Are your hiring decisions compliant with OFCCP And EEOC

A hiring decision is compliant when three things are true at once: the criteria you screened on are job-related, you applied them the same way to everyone, and you can still produce the records that prove it months later. Most employers get the first two roughly right. The third is where audits are lost.

That gap matters more in 2026 than it did five years ago, because a growing share of the screening is done by software before a human sees a name. The rules did not change to accommodate that. A tool that ranks applicants is a selection procedure, and it carries the same burden of proof a paper test always did.

TL;DR

• The EEOC covers almost every employer with 15 or more employees. The OFCCP covers federal contractors and subcontractors, and adds affirmative action and data-collection duties on top.
• Keep personnel and employment records for at least one year. Federal contractors keep them for two years once they pass 150 employees or a $150,000 contract.
• Record why each candidate was rejected, not just that they were. A missing reason is the single most common audit failure.
• An automated screening tool is a selection procedure. If it rejects one protected group at less than 80% of the rate of the top group, you need to be able to defend it.
• Keeping a named human accountable for the final call, with the AI score kept advisory, is the cheapest defensible design available today.

What makes a hiring decision EEOC compliant?

A hiring decision is EEOC compliant when the standard you used is job-related and consistent with business necessity, you applied it consistently, and you kept the evidence. The EEOC enforces the federal anti-discrimination laws that cover race, color, religion, sex, national origin, age from 40, disability, and genetic information, and it reaches nearly every employer with 15 or more employees.

What trips people up is that intent is not the test. You can run a hiring process nobody involved considers unfair and still create a violation, because the law also looks at outcomes. If a requirement screens out one group at a much higher rate and you cannot show the requirement actually predicts job performance, the outcome is the problem regardless of what anyone meant.

So the practical question is never "was this fair". It is "can this be shown to be fair, from records, eighteen months from now, by someone who was not in the room". Those are very different bars, and only the second one survives an investigation.

How do OFCCP rules differ from EEOC rules?

Both agencies police discrimination in hiring, but they cover different employers and demand different amounts of paperwork. The EEOC is reactive and complaint-driven. The OFCCP is proactive: it schedules audits of federal contractors and asks for the data up front, whether or not anyone has complained.

The row that catches growing companies is the last one. A private employer files the EEO-1 Component 1 report at 100 employees, but a federal contractor files it at 50. Win one government contract and your reporting obligation can start at half the headcount you planned around.

What are the EEOC applicant tracking requirements?

The EEOC requires you to keep all personnel and employment records for one year from the date the record was made or the personnel action was taken, whichever is later. That covers applications and resumes from people you did not hire, interview notes, test results, and the reason each candidate was rejected. If a charge is filed, the clock stops and you keep everything until the case is fully resolved.

Two details in the EEOC recordkeeping rule get missed. Payroll records run to three years, not one, under the age discrimination statute. And for anyone you terminate involuntarily, the one-year clock restarts from the termination date rather than the hire date.

The harder requirement is not retention, it is capture. Keeping a resume is easy. Reconstructing why a hiring manager passed on candidate 41 out of 300, eight months after the fact, from a Slack thread and a memory, is not. The reason has to be recorded when the decision is made, in a field, attached to the candidate.

Pro tip: make the rejection reason a required field that blocks the stage change. Teams that make it optional fill it in about a third of the time, and the third they skip is disproportionately the borderline candidates, which is exactly the population an investigator will ask about.

Who counts as an applicant under OFCCP?

This is the question that decides how big your data problem is, and the answer is narrower than most people assume. Under the OFCCP Internet Applicant rule, someone is an applicant only if all four of these are true: they expressed interest through the internet or related electronic technologies, you considered them for a particular position, their expression of interest showed they meet the basic qualifications for that position, and they did not withdraw at any point before an offer.

All four, not any of them. Somebody who emails a resume speculatively with no open role attached is not an Internet Applicant. Neither is someone who fails the stated basic qualifications, or who stops replying midway through.

That definition is a gift if you use it deliberately, and a trap if you do not. Basic qualifications have to be set in advance, in writing, and be objective and job-related. Set them properly and your applicant pool is defined and defensible. Leave them vague and you inherit every speculative resume that ever arrived, along with the duty to report demographics on all of them.

How long must you keep hiring records?

Retention is a floor, not a target, and the floor moves with your size and your contracts.

The contractor thresholds come from 41 CFR 60-1.12, and the list of what counts as a record is broader than most retention policies assume. It includes job advertisements, applications and resumes, records of internal database searches with the search criteria and the date, tests and test results, interview notes, and requests for reasonable accommodation.

Search criteria and dates are the sleeper item on that list. If a recruiter queries a resume database and contacts the top 20 results, the query itself is part of the record. Most teams have no idea their sourcing tool needs to log that, and most tools will not do it unless someone turns it on.

Does AI screening change your EEOC duties?

It changes none of your duties and most of your exposure. An algorithm that scores, ranks, or filters candidates is a selection procedure under the Uniform Guidelines, exactly like a written test. The same rule applies: a selection rate for any race, sex, or ethnic group that is less than four-fifths, or 80%, of the rate for the highest-scoring group is generally treated by federal enforcement agencies as evidence of adverse impact.

