California AI hiring regulations: the Civil Rights Council and CPPA rules explained

Two state agencies now regulate AI in California hiring. One applies anti-discrimination law, the other privacy law. Here is what each covers and when.

The short answer

California AI hiring regulations come from two state agencies, and they work differently. The California Civil Rights Council's rules on automated-decision systems, in effect since October 1, 2025, apply the state's Fair Employment and Housing Act to AI. They make it clear that an AI tool that discriminates is unlawful, that evidence of anti-bias testing matters, that a vendor acting for you can be treated as an employer, and that automated-decision data must be kept for four years. The California Privacy Protection Agency's (CPPA) rules on automated decisionmaking technology (ADMT), in effect since January 1, 2026, add privacy duties: a pre-use notice, an opt-out or human appeal, and an access right when a covered business uses ADMT to make hiring decisions. Businesses already using ADMT for those decisions have until January 1, 2027 to comply.

This is not legal advice. We built this summary from the regulation text and announcements published by the Civil Rights Department and the CPPA, linked at the end. Your counsel should confirm how they apply to you.

California AI hiring regulations at a glance

Question	Civil Rights Council ADS regulations	CPPA ADMT regulations
Legal basis	Fair Employment and Housing Act (anti-discrimination)	California Consumer Privacy Act (privacy)
Key dates	Approved by the Office of Administrative Law June 27, 2025; effective October 1, 2025	Adopted by the CPPA Board July 24, 2025; approved September 22, 2025; effective January 1, 2026; ADMT compliance by January 1, 2027 for existing uses
What it regulates	Use of an automated-decision system that discriminates on a protected basis	Use of ADMT that replaces or substantially replaces human decisionmaking for significant decisions, including hiring
Main duties	Don't discriminate; anti-bias testing is relevant evidence; accommodations; keep records four years	Pre-use notice; opt-out or human appeal; access to information; risk assessments
Who it covers	Employers and other covered entities, including agents acting for them	Businesses subject to the CCPA

Civil Rights Council rules on automated-decision systems

The Council's rules add a new section, 11008.1, to the state's employment regulations and amend several others. They don't create a separate AI statute. They explain how existing anti-discrimination law applies when software makes or shapes employment decisions.

What counts as an automated-decision system

An automated-decision system is a computational process that makes a decision or facilitates human decision making about an employment benefit. It may use AI, machine learning, algorithms, statistics or other data processing. The regulation lists the kinds of tasks these systems perform, including:

computer-based assessments or tests, such as questions, puzzles or games, that make predictive assessments, measure skills or reaction time, measure personality or "cultural fit," or screen, evaluate, categorize or recommend applicants;
directing job ads to targeted groups;
screening resumes for particular terms or patterns;
analyzing facial expression, word choice or voice in online interviews; and
analyzing applicant or employee data acquired from third parties.

Ordinary tools such as word processors, spreadsheets, web hosting, firewalls and calculators are excluded, as long as they don't make a decision about an employment benefit. An AI interview that scores or recommends candidates sits squarely inside the definition.

What the rules require in practice

No discriminatory tools. It is unlawful to use an automated-decision system or selection criteria that discriminates against an applicant or employee on a basis protected by the Act, subject to available defenses.
Anti-bias testing counts. Evidence of anti-bias testing or similar proactive efforts, or the lack of it, is relevant to a claim or defense. The rules say the quality, efficacy, recency and scope of the effort, its results and your response to the results all matter.
Your vendor can be your agent. An "agent" includes anyone acting on an employer's behalf to perform functions such as recruitment, screening or hiring, including through an automated-decision system. An agent of an employer is also an "employer" under the Act.
Four-year records. Employment records, now expressly including automated-decision system data and selection criteria, must be kept for four years.
Accommodations. The rules warn that a system measuring skill, dexterity or reaction time, or one analyzing tone of voice or facial expressions in interviews, may discriminate based on disability or other protected traits. You may need to provide a reasonable accommodation.
Medical inquiries. According to the Civil Rights Department's announcement, assessments that elicit information about a disability, including tests, questions or puzzle games, may count as an unlawful medical inquiry.

CPPA rules on automated decisionmaking technology (ADMT)

The CPPA package also updated other CCPA rules and added cybersecurity audits and risk assessments. Two parts matter most for hiring teams: the ADMT article and the risk assessment article.

