California employers using AI to screen resumes, rank candidates, or score video interviews now answer to two separate rulebooks with two different deadlines. The Civil Rights Council’s automated decision system (ADS) regulations took effect October 1, 2025 and apply to every employer with five or more employees. They establish that an algorithm does not shield an employer from liability: if a tool produces a discriminatory outcome, the employer answers for it, including when a vendor or staffing agency operates the tool. Those regulations also require four years of retention for all ADS data. The California Privacy Protection Agency’s automated decisionmaking technology (ADMT) regulations carry a January 1, 2027 deadline but reach only businesses meeting a CCPA threshold, including annual gross revenue above $26,625,000. Most small businesses fall outside the privacy rules while remaining fully subject to the civil rights rules. Every California employer should start with a written inventory of each tool that touches a hiring, promotion, discipline, or termination decision.
What Counts as an Automated Decision System
The Civil Rights Council defines an ADS as a computational process that makes a decision or facilitates human decision making regarding an employment benefit. The definition is deliberately broad, covering artificial intelligence, machine learning, algorithms, statistics, and other data processing techniques. Critically, the tool does not need to make the final call. Facilitating a human decision is enough. Regulators point to specific examples:
- Screening resumes for particular terms or patterns
- Directing job advertisements or recruiting materials to targeted groups
- Analyzing facial expressions, word choice, or voice during online interviews
- Using computer-based tests, puzzles, or games to measure skill, dexterity, or reaction time
- Analyzing applicant or employee data acquired from third parties
Note how ordinary that list is. An applicant tracking system with keyword filters qualifies, so employers who assume these rules reach only sophisticated AI models are usually mistaken.
Action Item 1: Comply With the Civil Rights Rules Already in Force
These regulations are not pending. They have applied since October 1, 2025, sitting alongside the wage and classification duties in our California HR compliance checklist.
Inventory Every Tool That Touches an Employment Decision
List every system involved in recruitment, screening, interviewing, testing, promotion, compensation, discipline, or termination. For each, record the vendor, the data it ingests, the output it produces, who reviews that output, and whether a human can override it. This inventory is the first document a regulator will request.
Test for Disparate Impact and Keep the Results
The regulations do not mandate a bias audit. They do something more consequential: they make your testing history relevant evidence. What you tested, what it showed, and how you responded can strengthen or undermine your defense, and declining to test is itself a fact a plaintiff can use. Both intentional discrimination and unintentional disparate impact are covered.
Confirm Your Tools Make No Prohibited Pre-Offer Inquiries
FEHA generally bars considering criminal history and conducting medical or psychological examinations before a conditional offer. Both prohibitions now expressly extend to inquiries made through an ADS. A background check that fires automatically at application can violate these rules without anyone intending it.
Retain Four Years of Automated Decision System Data
Employers must keep all ADS data affecting any employment benefit of an applicant or employee for a minimum of four years, covering inputs, outputs, and scoring data rather than final decisions alone. Many vendors purge candidate data sooner by default, so confirm retention terms in writing.
Hold Vendors and Staffing Agencies to the Same Standard
Liability extends to an employer’s agent, meaning anyone acting on the employer’s behalf. Recruiting platforms, staffing agencies, and assessment vendors can be pulled into the same analysis, and their conduct creates exposure for your business. Amend contracts to require bias-testing documentation, retention compliance, and indemnification, and treat these vendors as part of your broader third-party risk management program rather than an HR-only concern.
Action Item 2: Determine Whether the 2027 Privacy Rules Reach You
This question separates most small employers from most mid-market ones, and it deserves a documented answer rather than an assumption.
Test Your Business Against the Three CCPA Thresholds
The privacy regulations apply to a for-profit business operating in California that meets at least one of the following:
- Annual gross revenue above $26,625,000, measured globally rather than on California revenue alone
- Buying, selling, or sharing the personal information of 100,000 or more California consumers or households in a year
- Deriving 50% or more of annual revenue from selling or sharing personal information
The revenue figure adjusts for inflation in odd-numbered years, with the next adjustment due January 2027 (the CPPA publishes the current threshold). Many small employers meet none of the three, and that conclusion is worth documenting.
