a vendor's answer to the bias question stand in for an answer to this one. They're different questions with different rules.
A handful of states have also started passing their own rules aimed specifically at automated tools used in hiring, on top of whatever FCRA already requires. I won't try to summarize state-specific rules here. They vary and change fast enough that a general article would go stale before you finished reading it.
If you're using an AI hiring tool today, ask your lawyer whether your state has added anything on top of the federal picture, not just whether FCRA applies.
Here's the thing that actually matters once you get past the legal theory. Building in disclosure, consent, and an adverse-action process isn't expensive or complicated. Traditional background check companies have been doing exactly this for years. It's a solved operational problem, not a hard one.
What's expensive is finding out after the fact that a tool you trusted to just "help with hiring" was quietly functioning as an unregistered background check company the whole time, with none of the disclosures, none of the consent, and none of the dispute process the law requires.
So don't ask your vendor whether their tool is a background check. Ask what it does with a candidate's information, where that information comes from, and what happens to that output when you use it to say yes or no to a person.
The answer to those three questions tells you everything the label on the product never will.