California AI Employment Regulations: What Employers Must Do Under the New CCRC Rules

California’s Civil Rights Council finalized employment regulations targeting AI-driven discrimination that took effect on October 1, 2025. These are not aspirational guidelines or advisory guidance. They are binding regulations with teeth — regulations that expand employer liability, create affirmative compliance obligations, and impose a four-year record retention requirement on every business with five or more California employees that uses any automated or algorithmic tool in employment decision-making.

If your business uses AI-assisted hiring tools, resume screening software, predictive analytics for performance management, or any algorithm to sort or rank job applicants or employees, you are in scope. This post explains exactly what the regulations require and what you must do to comply.

Background: What the California Civil Rights Council Is and Why This Matters

The California Civil Rights Council (CCRC) is the rule-making body under the Civil Rights Department (formerly DFEH), and it operates under the California Fair Employment and Housing Act (FEHA) — the state’s primary employment anti-discrimination statute. FEHA’s prohibitions against employment discrimination are broad and well-enforced. The CCRC has the authority to issue regulations that clarify and extend FEHA’s requirements.

On June 27, 2025, the CCRC approved final regulations specifically addressing the use of automated decision systems in employment. The regulations were announced publicly on June 30, 2025, and took effect October 1, 2025. Their practical effect is to formally integrate algorithmic non-discrimination into the FEHA framework — meaning AI-driven employment discrimination is now subject to the same enforcement mechanisms, private rights of action, and administrative remedies that apply to traditional discriminatory employment practices.

This matters because FEHA is one of the most expansive employment discrimination statutes in the country. It covers more protected classes, has broader administrative enforcement, and allows for compensatory damages, punitive damages, and attorney’s fees in private civil litigation. Wrapping AI employment discrimination into that framework creates substantial exposure.

Who Is Covered

The regulations apply to employers with five or more employees in California. That threshold is lower than federal anti-discrimination law, and it means that small and medium-sized businesses — not just large enterprises — are in scope.

The definition extends to agents acting on behalf of covered employers. Agents are defined as any person acting on behalf of an employer to exercise a function traditionally exercised by the employer or any other FEHA-regulated activity. This explicitly covers third-party HR technology vendors, recruiting platforms, staffing agencies, and others who use automated decision tools on an employer’s behalf. If a vendor uses AI to screen resumes for you, or if a staffing agency uses algorithmic tools to evaluate candidates before presenting them to you, their use of those tools may be attributed to you as the employer.

What Is an Automated Decision System?

The CCRC regulations define an Automated Decision System (ADS) broadly: a computational process that makes a decision or facilitates human decision making regarding an employment benefit. An ADS may be derived from and/or use artificial intelligence, machine learning, algorithms, statistics, or other data processing techniques.

The breadth of this definition is intentional and significant. The regulations do not limit coverage to “AI” in the sense of large language models or neural networks. Any computational process that makes or facilitates employment decisions is potentially covered, including:

• Resume screening software that filters candidates by keyword or scoring algorithm
• Video interview analysis tools that score candidate responses using behavioral analytics
• Skills assessment platforms that rank candidates by automated test scoring
• Applicant tracking systems with built-in candidate ranking or sorting features
• Performance management software that generates automated performance scores
• Scheduling and shift assignment algorithms
• Compensation benchmarking tools that automatically generate salary recommendations
• Workforce analytics platforms that flag employees for review based on behavioral patterns

The critical test is not the sophistication of the technology — it is whether a computational process is making or facilitating an employment decision. If the answer is yes, the regulations apply.

The Core Legal Standard: Disparate Impact Under FEHA

The central anti-discrimination requirement in the CCRC regulations is the prohibition on ADS that results in discrimination against applicants or employees based on a protected class under FEHA. The list of protected classes under FEHA is extensive: race, color, national origin, ancestry, sex, gender, gender identity, gender expression, sexual orientation, religion, age (40 and over), physical disability, mental disability, medical condition, genetic information, marital status, military and veteran status, reproductive health decision making, and several others.

The critical legal mechanism is disparate impact liability. An employer may be liable under these regulations even if it did not intend to discriminate — liability attaches where the use of the ADS results in a disparate impact on a protected class.

Disparate impact doctrine has existed in employment law since the Supreme Court’s decision in Griggs v. Duke Power Co. in 1971. The innovation of the CCRC regulations is applying that doctrine formally and explicitly to algorithmic and AI-driven employment practices. The doctrinal framework is familiar, but the application to AI-specific tools is new and consequential.

What this means in practice: if your resume screening tool rejects Black applicants at twice the rate it rejects white applicants, that is potential disparate impact discrimination — even if you never intended to discriminate, even if the algorithm never explicitly considered race, and even if you were simply using a vendor’s off-the-shelf tool.

