California employers that use software to screen resumes, score assessments, or rank applicants are now covered by specific FEHA regulations on automated-decision systems, effective October 1, 2025. The rules don’t ban these tools. They make it unlawful to use one “that discriminates against an applicant or employee” on a protected basis, treat a vendor acting for the employer as an agent, and require four years of records. Evidence of bias testing, or its absence, now bears directly on the employer’s defense.
Which hiring tools are automated-decision systems?
More than most employers expect. The Civil Rights Council’s definition in 2 CCR 11008.1(a) covers “A computational process that makes a decision or facilitates human decision making regarding an employment benefit.” The system “may be derived from and/or use artificial intelligence, machine-learning, algorithms, statistics, and/or other data processing techniques.”
That last phrase matters. A tool doesn’t need to be marketed as AI to qualify. A simple scoring rule built into an applicant tracking system, a keyword filter that screens resumes, or a personality quiz that ranks candidates can all be covered, because each facilitates a human decision about hiring.
The regulation’s examples include tools that screen “resumes for particular terms or patterns,” that direct “job advertisements or other recruiting materials to targeted groups,” and that analyze “facial expression, word choice, and/or voice in online interviews.” It also excludes ordinary software, listing “word processing software, spreadsheet software” and similar technologies, but only if they “do not make a decision regarding an employment benefit.”
The CRD announced the approval in a June 30, 2025 release, stating that the new rules “are set to go into effect on October 1, 2025.”
Is the employer liable for a vendor’s tool?
Often, yes. The regulations add a definition of “agent” in 2 CCR 11008(a) that includes “any person acting on behalf of an employer, directly or indirectly, to exercise a function traditionally exercised by the employer.” The definition names “applicant recruitment, applicant screening, hiring, promotion, or decisions regarding pay, benefits, or leave,” including when those activities are “conducted in whole or in part through the use of an automated decision system.”
A staffing platform or screening vendor that rejects applicants for a California employer is doing exactly that kind of work. The employer can’t defend by pointing to the vendor’s algorithm as a black box. If the tool screens out a protected group, the claim runs against the employer, and possibly the vendor too.
That makes the vendor contract a defense document. Employers should know what data the tool uses, whether the vendor has tested it for adverse impact, and whether the contract requires the vendor to share testing results and cooperate in litigation. An indemnity clause helps with cost but doesn’t change the employer’s own liability.
What makes an AI hiring tool unlawful?
Discriminatory effect, even without intent. The core rule is in 2 CCR 11009(f): “It is unlawful for an employer or other covered entity to use an automated-decision system or selection criteria (including a qualification standard, employment test, or proxy) that discriminates against an applicant or employee or a class of applicants or employees on a basis protected by the Act, subject to any available defense.”
The word “proxy” carries much of the risk. The regulations define it as “A characteristic or category closely correlated with a basis protected by the Act.” A model that never sees an applicant’s age can still screen out older workers by weighting graduation year or years of experience. A model that never sees disability can screen out disabled applicants by scoring reaction time.
The defense is the familiar one. Under 2 CCR 11017(e), a facially neutral “testing device, automated-decision system, or other means of selection” that has an adverse impact “is permissible only upon a showing that the selection practice is job-related and consistent with business necessity.” An employer that can’t explain what the tool measures, or why it predicts job performance, will struggle to make that showing.
Accommodation is a separate duty. The regulations warn that a tool measuring “skill, dexterity, reaction time, and/or other abilities” may screen out applicants with disabilities, and that the employer “may need to provide reasonable accommodation to an applicant.” Online application systems should offer a clear way to request an alternative format.
Why does anti-bias testing matter so much?
Because the regulation makes it evidence. Section 11009(f) states: “Relevant to any such claim or available defense is evidence, or the lack of evidence, of anti-bias testing or similar proactive efforts to avoid unlawful discrimination, including the quality, efficacy, recency, and scope of such effort, the results of such testing or other effort, and the response to the results.”
This cuts both ways, and it’s the most practical part of the rules. Testing isn’t required by name, but a plaintiff will argue that an employer with no testing ignored an obvious risk. An employer that tested, found a problem, and adjusted the tool has a strong story. An employer that tested, found a problem, and did nothing has created the plaintiff’s best exhibit.
