Legal Eagles Update on Mitigating Hiring Risks

Legal and regulatory expectations in hiring are evolving, but not always how organizations expect. At Collaborate 2026, First Advantage brought together legal experts, customers, and guests for focused discussions on the current legal landscape. In a session I led with Pamela Devata, partner at Seyfarth, we shared that while federal regulators may have had some decrease in enforcement activity, risk is shifting to state and local authorities.

Federal slowdown is shifting risk to the states

The current regulatory environment reflects a shift in enforcement and legislative activity.

At the federal level:

• Legislative proposals, such as the Fair Credit Reporting Act (FCRA) Liability Harmonization Act (H.R. 5775), aim to modify civil liability provisions (including potential caps on statutory damages) and limitations on punitive damages and attorneys’ fees.

However, reduced federal enforcement at certain regulatory agencies doesn’t necessarily indicate reduced risk. Instead, organizations should expect:

• Increased state and local legislation and enforcement
• Expanded legislative activity across jurisdictions

This shift reinforces the need for organizations to monitor both federal developments and state and local changes that may impose additional requirements.

AI introduces new and evolving legal risks

While artificial intelligence continues to expand into hiring and workforce decision-making, legal frameworks remain fragmented.

At the federal level, no comprehensive legislation governing AI in employment is expected in the near term. In the absence of federal action:

• State legislatures, particularly in jurisdictions such as California, Colorado, and Connecticut, are expected to continue advancing AI-related laws.
• Existing and proposed laws focus on employer obligations, such as notice, audits, and disparate impact analysis.
• Some AI-related laws and regulations include opt-out or alternative-process requirements.

In addition to employer obligations, legal risk is expanding across the ecosystem:

• Vendors selling identity solutions for use in making employment decisions might face claims under the Fair Credit Reporting Act.
• Employers may face liability as end users of the same.
• Litigation may arise as some laws provide a private right of action from the use of AI in sourcing, screening, or making hiring decisions.

Existing laws, new use cases

A key consideration is that many risks stem not from new laws, but from new uses of existing technologies. Examples include:

• Uploading proprietary or confidential data into public AI tools creates data privacy concerns
• Use of AI for recording or note-taking, potentially triggering privacy or wiretap consent violations
• AI-generated training or onboarding materials raising intellectual property concerns
• Use of AI in hiring decisions introduces potential violations of state-level AI laws or in general existing employment laws and FCRA-related claims

Identity verification and privacy considerations

Identity verification tools are increasingly being used to address rising concerns around fraudulent applicants, particularly in remote hiring environments. These tools are designed to confirm that the individual participating in the hiring process is the same individual who will be employed, using methods such as document verification and biometric matching. A mismatch or incomplete verification could indicate the need for further investigation or additional information to validate identity.

However, important limitations were emphasized:

• These tools are not a substitute for employment eligibility verification (e.g., I-9/E-Verify)
• They should not be used as a basis for employment decisions
• They may raise Fair Credit Reporting Act considerations, depending on how they are used

At the same time, privacy laws continue to expand across multiple states, including California, Colorado, Texas, Connecticut, Florida, Minnesota, Virginia, and others. Key considerations include:

• Consumer requests to delete personal data
• Applicability of privacy laws to non-FCRA data
• The need to carefully evaluate what data is being used in hiring processes

FCRA compliance remains a core litigation risk

Despite evolving technologies and regulations, the FCRA remains a central source of legal compliance.

Disclosures and authorizations

Current trends indicate ongoing litigation risk for employers who use background screening companies regarding the FCRA requirements around disclosure and authorization, including:

• The requirement that disclosures be provided in a standalone document
• Limitations on including “extraneous” information
• Confusion created by statutory language allowing disclosure and authorization to be combined

Additional considerations include:

• State-specific requirements that should not be included in the disclosure
• Increased scrutiny of language related to ongoing or “throughout employment” checks
• Emerging litigation targeting promotions and internal mobility decisions

Adverse action requirements

Adverse action processes remain highly prescriptive and require careful attention. Required steps include:

• Providing a pre-adverse action notice
• Supplying a copy of the report and a summary of rights
• Allowing an appropriate waiting period (with federal guidance suggesting five days, but state laws potentially requiring more)
• Delivering a final adverse action notice with specific required elements

The session also noted that FCRA damages may include actual damages, statutory damages, attorneys’ fees, and (for willful violations) punitive damages.

Fair chance laws and credit restrictions continue to expand

State and local fair chance laws continue to evolve, with new and updated requirements. The following examples were discussed:

• The Washington State Fair Chance Act requires delays in criminal history inquiries until after a conditional offer and mandates written individualized assessments.
• The Philadelphia Fair Chance Ordinance amendments introducing shortened lookback periods and expanded notice requirements.
• Proposed expansions in California might introduce additional requirements related to assessments and disclosures.

In addition, New York state has enacted a broad credit history ban effective April 18, 2026. The law prohibits most employers from requesting or using consumer credit history for hiring, promotion, or compensation decisions. It defines credit history broadly to include credit reports, credit scores, bankruptcies, liens, and judgments, with limited role-specific exceptions.

Practical steps for employers

Employers should take the following steps now to mitigate risk and support compliance requirements in a rapidly changing legal environment:

• Monitor legal developments regularly, as laws and guidance continue to evolve.
• Review background check forms and notices regularly.
• Maintain clear policies regarding the use of AI in hiring.
• Evaluate vendor practices (including how AI is being used).
• Develop and document individualized assessment processes.
• Train employees on applicable laws and best practices.

Frequently Asked Questions