California's AI employment rules: the Civil Rights Council regulations and the CPPA automated decision rules

California regulates AI and other automated tools at work through two separate sets of rules. The Civil Rights Council's regulations apply the Fair Employment and Housing Act (FEHA), the state's anti-discrimination law, to automated-decision systems. The California Privacy Protection Agency's (CPPA) regulations on automated decisionmaking technology (ADMT) add notice, opt-out and access rights under the state's privacy law. This page explains both for workers and employers.

The short answer: since 1 October 2025, the FEHA regulations make clear that using an automated-decision system that discriminates on a protected basis is unlawful unless a defense applies, and that the data behind such tools must be kept for four years (Civil Rights Department, 30 June 2025; 2 CCR 11009, 11013). Under the CPPA regulations, a business that uses ADMT to make a significant decision about a person, including hiring, work allocation, pay, promotion, demotion, suspension or termination, must comply with the ADMT rules by 1 January 2027 (11 CCR 7200).

Part 1: the Civil Rights Council's FEHA regulations

The Civil Rights Department says the regulations took effect on 1 October 2025 and clarify how existing anti-discrimination law applies to artificial intelligence, algorithms and other automated-decision systems in employment (CRD announcement). They do not create a separate AI statute. They add automated-decision systems to the existing FEHA employment rules in Title 2 of the California Code of Regulations.

• Automated-decision system: "a computational process that makes a decision or facilitates human decision making regarding an employment benefit". It may use AI, machine learning, algorithms, statistics or other data processing techniques. The listed examples include online tests, puzzles and games that assess applicants or employees, targeting job ads, screening resumes for terms or patterns, analyzing facial expression, word choice or voice in online interviews, and analyzing applicant or employee data from third parties (2 CCR 11008.1(a)). Word processing, spreadsheets, spellchecking, data storage, anti-virus and similar tools are excluded, as long as they do not make a decision about an employment benefit.
• Agents count as employers: a person acting on an employer's behalf in recruitment, screening, hiring, promotion, or decisions about pay, benefits or leave, including through an automated-decision system, is an agent, and an agent of an employer is also an "employer" under the Act. An employment agency includes a business that procures applicants or work opportunities through an automated-decision system (2 CCR 11008).
• Discrimination through a tool: it is unlawful to use an automated-decision system or selection criteria that discriminate against an applicant or employee on a protected basis, subject to any available defense (2 CCR 11009(f)). A facially neutral tool with an adverse impact is permissible only if it is job-related and consistent with business necessity (2 CCR 11017(e)).
• Anti-bias testing as evidence: relevant to a claim or defense is evidence, or the lack of evidence, of anti-bias testing or similar efforts to avoid discrimination, including the quality, efficacy, recency and scope of the effort, its results and the response to those results (2 CCR 11009(f)). The regulations do not make a bias audit mandatory, but whether one was done, and what was done with it, can matter.
• Accommodation: a tool that measures skill, dexterity or reaction time, or analyzes tone of voice, facial expressions or other physical characteristics, may discriminate, and an employer may need to provide a reasonable accommodation (2 CCR 11016(c)(5), (d)(1)). Using an automated-decision system without additional process does not count as an individualized assessment (2 CCR 11072).
• Disability questions: asking questions likely to reveal a disability through an automated-decision system before a job offer is unlawful, and a medical or psychological examination includes a test, question, puzzle, game or other challenge in such a system that is likely to elicit information about a disability (2 CCR 11070(b), 11071(e)).
• Age: a facially neutral practice, including an automated-decision system, that has an adverse impact on applicants or employees aged 40 or over is presumed discriminatory unless it is job-related and consistent with business necessity, and a tool that screens out older applicants is discriminatory unless age is a bona fide occupational qualification (2 CCR 11076, 11079).
• Criminal history: the bar on asking about criminal history before a conditional offer covers inquiries through an automated-decision system (2 CCR 11017.1(a)).
• Records: employment records, now including selection criteria and automated-decision system data, must be kept for four years from the date of the record or the personnel action, whichever is later (2 CCR 11013(c)). Automated-decision system data includes data used in or resulting from the tool and data used to develop or customize it for a particular employer (2 CCR 11008.1(d)).
• Aiding and abetting: the existing aiding and abetting prohibitions include conduct carried out in whole or in part through an automated-decision system (2 CCR 11020(b)).

