Institutions

FCRA exposure and evidence

Institutional counsel carries liability when AI-assisted signals contribute to admit/decline outcomes. The map below ties each applicable FCRA section to the runtime receipt that supports it.

FCRA controls 8 6 verified · 2 partial
Retention 7 yr § 1681c window · append-only
Last verified 02:18 UTC § 1681m(a) chain · today
Verifier offline-capable Ed25519 · no vendor dependency

FCRA control map

Mapping of Fair Credit Reporting Act sections that apply to AI-assisted employment decisions. Residency match is an employment decision under § 1681b(a)(3)(B). 6 of 8 controls verified; 2 partial (runtime ready, per-program ATS/QMS integration is per-tenant rollout).

SectionControlStatusMaps to featureLast verified
§ 1681m(a)Adverse-action notificationVerifiedCortex ScreeningTue, 12 May 2026 03:18:42 UTC
§ 1681iDispute right and reinvestigationPartialCortex ScreeningMon, 11 May 2026 19:44:08 UTC
§ 1681e(b)Reasonable procedures for accuracyVerifiedCareer Interest BadgeTue, 12 May 2026 02:01:11 UTC
§ 1681g(a)Disclosure to consumer on requestVerifiedCortex ScreeningTue, 12 May 2026 00:55:09 UTC
§ 1681kPublic-record information for employment purposesVerifiedGrade NormalizationMon, 11 May 2026 22:19:47 UTC
§ 1681s-2Furnisher duties (ATS webhook ingest)PartialCortex ScreeningMon, 11 May 2026 16:28:12 UTC
§ 1681b(a)(3)(B)Employment-purpose permissible useVerifiedCortex ScreeningMon, 11 May 2026 20:41:35 UTC
§ 1681qObtaining information under false pretensesVerifiedCortex ScreeningMon, 11 May 2026 15:09:22 UTC
Adverse-action evidence chain — applicant 2026-04812

Representative end-to-end chain showing AI-assisted review documented from AI check through to a § 1681m(a) adverse-action notice. Each step below is a signed record counsel can verify.

  1. 01
    AI checks

    Three AI features run against the applicant submission

    Academic Career Interest Badge, Enhanced Grade Normalization, and Cortex Application Screening each produced a signed record with evidence-span hash and prompt version.

    signed r_4f2b9c1e signed r_a83f1c92 signed r_d12e8a07
  2. 02
    Fairness flag

    Daily test flags name-correlated sensitivity

    The daily test set finds the rural-medicine text-analysis prompt sensitive to a name cue. Applicant 2026-04812 eligible for re-analysis.

    partial prb-2026-04-30-417
  3. 03
    FCRA § 1681i

    Applicant opens dispute

    Disclosure request and dispute filed. Tracked case disp-2026-04812-A opens a reinvestigation receipt chain.

    signed r_disp_a01e72
  4. 04
    Reinvestigation

    Reinvestigation resolves; signal unchanged

    Re-extraction completes under corrected configuration. Underlying output remains Moderate; disposition published as a signed reinvestigation receipt.

    signed r_reinv_b48f12
  5. 05
    Held for review

    Missing-evidence flag caught before reaching reviewer

    On a methodology version bump, the system detected a text analysis citing an evidence span that did not exist in the personal statement. Output held at the system boundary.

    quarantined q-2026-04812
  6. 06
    FCRA § 1681m(a)

    Adverse-action notice (projected pathway)

    Should the program decline to interview based in part on AI-assisted signals, the notice links every contributing AI-check record — including the held event — and the dispute pathway. The notice is itself a signed record linkable in court.

Discovery readiness
01

Record retention

Signed AI-check records retained for the monitoring period plus seven years, matching FCRA's adverse-information window under § 1681c. Append-only; records cannot be modified after publication.

02

Evidence-chain integrity

Every per-check record is included in a per-period Merkle tree (RFC 6962). Tree root is signed and published at period close. Counsel can reconstruct any subset and verify inclusion without depending on Thalamus or Glacis.

03

Signed timestamps

Each record carries a wall-time-ns field signed alongside the verification hash. Per-period STH timestamps are independently signed (Ed25519) and verifiable against the embedded public key.