Ask the compliance team at most large employers whether they conduct individualised assessments before taking adverse action based on a criminal record. The answer will almost always be yes.
Ask them to pull the documentation from the last five times an offer was withdrawn following a background check that returned a criminal history. The answer will usually be one of three things: a generic form with minimal entries, a note in the ATS that says something like “criminal record — offer rescinded,” or nothing at all.
This is the gap at the centre of fair chance hiring compliance in 2026. The individualised assessment requirement is not new — it has been a feature of EEOC guidance since 2012 and is embedded in the fair chance laws of California, New York City, Washington State, Philadelphia, and multiple other jurisdictions. But its practical execution remains, in most organisations, inconsistent at best and entirely absent at worst.
That inconsistency is now expensive.
What an Individualised Assessment Actually Is
The term comes from the EEOC’s 2012 guidance on the use of arrest and conviction records in employment, which established that employers should not use criminal records as automatic disqualifiers and should instead conduct an individualised assessment of whether the specific conviction has a direct and adverse relationship to the duties of the specific role.
The assessment requires consideration of at least three things: the nature and gravity of the offence; the time elapsed since the offence or completion of the sentence; and the nature of the job sought, including its duties and the circumstances of the role.
Many fair chance hiring laws codify and expand on this framework. California specifies that employers must also consider evidence of rehabilitation and good conduct. New York City, under its Fair Chance Act, requires that the assessment consider eight specific factors drawn from state law, including the employer’s legitimate interest in protecting public safety, the bearing of the conviction on the person’s fitness or ability to perform the duties of the job, and any additional information produced by the applicant regarding their rehabilitation. Philadelphia’s amended ordinance requires consideration of the bearing the conviction has on fitness for the specific position and gives candidates the right to submit evidence of rehabilitation, work experience, education, and training before a decision is finalised.
The common thread: a criminal record alone is not sufficient grounds for an adverse employment decision in any of these jurisdictions. The employer must be able to articulate a specific, documented reason why the particular conviction disqualifies the particular candidate from the particular role.
Why Blanket Disqualification Policies Are Now Illegal
For decades, many employers maintained blanket disqualification policies: any felony conviction within seven years, automatic disqualification. Any conviction involving violence or theft, regardless of age, automatic disqualification. The appeal of these policies is obvious — they are simple, consistent, and easy to apply. Hiring managers don’t need to exercise judgement. The decision is made by policy.
In a growing number of jurisdictions, these policies are now illegal.
California’s employer compliance guidelines, updated to reflect the Civil Rights Council’s AI and algorithmic decision-making regulations, explicitly prohibit the use of automatic screening criteria that categorically screen out candidates based on conviction history without an individualised assessment. New York City’s Fair Chance Act prohibits per se disqualification based on criminal history. Washington State’s expanded Act, effective July 2026, makes clear that the individualised assessment requirement applies regardless of the nature of the offence.
The practical implication is that an employer in any of these jurisdictions who has maintained a blanket disqualification policy — whether enforced by a hiring manager’s manual review or, as is increasingly common, by an ATS configured to automatically flag and remove candidates based on background check results — is potentially in violation of the applicable law every time that policy is applied.
The automation dimension is worth emphasis. Many organisations use applicant tracking systems that can be configured to automatically advance or stall candidates based on background check outcomes. If those systems are configured to automatically screen out candidates whose checks return any conviction within a specified period — without any human review, without any assessment of the nature of the offence or the requirements of the role — they are implementing a blanket disqualification policy at scale. In jurisdictions requiring individualised assessments, that configuration is a compliance liability.
The Adverse Action Procedure: The Sequence Most Employers Get Wrong
Assuming an employer has conducted a genuine individualised assessment and determined that a specific conviction does create a job-related disqualifying concern, the adverse action procedure is what determines whether that decision is legally defensible.
Under the FCRA, adverse action based on a consumer report — which includes background check results — requires a two-step notice process. First, a pre-adverse action notice must be provided to the candidate before the decision is finalised, along with a copy of the background check report and a copy of their FCRA rights. The candidate must be given a reasonable period to review and respond. Then, if the employer proceeds, a final adverse action notice must be provided.
Many fair chance hiring laws impose additional requirements on top of the FCRA framework — and the interaction between FCRA timing and fair chance law timing creates compliance complexity that employers frequently mishandle.
Philadelphia’s amended ordinance requires the employer to identify the specific conviction under consideration in the first notice and hold the position open for at least two business days. If the employer is simultaneously following FCRA pre-adverse action procedures, the holding period extends to five business days. During that period, the candidate may submit evidence of rehabilitation, the inaccuracy of the record, or any other relevant information.
Washington State’s revised Act similarly requires a first notice that specifies the conviction and a holding period, with the candidate’s right to respond before a final decision.
New York City’s Fair Chance Act requires the employer to complete the full individualised assessment before issuing the first notice — meaning the assessment must happen before, not after, the candidate is informed that adverse action is being considered.
The sequencing requirement matters. An employer who issues a notice and simultaneously makes the final decision has not provided a genuine opportunity to respond. An employer who makes the final decision before providing any notice at all has failed the most basic procedural requirement. Both are violations.
Building the Process: What a Defensible System Looks Like
The organisations that manage this well share a common characteristic: they have reduced as much of the individualised assessment to a documented, structured process as possible, while preserving genuine human judgement at the decision point.
Here is what that looks like in practice.
A written criminal history policy. The starting point is having a written policy that specifies: at what point in the hiring process criminal history checks are ordered; which positions, if any, have specific regulatory disqualification requirements (financial services roles with FDIC requirements, roles working with children or vulnerable adults, and so on); and the framework by which the employer will evaluate criminal history when it appears. The policy should be reviewed against the laws of every jurisdiction in which the employer hires and updated when those laws change.
