California's AI Hiring Rules: What Employers Need to Know in 2026
8 min read · Last reviewed 1 Aug 2026
General information, not legal advice. Laws in this area change; verify against the official sources at the end of this guide and confirm specifics with employment counsel.
California regulates AI hiring through two separate rulebooks written by two different agencies, and conflating them is the most common mistake employers make. The first, and the one that matters for most small businesses, is the Civil Rights Department's FEHA regulations on automated-decision systems, in effect since October 1, 2025, which apply to employers with five or more employees. The second is the privacy agency's CCPA rules on automated decision-making technology, which mostly bind larger companies and phase in through 2027.
Neither rulebook bans AI screening. What California does instead is make discrimination through an automated system explicitly unlawful, stretch liability to your vendors and agents, extend recordkeeping to four years, and make your bias testing (or your failure to test) admissible evidence. Here is the practical picture for a small employer. General information, not legal advice.
Two rulebooks, two agencies: which one applies to you
Rulebook one: the Civil Rights Council's amendments to the Fair Employment and Housing Act (FEHA) regulations, effective October 1, 2025. FEHA covers employers with five or more employees, wherever the employer is based, when they employ or screen Californians. If that is you, these rules apply now.
Rulebook two: the California Privacy Protection Agency's regulations on automated decision-making technology (ADMT) under the CCPA. These only apply to businesses that meet CCPA thresholds (roughly: over $25 million in annual revenue, or data on 100,000+ consumers, or half of revenue from selling data). Most 5-to-50-person companies are simply not covered. If you are, the ADMT rules add pre-use notices and access rights around significant decisions like hiring, with compliance dates phasing in (the main ADMT obligations land by January 1, 2027).
The rest of this guide focuses on the FEHA rules, because they are the ones with a five-employee threshold and they took effect first.
What the FEHA ADS regulations cover
An automated-decision system (ADS) is defined broadly: a computational process that makes a decision or facilitates human decision making regarding an employment benefit, including processes derived from machine learning, statistics, or other data-processing or AI techniques. The regulations call out familiar examples: tools that screen resumes, rank or prioritize applicants, target job ads, analyze interview recordings, or score assessments and games.
The core rule is simple: it is unlawful to use an ADS (or selection criteria inside one) that discriminates against applicants or employees on a protected basis, under either intentional-discrimination or disparate-impact theories. This is not a new liability so much as an explicit confirmation that FEHA's existing discrimination rules reach algorithmic tools, with definitions that remove the "it was the software" defense.
Two extensions have teeth. The regulations make clear that an employer's "agents" (which can include a vendor operating a screening tool on your behalf) fall within the rules, so outsourcing the screening does not outsource the liability, and the vendor itself can face exposure. And the definitions cover third-party data and tools, so a tool you licensed rather than built is still your problem.
Bias testing becomes evidence, in both directions
A distinctive feature of the California rules: evidence of anti-bias testing (or the lack of it) is relevant to claims and defenses. If a candidate alleges your screening tool had a disparate impact, the fact that you tested the tool for adverse impact, and acted on the results, weighs in your favor. The fact that you never looked weighs against you.
This quietly changes the economics of testing. Before, checking your funnel for adverse impact was a best practice; now, in California, it is closer to self-insurance. The standard test is the same four-fifths selection-rate comparison the EEOC's Uniform Guidelines describe: compute each group's selection rate, divide by the highest group's rate, and treat ratios under 0.80 as a flag worth investigating.
You do not need a consultant to run the first pass. SiftFirst's free bias audit self-check runs the four-fifths math in your browser: you take the audit-ready score export, add the demographic columns from your own voluntarily collected records, and paste it in; nothing is uploaded or stored. It is a self-check, not an official audit, but it is exactly the kind of testing the regulations make relevant, and it costs you fifteen minutes.
The four-year recordkeeping duty
The regulations extend FEHA's recordkeeping requirement to four years and explicitly include ADS-related records: the applications, the selection criteria, the automated-decision data your tools generate, and the results. If a tool scored 200 applicants for a role, those scores, and the criteria behind them, need to survive for four years from the record's creation or the personnel action, whichever is later.
For employers using black-box tools, this is awkward: you cannot retain what your vendor never showed you. Practically, prefer tools that let you export per-candidate scores, the criteria used, and the outcome, and get that export into your own storage as part of closing out each hire. A saved screening in SiftFirst preserves the rubric, every candidate's per-criterion scores with quoted evidence, and the shortlist outcome in one place, which is precisely the record the regulation contemplates.
Four years is longer than the federal baseline, so if you standardize on one retention period across jurisdictions, standardize on four.
A practical path for a California SMB
For a company with 5 to 50 employees hiring in California, the sequence looks like this. (1) Inventory your tools: anything that screens, ranks, targets, or scores candidates is an ADS. (2) Make the criteria job-related and human-set, and be able to say what each tool assesses; vague matching scores are hard to defend under a disparate-impact lens. (3) Test: run a four-fifths self-check on real funnel data a few times a year and after any change of tool or criteria, and keep the results with notes on what you did about them. (4) Retain: export and keep four years of applications, criteria, scores, and outcomes. (5) Ask your vendor pointed questions: what does the tool assess, has it been tested for adverse impact, can you export the records, does anything auto-reject.
Human review still matters, but treat it as documentation, not a shield: California's rules and the Mobley v. Workday litigation both make clear that a human rubber stamp on a biased ranking does not immunize anyone. What protects you is a process where criteria are explicit, scores carry evidence, a human genuinely decides, and the records prove it. If you also hire in NYC, Illinois, or Colorado, those laws stack on top; the 2-minute compliance check maps which apply to you.
Key takeaways
- ✓California has two AI-hiring rulebooks: FEHA ADS regulations (effective October 1, 2025, employers with 5+ employees) and CCPA ADMT rules (large businesses only, phasing in to 2027).
- ✓Discrimination through an automated-decision system is explicitly unlawful, and liability extends to agents and vendors operating tools on your behalf.
- ✓Evidence of anti-bias testing, or your failure to test, is admissible: periodic four-fifths self-checks are now effectively self-insurance in California.
- ✓ADS-related records (criteria, scores, results, applications) must be kept four years, so use tools that let you export per-candidate scoring data.
- ✓Human review documents a defensible process but does not immunize a biased tool; explicit criteria and evidence-backed scores are the real protection.
Screening built for these rules
SiftFirst scores candidates against criteria you set, quotes the resume line behind every score, never auto-rejects, and exports the records these laws expect. The candidate notice generator and bias audit self-check are free.
FAQ
I have 8 employees. Which California rules apply to me?
The FEHA ADS regulations apply: FEHA covers employers with five or more employees. The CCPA ADMT rules almost certainly do not, unless you exceed $25 million in revenue or process data on 100,000+ consumers. So your duties are: do not use a discriminatory ADS, keep four years of records, and treat bias testing as your evidence base.
Is a resume screening tool an automated-decision system under these rules?
If it scores, ranks, filters, or otherwise facilitates the decision about who advances, yes. The regulations name resume screening and applicant ranking among their examples. A tool that only stores and organizes applications without evaluating them is not making or facilitating a decision.
If a human reviews every AI recommendation, am I exempt?
No. The rules cover systems that facilitate human decision making, not only ones that decide autonomously, and the Mobley v. Workday litigation shows courts are unwilling to treat token human review as a liability cutoff. Genuine human judgment on evidence, documented, is valuable as part of a defensible process; it is not an exemption.