The legal mistake courts should avoid in Eightfold AI lawsuit
The Eightfold AI class action suit threatens to stretch consumer reporting laws beyond their limits, treating AI software vendors as reporting agencies rather than tool builders.
By
Jon Polenberg
Published: 01 Jun 2026
While AI-based screening of job candidates comes with several concerns, the recent class-action lawsuit against hiring software company Eightfold AI threatens to establish a misguided precedent that would stretch the bounds of developer responsibility. The lawsuit cites decades-old consumer reporting laws to wrongly ask the courts to settle a matter that should instead be the responsibility of legislators.
The lawsuit was filed in January in the Contra Costa County Superior Court of California. The plaintiffs, two job applicants, alleged Eightfold uses a cloud-based platform that aggregates information about job applicants from multiple sources, including applicants' resumes and profiles, publicly available professional information, employer data and proprietary data sets.
The platform then applies machine learning models to generate a numerical "match score" predicting how well an applicant fits a particular job. Once delivered to employers, these rankings help hiring managers screen candidates; lower-ranked candidates might not have a human review their applications. The complaint also alleged that applicants can't see or correct the data or scores used in the evaluation process.
In other words, the plaintiffs argued that Eightfold functions like a consumer reporting agency. They liken Eightfold to an agency that compiles personal information into reports and sells those reports to others for use in credit, housing or employment decisions. If Eightfold qualifies as a consumer reporting agency, it would face strict obligations relative to disclosures, accuracy and dispute rights. The law would treat it like a credit bureau or a background-check company under the Federal Trade Commission's more than 50-year-old consumer reporting laws.
Is Eightfold really like a consumer reporting agency?
A company that sells database software doesn't become a reporting agency by storing customers' personal data in its software.
Eightfold's public materials describe something different. Rather than a company that compiles dossiers on individuals to sell to third parties, the company presents itself as an enterprise software platform supporting employers' hiring operations.
Marketing materials aren't sworn evidence, of course; they don't describe how the platform operates for every deployment. Yet, there's enough of a difference to realize that the legal question at play isn't as simple as the complaint suggests. The responsibilities of a consumer reporting agency look dramatically different from the duties of software services developers.
Consumer reporting laws were written long before AI entered the workplace, and legislatures designed them to regulate companies such as credit bureaus, background-check firms and tenant-screening services.
Consumer reporting agencies share a common structure. They collect personal information about individuals and assemble it into reports. They then sell those reports to banks, landlords and employers. The individual might never see the report or control how companies use them. This imbalance creates risks, so the law imposes a regulatory regime governing accuracy, disclosure and the right to dispute errors.
But that's a different service than a software platform designed to be a database storage tool. A company that sells database software doesn't become a reporting agency by storing customers' personal data in its software. The statute focuses on who operates the reporting function, not who builds the tools.
Key questions courts should ask
Instead of getting lost in technical labels, courts evaluating the Eightfold case should ask three practical questions:
Who gathered and analyzed the applicant's information: Was it Eightfold operating independently, or employers using software inside their own hiring system?
Who delivered a report to someone else: Did Eightfold sell a report about an individual to an employer, or did the employer generate its own internal output using a tool?
Who controlled how the system operated, including what data went in, when the system ran, how the results were interpreted and how long they were retained?
Where the lawsuit goes wrong
The lawsuit's flaw is misunderstanding the AI tool. Specifically, AI models differ from human actors: They don't autonomously generate reports about individuals. Instead, they react to prompts like an applicant submitting a resume. Outputs only arise because someone activates the system, not because the software developer decides to assess any given person.
Consumer reporting laws regulate businesses that actively compile and sell reports about people. They don't regulate tools that generate outputs on demand.
Treating that response as the software company "furnishing" a report collapses the distinction between a tool and its operator. It would mean any company that builds an AI tool becomes legally responsible for every output generated when a user or automated workflow activates the system. Yet, the developer didn't choose the subject, initiate the evaluation or control how the employer used the result.
Consumer reporting laws regulate businesses that actively compile and sell reports about people. They don't regulate tools that generate outputs on demand in response to a user's prompt. Extending the laws governing consumer reports to cover AI software vendors would treat tools as regulated actors and redefine the scope of the statute.
If AI hiring tools raise new concerns about fairness, transparency or accountability, courts can address those concerns through flexible common law doctrines where appropriate. Legislatures can also design new regulatory frameworks tailored to modern systems. What courts shouldn't do is stretch old statutes beyond their design limits to fill perceived regulatory gaps.
The Eightfold lawsuit presents a straightforward option. It invites courts to apply familiar legal concepts to newer AI tools. That approach might streamline analysis, but it also carries a risk of added uncertainty.
Software isn't a reporting agency; AI tools aren't decision-makers. Responsibility follows control, not code. Courts should resist the urge to blur those lines and leave regulatory expansion to the legislatures.
Jon Polenberg is a highly regarded business trial lawyer in Florida, known for his relentless advocacy and strategic insight in complex commercial litigation. With decades of experience representing businesses in high-stakes cases, Jon has built a reputation for handling intricate legal disputes with precision and a commitment to excellence. His practice spans a range of industries, assisting companies in resolving matters that affect their operations, reputations and financial interests.
