Pre-Hire Due Diligence Agent

Cross-jurisdictional pre-employment due diligence answers to five parallel statutory regimes. US anti-discrimination law sets the disparate-impact rules through the EEOC’s 2012 guidance. The FCRA governs consent and adverse-action notices. Form I-9 verification exposes the employer to ICE audit. The UK runs criminal checks through DBS under the Rehabilitation of Offenders Act 1974. And the EU adds the GDPR Article 9 and 10 limits alongside the EU AI Act high-risk regime, with fines up to EUR 35M or 7 percent of global turnover. A single pre-hire decision at a large or upper-mid-market employer can trigger all five at once.

Background check between compliance obligation and Title VII trap

This agent follows the Decision Layer principle: each decision is either rule-based, AI-assisted, or explicitly assigned to a human - and the human spots are reserved for the DPIA and the EEO Officer’s final hiring approval.

The hire is signed, the candidate starts - and six months later it turns out that the stated university degree never existed. The reference letter was manipulated. The criminal conviction was never disclosed. The Form I-9 was completed but the documents were never properly reviewed.

Cross-industry surveys show approximately one-third of all applications contain false information. A Resume Builder survey from January 2025 reports 44 percent of respondents admitted to lying during the hiring process - 24 percent directly in the CV. Since generative AI produces letters of reference and certificates in minutes, the rate keeps rising.

The legal side is asymmetric. Under Title VII, criminal-record screening that correlates with protected categories creates disparate-impact exposure unless an individualised assessment is done, as the EEOC’s 2012 guidance requires. FCRA statutory damages of USD 100 to 1,000 per violation, aggregated across the candidate pool, drive eight-figure class-action settlements. The UK Rehabilitation of Offenders Act 1974 protects against discrimination over a spent conviction. And unauthorised processing of special-category or criminal data under GDPR reaches up to 4 percent of global turnover.

EU AI Act high-risk classification, DPIA and FRIA

EU AI Act 2024/1689 Annex III(4)(a) classes AI systems for recruitment or selection as high-risk, and pre-employment due-diligence AI falls within scope because its verification decisions materially influence which candidates reach a final hire. Mobley v. Workday (2023) confirmed the same under US law: algorithmic discrimination in HR software is actionable on disparate-impact grounds across the whole pipeline.

The high-risk classification brings the full Chapter III conformity obligations - risk management, data governance, technical documentation, AI system logging, human oversight, accuracy and cybersecurity - together with a CE marking and a Fundamental Rights Impact Assessment by the deployer before first use. Fines reach EUR 35M or 7 percent of global turnover.

On top of this, GDPR Article 35 makes a DPIA mandatory for high-risk processing involving special-category or criminal data. The CJEU SCHUFA judgment (C-634/21, 2023) confirmed that scoring and profiling outputs which substantially shape a later decision count as automated decision-making, even when a nominal human review takes place.

US FCRA, Ban-the-Box and adverse-action notice

The FCRA Section 604(b)(2) requires a clear, standalone written disclosure before a consumer report is obtained - the document may contain nothing but the disclosure, with no liability waivers attached. Section 604(b)(3) requires the candidate’s written authorisation, and before any adverse action the employer must serve a Pre-Adverse Action Notice with a copy of the report, a Summary of Consumer Rights, and a 5-business-day window to dispute.

The Adverse Action Notice then follows under Section 615(a). Wilful non-compliance carries statutory damages of USD 100 to 1,000 per violation, which aggregate across the candidate pool into class-action exposure; Spokeo v. Robins (2016) confirmed that the procedural harm alone establishes standing.

More than 38 states delay any criminal-record inquiry until after a conditional offer is made. The EEOC’s 2012 arrest-and-conviction guidance sets the Title VII framework: blanket exclusions risk disparate-treatment liability, and disparate-impact liability requires an individualised assessment weighing the nature and gravity of the offence, the time elapsed and its relevance to the job. In California, the ICRAA adds a 7-year lookback and punitive damages of USD 10,000 for wilful non-compliance.

