A company-wide "we don't hire anyone with a felony" policy is one of the riskiest hiring rules you can write. Not because looking at criminal history is illegal. It's risky because a blanket rule can't do the one thing the law actually requires: check whether the conviction has anything to do with the job you're filling.
I already walked through how to evaluate one candidate's record fairly, offense by offense. This article is about something that happens earlier than that: the written policy itself, and why a formal rule carries more legal exposure than one bad individual decision ever would.
Here's the part that surprises employers. One manager making a poor call on one candidate is a problem. A written policy that makes the same poor call on every candidate, forever, is a much bigger one.
A policy is evidence. It's proof, in writing, that you excluded people the same way every time, without looking at what actually happened or whether it even mattered for the job. A court doesn't have to guess at your intent. Your handbook spells it out for them.
So to say that a different way: a bad individual decision is a mistake. A bad policy is a pattern. And patterns are exactly what EEOC investigations and class-action lawsuits get built around.
Your policy probably doesn't say anything about race. Most don't. That's not the same as being safe.
Conviction rates aren't spread evenly across every group of people in this country. That's a documented pattern, not an opinion. So a rule like "no felony convictions, ever" can end up screening out one group of applicants at a much higher rate than others, even though the policy itself is written in completely neutral language.
That gap is called disparate impact, and it's been part of Title VII since the 1970s. A policy doesn't need to target anyone on purpose to violate it. Intent doesn't matter here. Effect does. What matters is what the rule actually does once you look at who it screens out, not what it says on paper.
The EEOC's 2012 guidance on criminal records gives employers one narrow way out of a disparate impact problem: show the policy is job-related and consistent with business necessity. That's the legal phrase, and both halves have to hold up, not just one.
Job-related means the specific conviction you're excluding for actually connects to a real risk in the actual job. A theft conviction disqualifying someone from handling company cash clears that bar pretty easily. The same conviction disqualifying someone from a warehouse job with no cash access probably doesn't.
Business necessity means the exclusion serves a real, provable purpose, not just a general sense of caution. "We'd rather not take the risk" isn't a defense on its own. Courts want to see that you actually weighed how long ago the offense happened and what the job involves, not that you assumed the worst and moved on.
A blanket policy fails this test almost by definition. It excludes the fifteen-year-old shoplifting conviction and the recent violent felony under the same rule, for every job in the company, from a delivery driver to a warehouse stocker. That's not job-related to anything specific. That's just a fear of records in general.
Not "no felons." Something closer to: convictions get considered one at a time, weighed against the specific job, with a real chance for the candidate to respond before anything final gets decided. I already broke down that three-factor review in detail, so I won't repeat it here.
What matters for the policy document itself is narrower than that. Don't write "excluded permanently for any felony." Write which specific offenses concern you, for which specific roles, and for how long. A five-year lookback on a violent offense tied to a role working with vulnerable people reads completely differently to a court than a lifetime ban applied company-wide to every job you have.
The biggest one: treating "felony" as one category. It isn't. A decades-old drug possession charge and a violent offense from last year get lumped into the same box, and the same automatic no, under most blanket policies. That's exactly the kind of undifferentiated exclusion the EEOC guidance calls out by name.
The second: applying the rule to jobs where it makes no sense at all. If your policy excludes any felony conviction for a remote data-entry role with zero physical access to anything, that exclusion is hard to justify as business necessity. Nobody's buying that a theft conviction from 2009 threatens a job with no cash, no inventory, and no in-person contact.
The third: no path for the candidate to respond before the decision is final. Even a defensible, genuinely job-related exclusion looks worse in front of a court or the EEOC when the candidate never got a chance to explain context, show rehabilitation, or flag a mistaken record.
If your handbook still has a "no felons" line in it, that's the first thing to fix. Not because it feels risky. Because it is.