A structured assessment form. For every instance where a background check returns criminal history, a designated reviewer should complete a structured assessment form that documents: the specific conviction or convictions returned; the nature of the offence; the time since the offence and completion of any sentence; the specific duties of the role the candidate is being considered for; any direct relationship between the offence and the job duties; any mitigating factors in the candidate’s history, including evidence of rehabilitation, subsequent employment history, references, or other relevant information; and the specific conclusion reached and the reasoning for it.
The form does not need to be elaborate. It needs to be specific. A generic “criminal record — not suitable for this role” entry is not a documented individualised assessment. It is a conclusion without reasoning, and it will not withstand scrutiny in litigation or enforcement proceedings.
A clear escalation path. The hiring manager who first sees a background check result is usually not the right person to conduct the individualised assessment. That person has a candidate they like, a role they need to fill, and limited patience for compliance process. The assessment should be handled by HR, with legal involved for any cases where the conviction is serious, recent, or where the job-relatedness determination is not straightforward.
First notice and waiting period, tracked. Once the assessment determines that adverse action is being considered, the first notice must go out — with the required content, in the required form, with the start of the waiting period tracked. The candidate’s response, if any, must be reviewed and considered before the final decision is made. Both the notice and the response should be retained in the candidate’s file.
Final decision documented against the assessment. The final adverse action decision should be linked to the individualised assessment form, with documentation of whether the candidate responded during the waiting period and how that response was considered. The final adverse action notice should follow.
This sequence, followed consistently and documented completely, is what a legally defensible adverse action process looks like. It takes time. For most organisations, it takes considerably more time than the current process of “check came back with something, offer withdrawn.” But it is the process the law requires, and the organisations that have built it into their workflows have done so because the alternative — facing a class action alleging systematic non-compliance with fair chance procedures — is considerably more expensive.
The Documentation Standard
A recurring theme in fair chance hiring litigation and enforcement is documentation. Or rather, its absence.
When an employer is challenged on an adverse employment decision based on criminal history — whether by a government agency, in litigation, or in a regulatory complaint — the employer’s defence rests almost entirely on their ability to produce contemporaneous documentation showing that a genuine individualised assessment was conducted, that the required notices were provided in the required sequence, that the candidate was given a meaningful opportunity to respond, and that the final decision was based on a specific, articulable job-related concern rather than a generalised aversion to criminal records.
Without that documentation, the employer is in a very difficult position. The absence of a documented assessment creates an inference that no assessment was conducted. The absence of a notice with a tracked date creates a dispute about whether proper procedure was followed. The absence of any record of the candidate’s response and its consideration suggests the waiting period was procedural theatre rather than a genuine opportunity.
California’s Civil Rights Council regulations now require employers to maintain records of automated decision-making data for four years. New York City’s Local Law 144 requires records of bias audits and automated employment decisions. Even in jurisdictions without specific recordkeeping mandates, the FCRA’s requirements for retaining consumer report information and adverse action documentation create an obligation to maintain hiring records for specified periods.
The practical standard: retain everything related to a background check that returned criminal history — the check itself, the individualised assessment form, the first notice, any response from the candidate, the final decision documentation, and the final adverse action notice. Retain it for at least four years. For positions in California, make it part of a documented compliance programme that can be produced on request.
Training: The Compliance Investment That Actually Works
The most sophisticated policy and the most carefully designed process are only as effective as the people executing them. In practice, fair chance hiring compliance fails most frequently at the point where a hiring manager or recruiter encounters a background check result and has to decide what to do next.
The training gap is usually not knowledge of the law. It is the practical skills: how to read a background check report correctly, how to identify what is and is not within the permissible lookback period for the applicable jurisdiction, how to use the individualised assessment form rather than defaulting to a quick judgement, when to escalate to HR or legal, and how to handle the candidate conversation professionally.
Managers also need to understand what they cannot do. They cannot instruct a candidate to disclose their record before a conditional offer has been made. They cannot make comments or ask questions that signal an intent to use criminal history as a disqualifying factor before the permitted stage in the process. They cannot apply their own judgement about what kind of convictions should disqualify a candidate without following the formal process. All of these behaviours — which occur regularly in informal hiring conversations — create exposure under fair chance hiring laws.
Training should be role-specific, updated annually as the law evolves, and documented. The organisations that handle this well treat fair chance hiring compliance the same way they treat harassment prevention training — a recurring, mandatory programme with attendance records, not a one-time briefing from three years ago.
The Bigger Picture: Fair Chance Hiring as Risk Management
There is a case for fair chance hiring that has nothing to do with compliance obligation: it is good risk management and good talent acquisition strategy.
Research consistently finds that employees hired through fair chance programmes, where criminal history is evaluated in context rather than used as an automatic screen, show retention rates and performance outcomes comparable to broader employee populations. The talent pool excluded by blanket disqualification policies is substantial — approximately one in three American adults has some form of arrest or conviction record. Policies that exclude that population without individualised assessment are not just legally risky; they are operationally limiting.
The organisations that build genuinely effective fair chance hiring processes tend to find that the compliance investment pays dividends beyond litigation avoidance. The discipline of documenting individualised assessments, training managers on consistent decision-making, and building auditable hiring workflows makes their processes more defensible across every dimension of employment law — not just the criminal history piece.
The law in this space is going to keep moving. The July 2026 Washington State expansion will not be the last significant development. The trajectory is toward more jurisdictions, more demanding requirements, and more robust enforcement. The organisations that are building genuinely compliant processes now are the ones that will navigate that trajectory without crisis.
AMS Inform provides background verification and workforce screening services across 160+ countries. For organisations looking to build compliant, jurisdiction-aware background screening frameworks, speak to our team at AMSinform.com.