So testing should be planned with counsel. Running the analysis through a lawyer can preserve privilege over drafts and early findings while the employer decides how to respond. The final record should cover the test itself and the changes it led to.
| Issue | Regulation | Exposure | Defense points |
|---|---|---|---|
| Tool screens out a protected group | 2 CCR 11009(f), 11017(e) | Disparate impact claim, often as a class | Job-relatedness and business necessity, supported by validation |
| Vendor runs the screening | 2 CCR 11008(a) | Employer liable for agent’s conduct | Contract terms on testing, data access, and cooperation |
| No bias testing or ignored results | 2 CCR 11009(f) | Evidence against the employer | Documented testing and a recorded response |
| Tool can’t accommodate disability | 2 CCR 11016(c)(5) | Failure to accommodate | Alternative process offered and used |
| Data deleted too soon | 2 CCR 11013(c) | Spoliation arguments and adverse inferences | Four-year retention of system data |
What records does the employer have to keep?
Four years of them, including the system’s data. As amended, 2 CCR 11013(c) requires employment records to be preserved “for a period of four years from the date of the making of the record or the date of the personnel action involved, whichever occurs later,” and the covered records include “selection criteria, automated-decision system data.” The regulations define that data broadly to include data used to “develop or customize an automated-decision system for use by a particular employer.”
Much of that data sits with the vendor. Employers should confirm in writing that the vendor keeps applicant scores and model versions for at least four years and will produce them on request. A vendor that purges data after 90 days leaves the employer unable to defend its own decisions.
When a claim challenges an automated hiring decision
- Preserve the applicant’s file, the tool’s scores and inputs, the model or configuration version in use, and the vendor’s communications under a litigation hold, and send a written hold to the vendor.
- Calendar the response deadline on the CRD complaint or summons, and check the vendor contract, any arbitration agreement, and the EPLI policy for notice requirements.
- Identify who chose and configured the tool and who reviewed its output, and stop any action toward the applicant or employee that could look like retaliation.
- Pull the vendor contract, any validation or bias-testing reports, and the job-related criteria the tool was meant to measure.
- Talk to counsel before running new testing, responding to the agency, or contacting the applicant.
AI screening claims are new, but they follow FEHA’s familiar disparate impact rules. The firm’s page on defending California employers against discrimination claims describes how those cases are handled.
Automated-decision system questions
Do the rules apply to small employers?
They apply to employers covered by FEHA, which generally means five or more employees. The rules don’t set a separate size threshold for automated tools. A small business using an off-the-shelf applicant tracking system with built-in ranking is covered the same way a large company is, so the vendor questions matter just as much.
Is using AI to screen applicants illegal in California?
No. The regulations treat these tools like any other selection device. They’re lawful unless they discriminate on a protected basis and the employer can’t show the practice is job-related and consistent with business necessity. The practical burden is knowing what the tool does and being able to prove it.
Does a human reviewer protect the employer?
Not by itself. The definition covers tools that facilitate human decision making, so a human approving the tool’s ranking doesn’t take the process outside the rules. Real human review helps on the merits, though, if reviewers look past the score and their reasons are documented.
What about the No Robo Bosses Act?
That’s a separate statute with its own notice and oversight rules. The FEHA regulations discussed here govern discrimination claims and recordkeeping, and they apply now. The firm’s post on the No Robo Bosses Act covers the statute.
If an applicant says your hiring software discriminated
If your company has received a CRD complaint or lawsuit challenging an automated screening decision, the tool’s data and the vendor’s testing records usually decide how much of the claim is real. Rosenberger + Kawabata represents employers defending employment lawsuits and claims through its business litigation practice, including claims involving automated hiring and screening tools. Contact Rosenberger + Kawabata online for a confidential consultation, or call (310) 894-6921.
Sources
The regulations are the Civil Rights Council’s final text of the automated-decision system regulations, amending California Code of Regulations, title 2, sections 11008 through 11017. The effective date is from the CRD’s June 30, 2025 announcement.
This post is general information about California and federal employment law as of November 7, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Employment statutes, regulations, and court decisions change often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.