The regulations also cover disparate treatment — intentional discrimination — but the disparate impact provision is where most employers face the greatest practical risk, because it can arise from AI tools that appear facially neutral.

Anti-Bias Testing: The Affirmative Defense and Its Flip Side

One of the most practically important provisions of the CCRC regulations is the anti-bias testing framework. The regulations establish that anti-bias testing or similar proactive efforts to avoid unlawful discrimination can be used in defense of discrimination claims.

This creates an affirmative defense structure: if you have conducted documented anti-bias testing of your ADS — testing that is timely, repeatable, and transparent — that testing is evidence that supports your defense in a disparate impact claim.

The flip side, which the regulations make equally explicit, is that the absence of anti-bias testing can be used as evidence against an employer in a discrimination claim. Courts and administrative agencies are explicitly instructed to consider the lack of testing as a negative factor.

This is a significant shift from prior practice. Before these regulations, an employer could argue that its use of a vendor’s algorithm constituted good-faith reliance on an established tool. After October 1, 2025, the absence of bias testing is itself a liability indicator.

What Adequate Anti-Bias Testing Requires

The regulations make clear that a single validation at launch is not sufficient. Testing must be ongoing — bias audits must be integrated as regular and systemized maintenance practices, not one-time exercises performed when the tool is first deployed.

Testing must be timely — conducted at meaningful intervals, not just once at deployment. Testing must be repeatable — using documented methodologies that can be reproduced and reviewed. Testing must be transparent — documented in a manner that allows review by regulators, litigants, and auditors.

Adequate testing methodology should include:

• Comparison of selection rates across protected class categories (race, sex, age, disability, and others relevant to the use case)
• Analysis of whether differences in selection rates rise to the level of adverse impact using recognized statistical measures (for example, the “four-fifths rule” or statistical significance testing)
• Testing across the full pipeline, not just at the final selection stage, since bias can accumulate through multiple algorithmic steps
• Intersectional analysis (e.g., Black women as a distinct category, not just Black applicants and women separately)
• Review of the training data on which any AI component was trained, for historical bias

Who conducts the testing matters. Independent audits conducted by qualified third parties carry more evidentiary weight than self-assessments. For employers using third-party AI vendors, the contract with the vendor should require the vendor to provide bias audit data and methodology, facilitate independent testing, and notify the employer of any known bias issues identified in internal testing.

Risk Assessments: The Affirmative Due Diligence Obligation

The CCRC regulations require employers to conduct a risk assessment before deploying an ADS in employment contexts where the use presents a significant risk. The risk assessment must contain specified content — it is not a check-the-box exercise.

A proper risk assessment should evaluate:

The nature of the employment decision. Higher-stakes decisions — hiring, promotion, termination, disciplinary action — warrant more rigorous assessment than lower-stakes decisions. The assessment should document what decision the ADS is facilitating and what the consequences of that decision are for the affected individuals.

The population affected. What protected class characteristics are present in the applicant or employee population being processed by the ADS? What historical patterns of employment outcomes exist for those groups?

The vendor’s representation of the system. What has the vendor represented about how the system works, how it was trained, and whether bias testing has been conducted? What documentation exists?

The available alternatives. Are there alternative selection processes that would achieve the employer’s legitimate business objective with less disparate impact risk?

Known limitations. What are the known performance limitations of the tool, including any limitations related to demographic performance disparities?

Document the risk assessment. The documentation is subject to the four-year retention requirement, and in any subsequent litigation or regulatory investigation, it will be the evidence of your pre-deployment due diligence.

The Four-Year Record Retention Requirement

The CCRC regulations require employers to preserve ADS-related records for four years. The records that must be preserved include:

• Selection criteria used in or by the ADS
• Relevant outputs from the ADS (including individual scores, rankings, or selection decisions)
• Anti-bias audit findings
• Risk assessment documentation
• Records of modifications to the ADS and the dates of those modifications

This four-year retention requirement has immediate practical implications that many employers have not yet addressed.

For employers using third-party AI tools: Do your current vendor agreements require the vendor to provide you with the output data and audit data you need to satisfy this retention obligation? Many AI tool vendors do not automatically provide detailed output logs to customers — the data exists in the vendor’s systems, but the customer may not have access or contractual rights to it. Fix this in your vendor agreements now.

For employers retaining applicant data: Retaining AI output data for four years means you are retaining information about job applicants for four years. Under California’s Privacy Rights Act and other state privacy laws, you have obligations with respect to data you retain about individuals, including the right to delete. Reconcile the CCRC four-year retention obligation with your privacy law data minimization and deletion obligations — these can be in tension, and you need a documented position on how you will manage both.