When the ADMT rules apply

ADMT means technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. "Substantially replace" means you use the output to make a decision without human involvement. Human involvement requires a reviewer who knows how to interpret the output, reviews it along with other relevant information, and has authority to make or change the decision. A significant decision includes hiring, allocation of work and compensation, promotion, and demotion, suspension or termination.

That definition matters. If a trained recruiter reviews each AI interview result alongside the resume and other evidence and can overrule it, the CPPA's ADMT article may not reach that use. If candidates below a score cutoff are rejected automatically, it likely does. The Civil Rights Council's rules, by contrast, apply whether or not a human is involved.

What covered businesses must do

Pre-use notice. Explain, in plain language and before you collect the information you'll process with ADMT, the specific purpose for using it, the right to opt out (or to appeal, where that exception applies) and the right to access information. A generic phrase like "to make a significant decision" is not enough.
Opt-out, with exceptions. Offer at least two ways to opt out, one matching how you mainly interact with the consumer. You don't have to offer an opt-out if you provide an appeal to a qualified human reviewer with authority to overturn the decision. For hiring, there is a further exception when the ADMT is used solely to assess the person's ability to perform at work, and it works for that purpose and does not unlawfully discriminate.
Access. On request, give a plain-language explanation of the specific purpose, the logic of the ADMT, and how its output was used in the decision about the person, including whether it was the sole factor.
Risk assessment. Using ADMT for a significant decision is listed as processing that presents significant risk, which requires a risk assessment before you start. So is using automated processing to infer a job applicant's ability, aptitude or performance at work based on systematic observation. For processing that started before the rules took effect and continues, the risk assessment is due by December 31, 2027.

CPPA compliance dates

A business that used ADMT for a significant decision before January 1, 2027 must comply with the ADMT article by January 1, 2027. A business that starts on or after that date must comply from the first use. Risk assessments must be reviewed at least every three years, updated within 45 days of a material change, and kept for as long as the processing continues or five years after completion, whichever is later.

A practical checklist for California employers

List every tool that scores, ranks, filters or analyzes candidates, including AI interviews and resume screening.
For each tool, note whether a trained person reviews the output and can change the decision. Write down how.
Ask each vendor for its most recent bias testing, the date, who ran it, and what changed after the results. The Civil Rights Council's rules make all of that relevant.
Add an accommodation request path to every AI step, and train recruiters to use it.
Set a four-year retention rule for automated-decision data, and confirm your vendor can export it.
Draft the CPPA pre-use notice and choose your route: opt-out, human appeal, or the hiring exception.
Schedule risk assessments for existing AI hiring uses before the December 31, 2027 deadline.

Bias testing is the common thread. Our guide to AI bias audits explains how independent audits work, and our NYC Local Law 144 guide covers the one U.S. law that requires a published audit. NTRVSTA has published its own NYC Local Law 144 bias audit, by the independent auditor Asenion and finalized October 20, 2026, on our compliance page. That audit addresses New York City's law. It is not a claim of compliance with California's rules, which depend on how each employer uses a tool. For other states, see our guides to the Colorado AI Act, the Illinois AI Video Interview Act and the EU AI Act.

Questions

Are California's AI hiring regulations in effect now?

The Civil Rights Council's automated-decision system regulations took effect October 1, 2025. The CPPA's regulations took effect January 1, 2026, but a business already using ADMT for significant decisions before January 1, 2027 has until that date to comply with the ADMT article.

Does an AI interview count as an automated-decision system in California?

It can. The Civil Rights Council's definition covers computational processes that make or facilitate human decisions about an employment benefit, and its examples include computer-based tests and questions and analyzing facial expression, word choice or voice in online interviews.

Do candidates have a right to opt out of AI in hiring?

Under the CPPA rules, businesses using ADMT for significant decisions generally must offer an opt-out. There are exceptions, including a human appeal process, and a hiring exception when the ADMT is used solely to assess ability to perform at work and works for that purpose without unlawful discrimination.

How long must we keep AI hiring records in California?

The Civil Rights Council's rules require employers and other covered entities to keep employment records, including automated-decision system data, for four years. The CPPA rules separately require risk assessments to be kept while the processing continues or for five years after completion, whichever is later.

If you're reviewing your AI hiring tools for California, it helps to see one up close. Book a 20-minute demo, or try a sample AI interview from the candidate's seat.

Sources

NTRVSTA