FEHA employment rules apply to employers that regularly employ five or more people, and to the state and local public entities regardless of size (2 CCR 11008).

Part 2: the CPPA's ADMT regulations

The CPPA's regulations on automated decisionmaking technology, risk assessments and cybersecurity audits were approved by the Office of Administrative Law on 22 September 2025 and took effect on 1 January 2026 (CPPA rulemaking page). They apply to businesses covered by the California Consumer Privacy Act (CCPA), and the regulations' own examples cover employees and job applicants (11 CCR 7220(e)).

• ADMT: any technology that processes personal information and uses computation to replace, or substantially replace, human decisionmaking. It substantially replaces human decisionmaking when its output is used to decide without human involvement. Human involvement means a reviewer who knows how to interpret and use the output, reviews it with any other relevant information, and has authority to make or change the decision (11 CCR 7001(e)). A tool that only assists a person who does all three is outside this definition.
• Significant decisions at work: hiring; allocation or assignment of work, and salary, hourly or per-assignment pay, bonuses or other benefits; promotion; and demotion, suspension and termination. Advertising to a person is not a significant decision (11 CCR 7001(ddd)).
• Deadline: a business already using ADMT for significant decisions before 1 January 2027 must comply by that date; any later use must comply from the start (11 CCR 7200(b)).
• Pre-use Notice: before processing, a prominent notice giving the specific purpose (not a generic one), the right to opt out and to access, a statement that the business may not retaliate, and a plain language explanation of how the ADMT works, what output it produces and how that output is used, and what the alternative process is for people who opt out (11 CCR 7220). An employer may combine notices, for example one notice covering resume screening software and interview analysis software for job applicants. Trade secrets need not be disclosed.
• Opt-out, and its exceptions: people must be able to opt out of ADMT for a significant decision (11 CCR 7221(a)). No opt-out is needed if the business offers an appeal to a human reviewer with authority to overturn the decision. Hiring decisions are also exempt if the tool is used solely to assess ability to perform at work and works for that purpose without unlawful discrimination, and allocation of work and pay decisions are exempt on similar terms (11 CCR 7221(b)). If a business relies on an exception, the notice must say which one or explain the appeal.
• How opt-out works: at least two methods, one matching how the business mainly deals with the person; no account creation; a cookie banner does not count. After an opt-out, processing must stop within 15 business days, and the business must wait at least 12 months before asking the person to consent again (11 CCR 7221(c)-(n)).
• Access: on request, a plain language explanation of the purpose, the logic of the ADMT, how it processed the person's information, the outcome, and how the output was used in the decision, including any other factors (11 CCR 7222). Where a tool was used more than four times in 12 months, the business may give an aggregate response.
• Risk assessments: using ADMT for a significant decision, and using automated processing to infer a job applicant's or employee's ability, performance at work, behavior and similar traits from systematic observation, both require a risk assessment before processing starts (11 CCR 7150(b)). Existing processing must be assessed by 31 December 2027, and assessments from 2026 and 2027 are submitted to the CPPA by 1 April 2028 (11 CCR 7155, 7157).

What this means in practice

• Employers: list every tool that screens, scores, ranks or assigns work. Check it for adverse impact, keep the results and what you did about them, and keep automated-decision system data for four years. Plan accommodation routes for tests and video interviews. For any tool that decides without real human review, prepare the Pre-use Notice, an opt-out or human appeal route, access responses and a risk assessment for January 2027.
• Vendors: a vendor acting for an employer can be an agent and so an employer under the FEHA regulations, and a vendor that is a CCPA service provider or contractor must help its business customer answer access requests under the CPPA regulations (11 CCR 7222(i)).
• Workers and job seekers: from 2027, look for a Pre-use Notice, ask what the tool did with your information, and use the opt-out or appeal it describes. If a tool screened you out on a protected basis, the FEHA rules apply now.

For other US rules, see Colorado's automated decision law, the Texas AI law, Illinois AI hiring laws, NYC Local Law 144, US employee monitoring laws and AI in hiring.

This page covers California and is general information based on the Civil Rights Council's final text and the CPPA's approved regulations text as published when checked on 3 November 2026, not legal advice.