For audit readiness: If the California Civil Rights Department or a plaintiff’s attorney asks for records related to your ADS use in an employment context, you will need to produce them promptly. Records that are disorganized, incomplete, or inaccessible are nearly as bad as records that do not exist — and worse in some ways, because they suggest negligence rather than absence of use. Implement a records management program for ADS documentation now.

Scope of Covered Employment Decisions

The regulations apply broadly across the employment lifecycle. Employment decisions subject to the ADS anti-discrimination requirements include:

Recruiting. AI tools used to identify or attract candidates — including automated job posting targeting, social media sourcing algorithms, or tools that search databases to identify passive candidates — are covered when they function to include or exclude individuals from consideration.

Hiring and selection. This is where most employers’ AI exposure is most visible: resume screening, automated application scoring, AI-assisted interview evaluation, skills assessments with algorithmic scoring.

Promotion and advancement. Performance management AI, leadership potential assessment tools, and succession planning algorithms that rank employees for promotion consideration.

Compensation. Automated compensation benchmarking tools that generate salary recommendations based on algorithmic analysis.

Discipline and termination. Productivity monitoring tools that feed into disciplinary processes, or tools that flag employees for performance improvement plans based on behavioral data.

Leave and benefits administration. Tools that apply algorithms to determine eligibility for leave, accommodations, or benefits.

What “Agent” Liability Means for Your Vendor Relationships

The extension of the regulations to agents of employers — including third-party vendors — is one of the most consequential aspects of the regulatory framework. If a vendor you hire uses an ADS on your behalf and that ADS produces discriminatory outcomes, you as the employer bear FEHA liability.

This creates an obligation to due-diligence your AI vendors’ compliance posture, not just their technology. When procuring AI employment tools, you should:

Request bias audit documentation. Ask the vendor for the results of any bias audits conducted on the tool, including the methodology, the demographic categories tested, and the outcomes. A vendor that cannot or will not produce this documentation is a vendor you should not be using for high-stakes employment decisions.

Include compliance representations in your contract. The vendor should represent that the tool does not have known disparate impact on any FEHA-protected class and that any bias testing conducted revealed no unresolved adverse impact. This representation should be ongoing, with notification obligations if subsequent testing reveals problems.

Require notification of material changes. If the vendor updates the algorithm, retrains the model, or makes any change that could affect performance across demographic groups, the contract should require advance notification and an opportunity for you to conduct updated testing before the change is deployed in your use.

Include indemnification. If discriminatory outcomes result from the vendor’s AI tool’s design or training — rather than from your configuration or use — the vendor should bear the primary indemnification obligation for the resulting claims.

Steps Employers Need to Take Now

If these regulations apply to you — employers with five or more California employees using any automated or algorithmic process for employment decisions — the compliance timeline is not in the future. These regulations became effective October 1, 2025. You are in a compliance period right now.

Step 1: Inventory your ADS. Identify every tool that qualifies as an ADS under the CCRC regulations. Cast the net wide — include resume screening software, applicant tracking system ranking features, video interview analysis, performance management scoring, and any other algorithmic tool touching employment decisions.

Step 2: Assess your testing status. For each identified ADS, determine whether bias testing has been conducted, when it was conducted, whether the methodology meets the “timely, repeatable, and transparent” standard, and what the results showed.

Step 3: Conduct or procure current bias audits. If your tools have not been tested, or have not been tested recently, obtain current bias audits. For complex AI systems, engage a qualified third-party auditor.

Step 4: Document risk assessments. For each ADS with a significant deployment, document a risk assessment meeting the regulatory standard.

Step 5: Implement record retention. Establish the records management program needed to preserve required documentation for four years, including output data you need to obtain from vendors.

Step 6: Update vendor contracts. Ensure your AI employment tool vendor contracts include the compliance representations, audit obligations, notification requirements, and indemnification provisions described above.

Step 7: Train HR and decision-makers. The regulations affect how AI-assisted employment decisions are made and documented. HR personnel and managers who use these tools need to understand the compliance framework.

The Broader Context: California as a Bellwether

California has consistently been ahead of other states in employment law — and what becomes law in California frequently becomes the national standard over the following decade. The CCRC regulations represent the first fully-implemented state-level regulatory framework for AI employment discrimination. Illinois, New York, and Colorado are watching carefully. Federal regulators at the EEOC have issued guidance on AI-driven employment discrimination that tracks the same disparate impact framework.

If you are building compliance programs for multi-state employers, California’s CCRC rules are a reasonable baseline for your enterprise-wide AI employment governance, even in states where no equivalent rule has yet been enacted.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.