US Form I-9 employment eligibility verification

Form I-9, under Immigration and Nationality Act Section 274A, obliges the employer to verify each new hire’s identity and work authorisation. The candidate self-attests in Section 1 by the first day of employment, and the employer reviews the original documents in Section 2 within three business days, drawing on the List A, B and C categories of acceptable documents.

E-Verify, run jointly by USCIS and the Social Security Administration, confirms authorisation against federal databases. An ICE Form I-9 audit creates significant exposure: civil penalties of USD 281 to 2,789 per paperwork violation, USD 698 to 27,894 per knowing-hire violation, and criminal penalties for a pattern of violations. A Notice of Inspection typically gives only a three-day response window, and Section 274B bars discrimination on citizenship or national origin during the process.

UK DBS checks and ROA spent convictions

The UK runs criminal checks through a three-tier DBS framework: a basic check (with consent, unspent convictions only), a standard check for the regulated workforce (spent and unspent convictions, with cautions), and an enhanced check for roles with children or vulnerable adults (adding barred-list checks under the Safeguarding Vulnerable Groups Act 2006). The Rehabilitation of Offenders Act 1974 protects against discrimination over a spent conviction and limits when one must be disclosed. Under the DBS Filtering Rules, a single conviction is filtered after 11 years where no custodial sentence was imposed. Separately, the Modern Slavery Act 2015 requires supply-chain due diligence above GBP 36M turnover, and a Right to Work Check carries civil penalties up to GBP 20,000 per illegal worker.

Cross-reference to Candidate-Screening, Interview-Scheduling and Contract-Offer-Generation

The agent picks up from the Candidate-Screening Agent’s shortlist, runs after interview scheduling, feeds verified candidates into the Contract-Offer-Generation Agent, and triggers the Audit-Compliance Agent for the bias audit, DPIA and FRIA.

It integrates over API with the major ATS and HCM platforms (Workday, ADP, SAP SuccessFactors, Oracle Cloud HCM, Greenhouse, Lever, iCIMS, BambooHR) and the leading background-screening vendors (Sterling, HireRight, Checkr and others). Consent is sealed with a qualified electronic signature under eIDAS in the EU and ESIGN/UETA in the US.

At a glance

• High-risk under EU AI Act 2024/1689 Annex III(4)(a) with full conformity duties, a deployer FRIA, fines up to EUR 35M or 7 percent of global turnover, and the Mobley v. Workday (2023) precedent
• FCRA Section 604(b) standalone disclosure and authorisation with the Pre-Adverse Action Notice, the 5-business-day window, and statutory damages of USD 100 to 1,000 per violation
• State Ban-the-Box laws applying the EEOC’s 2012 individualised-assessment framework, with a 7-year lookback and USD 10,000 punitive damages in California
• Form I-9 verification with E-Verify, where an ICE audit carries USD 281 to 2,789 per paperwork violation and far more per knowing hire
• UK DBS basic, standard and enhanced checks with ROA 1974 spent-conviction filtering, Modern Slavery Act due diligence, and the Right to Work Check
• GDPR limits on special-category and criminal data under Articles 9 and 10, with a mandatory Article 35 DPIA and the SCHUFA judgment
• ADA Title I medical-inquiry restrictions, barring disability inquiries before a conditional offer
• Decision Layer audit trail retained per the longest applicable rule, from the AI system log lifetime under the EU AI Act to 5 years under the FCRA

Decision-Maker Distribution Pre-Hire-Due-Diligence

The 9 rule-based decisions handle deterministic procedural routing, where a statute citation determines the outcome. The 3 AI-augmented decisions provide indicators - the model output is an indicator, not a final decision. The 2 human escalations are the DPIA and FRIA, required by GDPR Article 35 and EU AI Act Article 27, and the EEOC individualised assessment at final hiring approval.

An escalation is triggered by a missing FCRA disclosure or Pre-Adverse Action Notice, a criminal-record discrepancy needing an individualised assessment, a Form I-9 gap, a spent-conviction discrepancy under the ROA 1974, a visa risk, or a bias indicator. Each one produces signed reasoning from the Talent Acquisition Director, DPO, EEO Officer, Hiring Manager and Compliance Officer, logged to the Decision Records as the basis for a later regulatory audit or class-action defence.