California's AI hiring regulations: what the FEHA rules require

Since October 1, 2025, California's Fair Employment and Housing Act regulations have expressly covered automated-decision systems in hiring. The Civil Rights Council's final text does not ban AI or algorithmic screening tools. It defines what counts as an automated-decision system, makes discriminatory use of one unlawful in the same way a discriminatory human decision is, treats anti-bias testing as evidence in a discrimination claim, and extends the personnel-records retention period to four years for data the system produces or uses.

What changed on October 1, 2025

The Civil Rights Council amended Title 2 of the California Code of Regulations, Chapter 5 (Fair Employment and Housing Council), Subchapter 2 (Discrimination in Employment). The final text is published on calcivilrights.ca.gov. The changes that matter for a recruiting or interviewing tool:

What counts as an automated-decision system

Section 11008.1(a) defines an automated-decision system as "a computational process that makes a decision or facilitates human decision making regarding an employment benefit," which may be derived from or use artificial intelligence, machine learning, algorithms, statistics or other data processing techniques. The regulation lists example tasks:

• Computer-based assessments or tests, including games or puzzles, that make predictive assessments or measure skills, dexterity, reaction time, personality traits, aptitude, attitude or cultural fit.
• Screening or evaluating, categorizing or recommending applicants or employees.
• Directing job advertisements or recruiting materials to targeted groups.
• Screening resumes for particular terms or patterns.
• Analyzing facial expression, word choice or voice in online interviews.
• Analyzing employee or applicant data acquired from third parties.

It excludes word processing, spreadsheet, web hosting, storage, firewall, spellcheck, calculator, database and similar technology, provided the tool does not itself make a decision about an employment benefit. Where that leaves a plain interview transcription and note-taking tool is not spelled out in the text. A tool that only produces a transcript, without scoring, ranking or recommending, sits closer to the excluded list than to the covered examples above; a tool that also scores or flags candidates moves toward the covered side. We found no Civil Rights Council guidance resolving borderline tools as of September 2026, so confirm with counsel what your specific stack does with the output, not just what it is called.

Who is covered

FEHA's employer threshold, unchanged by this rulemaking, is five or more employees, counted under section 11008(e) as regularly employing five or more for any part of the day on which the conduct occurred, or on a regular seasonal basis; part-time employees count the same as full-time. Two features of the amended text widen who else can be pulled in:

• Agents. Section 11008(a) defines an agent as anyone acting on behalf of an employer to exercise recruitment, screening, hiring or similar functions, "including when such activities and decisions are conducted in whole or in part through the use of an automated decision system." An agent of an employer is also an "employer" under the Act, which reaches a vendor or third-party recruiter operating the tool on the employer's behalf.
• Employment agencies. Section 11008(g) now expressly includes a person undertaking the procurement of job applicants, employees or work opportunities "through the use of an automated-decision system."

The discrimination standard, and where anti-bias testing fits

Section 11009(f) is the operative prohibition: "It is unlawful for an employer or other covered entity to use an automated-decision system or selection criteria (including a qualification standard, employment test, or proxy) that discriminates against an applicant or employee or a class of applicants or employees on a basis protected by the Act, subject to any available defense." The regulation does not create a new discrimination standard on top of FEHA; it applies FEHA's existing disparate-treatment and adverse-impact framework to decisions an automated-decision system makes or shapes.

The same subsection then makes a specific evidentiary point: evidence, or the lack of evidence, "of anti-bias testing or similar proactive efforts to avoid unlawful discrimination, including the quality, efficacy, recency, and scope of such effort, the results of such testing or other effort, and the response to the results" is relevant to a claim or an employer's defense. The regulation does not require anti-bias testing. It makes having done it, and having acted on what it found, evidence that helps an employer; not having done it is evidence that can be used against one.

The regulation also defines a "proxy" as "a characteristic or category closely correlated with a basis protected by the Act" (§ 11008(l)), which reaches selection criteria such as zip code, a graduation-date range, or a gap in work history where those stand in for a protected characteristic in practice.

Recordkeeping: four years, and it now names automated-decision-system data

Section 11013(c) requires an employer or other covered entity to preserve personnel and employment records for four years from the date the record was made or the date of the personnel action, whichever is later, up from two years under the prior text. The amendment adds "automated-decision system data" to the list of records this covers, alongside applications, personnel records, selection criteria and referral records. Section 11008.1(d) defines that data as anything used in or resulting from applying the system, including data about individual applicants or employees and data reflecting employment decisions, plus data used to develop or customize the system for a particular employer.

In practice: if a complaint is filed, section 11013(c)(6) also requires preserving records "relevant to the complaint," which the text says includes automated-decision-system data for the complaining party and for other candidates for the same position at the same location, until the complaint and any related proceedings are fully and finally resolved.

Where this sits next to other California and federal rules

• The California Privacy Protection Agency. The CPPA has a separate rulemaking on automated decisionmaking technology under the California Consumer Privacy Act, aimed at privacy notice and opt-out rights rather than at FEHA's discrimination standard. It is a different regulator, a different statute and a different trigger; treat it as a separate compliance project, not a substitute for the Civil Rights Council rules covered here.
• Title VII. A tool used in California is still subject to federal disparate-impact law. See Title VII disparate impact and AI hiring tools for the four-fifths rule and what changed at the EEOC in 2025 and 2026.
• Other states. If you hire outside California too, see AI hiring laws by state for the map, and Colorado's AI law for employers and NYC Local Law 144's bias audit rules for two regimes built differently from California's.

A vendor and process checklist

• List every tool touching recruitment, screening, interviewing or promotion for California employees or applicants, and what each one does with its output (score, rank, recommend, or transcript only).
• Ask each vendor in writing whether the tool has been tested for adverse impact, when, on what population, and what the results were.
• Keep the vendor's anti-bias testing documentation somewhere you can produce it for four years, matched to the version of the tool you were using.
• Review selection criteria the tool applies (keywords, score cutoffs, "culture fit" proxies) for anything that could correlate with a protected characteristic, such as graduation year or zip code.
• Confirm who at your organization, or at an agency acting as your agent, controls the tool's configuration, since that person's or firm's conduct can be imputed to the employer.
• Set a four-year retention clock on automated-decision-system data tied to each employment decision, and a litigation hold process that extends it when a complaint is filed.
• Re-run this checklist when a vendor changes its model or scoring logic, since "recency" of testing is itself a factor the regulation calls out.

Common mistakes