The exposure grows because volume grows. A human reviewer applying a slightly biased standard affects the candidates they personally read. A model applying the same standard affects everyone, consistently, at a scale that makes the statistical pattern obvious in the data. Consistency cuts both ways: it is the reason automated screening is defensible when it is built well, and the reason it is indefensible when it is not.

Some jurisdictions have gone further. New York City's Local Law 144 requires an automated employment decision tool to have had a bias audit within the previous year, requires the audit results to be published, and requires candidates to be notified at least 10 business days before the tool is used on them. Enforcement began in July 2023.

Three design choices do most of the work here, and all three are configuration rather than philosophy. Keep the model's output advisory rather than automatic. Route anything near a cutoff to a named human. And log the score, the threshold, and the human decision together, so the three can be read as one record later.

How to audit your hiring process before the OFCCP does

Run this yourself once a year. It takes a day and it is the closest thing to insurance available.

1. Write down the basic qualifications for every open role before you post it. Objective, job-related, and fixed in advance. This one step defines your applicant pool and decides half the audit.
2. Pull your selection rates by group at each stage, not just the final hire. Adverse impact usually enters at the screening stage and gets diluted by the time you look at offers.
3. Apply the 80% test to each stage. Anything below it is not automatically illegal, but it is a question you now have to be able to answer.
4. Spot-check 20 rejections at random and try to reconstruct why each one happened from the record alone. If you cannot, neither can an investigator, and that is the finding.
5. Confirm your retention windows match the table above, including the sourcing queries and the accommodation requests.
6. Re-validate every scoring tool you use, including the ones a vendor validated for you. Validation is role-specific and it goes stale.

Step 2 is the one that gets skipped, because the data usually lives in three systems that do not talk to each other. That is a tooling problem worth solving before it becomes a legal one. A wider hiring compliance checklist covers the adjacent obligations this page does not.

Common compliance mistakes that cost employers

The failures repeat, and they are rarely exotic.

• Undocumented rejection reasons. The record shows a decision with no basis. Everything else on this list is survivable; this one usually is not.
• Basic qualifications written after the fact. If they were not fixed before the posting went live, they read as a justification rather than a standard.
• Interview questions that drift. Two candidates for one role, asked materially different questions, scored on the same scale. Structured questions and a shared rubric fix this cheaply, and there is a wider case for fair employment testing practices.
• Treating a vendor's validation as your own. A test validated for a different role in a different workforce is evidence about that workforce, not yours.
• Mistaking bias training for a control. Training is worth doing, and it is not a record. Auditors ask for data, so pair it with real work to reduce bias in employment testing.
• Purging records on a generic IT schedule. A 12-month default delete will destroy contractor records that needed 2 years, and it will do it silently.

Build hiring records you can defend

Compliance and hiring quality pull in the same direction here, which is not the usual situation. The records that satisfy an auditor, consistent criteria, scores attached to evidence, and a written reason for every decision, are the same records that tell you whether your hiring is actually working.

That is the idea behind the Testlify Human-Led Decision Scorecard: candidate evidence from assessments, interviews, references, and reviewer ratings is combined into one structured decision, while the final judgment stays with the hiring team. AI assists. Humans decide. The record shows both.

In practice that means AI scores that ship with an in-product reminder that they are for guidance only, a toggle to exclude the AI score from the final average entirely, and a setting that routes a question to a named reviewer for manual review. Candidates can request accommodations through a structured flow that a human administrator reviews. Demographic data is collected anonymously and is not shared with employers. Testlify integrates with the applicant tracking system you already run, across 100 or more integrations, so the system of record stays where it is, and teams without one get a simple built-in pipeline instead.

Testlify also holds SOC 2 Type II and ISO 27001 certification and supports GDPR, CCPA, and NYC Local Law 144 obligations. Explore the test library to see how role-specific assessments are validated, or book a demo to walk through the audit trail with someone who has set one up.

Key takeaways

• Documentation beats intention. Regulators assess records, not motives, so a fair process with no written reasons is indistinguishable from an unfair one. Make the rejection reason a required field that blocks the stage change, and the largest audit risk on this page disappears.
• Your thresholds move when you win a contract. EEO-1 filing starts at 100 employees for a private employer and 50 for a federal contractor, and retention doubles to 2 years past 150 employees or a $150,000 contract. Re-check both the day a government contract is signed, not at year end.
• Basic qualifications are a control, not paperwork. Setting them in advance, in writing, and objectively both narrows who counts as an applicant and supplies the job-relatedness defense. Vague criteria expand the pool and weaken the defense at the same time.
• An algorithm is a selection procedure. The four-fifths rule applies to a model exactly as it applies to a written test, so run the 80% comparison on your own stage-by-stage data before someone else does. Buying the tool does not transfer the liability.
• Human-in-the-loop is a configuration, not a promise. Advisory-only AI scoring, a named reviewer on borderline cases, and one record linking score, threshold, and decision are the three settings that make automated screening defensible.
• Audit annually, at every stage. Adverse impact appears at screening and washes out by the offer stage, so a hire-rate-only review will miss it entirely. One day a year, done properly, is cheaper than one compliance evaluation.

FAQs