Prepare Pre-Use Notices, Opt-Outs, and Access Rights
Covered employers using ADMT for a significant employment decision must give a plain-language pre-use notice, offer at least two ways to opt out, and honor requests to explain how the technology was used. In hiring, pre-use means before the applicant submits an application or enters an AI-assessed screening step, not after a decision is reached.
Document a Risk Assessment Before Deployment
A risk assessment is required before initiating processing that presents significant privacy risk, which includes using ADMT for a significant decision. Processing already underway before January 1, 2026 must be documented no later than December 31, 2027, then updated every three years and within 45 days of any material change. The documentation discipline here mirrors what we outline in our guide to cybersecurity compliance advisory for mid-market organizations: repeatable evidence beats a one-time exercise.
Action Item 3: Track the Legislation Still Moving
California’s statutory framework remains unsettled, and the bill now in play would reshape how automated tools may be used in discipline and termination.
Why SB 7 Failed and What SB 947 Changes
Governor Newsom vetoed SB 7, the original No Robo Bosses Act, on October 13, 2025, calling its notice requirements unfocused and pointing to the privacy regulations as the better vehicle. Senator Jerry McNerney reintroduced a revised version, SB 947, on February 2, 2026, substituting post-use notice for advance notice and narrowing the prohibited uses. The Senate approved it 29 to 9 on May 19, 2026, and it now sits in the Assembly.
Keep a Human in the Loop Either Way
If enacted, SB 947 would bar sole reliance on an automated system for discipline, termination, or deactivation, require human oversight and corroborating evidence, prohibit predictive behavioral analysis of worker data, and carry a $500 civil penalty per violation plus a private right of action. Employers who already require documented human review of every adverse automated recommendation will need little adjustment either way. That is the design choice worth making now, and it belongs in the same IT governance framework that sets policies and controls for every other system in your environment.
Frequently Asked Questions About AI Hiring Compliance in California
Does my applicant tracking system count as an automated decision system?
Very likely yes, if it screens, filters, or ranks applicants using keywords, patterns, or scores. The definition reaches tools that facilitate a human decision, not only tools that decide on their own.
Do these rules apply to a business with only ten employees?
The civil rights regulations apply at five or more employees with at least one in California, so yes. The privacy regulations apply only if the business meets a CCPA threshold, which a ten-person company usually will not.
Are we liable if a vendor’s tool discriminates?
Yes, potentially. Liability extends to agents acting on an employer’s behalf, including vendors, recruiting platforms, and staffing agencies performing employment functions for you.
Is a bias audit legally required in California?
No regulation currently mandates one for private employers. Your testing record is relevant and consequential in a discrimination claim, which makes documented testing a practical necessity rather than an optional exercise.
How Windes Helps California Employers Using AI in Hiring
Two overlapping frameworks, a four-year retention duty, vendor liability, and a bill still moving through the Legislature add up to a problem most California businesses are not staffed to solve alone. The Windes Human Capital Consulting team provides the tailored HR expertise this moment requires, acting as a flexible extension of your operations without the overhead of a full-time department.
- Inventory the automated tools already in use across your hiring, performance, and termination processes
- Determine which frameworks apply to your business, and document the threshold analysis behind that conclusion
- Build the four-year retention schedules and documented human-review protocols that hold up under scrutiny
- Update your employee handbook to reflect current requirements
- Amend vendor and staffing agency contracts to require bias-testing documentation and indemnification
Because these tools sit inside your technology stack, the questions rarely stop at HR. Our IT governance and cybersecurity compliance teams address the vendor management, data retention, and access control questions that surface alongside them.
Do you know which of your systems qualifies as an automated decision system? Contact the Windes Human Capital Team and replace compliance uncertainty with a documented position.
