If your compliance calendar has exactly one entry for AI hiring risk, and it reads January 1, 2027, you are tracking the wrong regulator. On October 1, 2025, California's Civil Rights Council turned a different, older law into a live automated-decision-system rule for any employer with five or more people. It didn't wait for the CPPA's better-known ADMT deadline, and it already treats the absence of bias testing as evidence against you in a discrimination claim.
Two regulators, two clocks, same word
California now runs two separate rulebooks that both use the phrase "automated decision." The California Privacy Protection Agency's ADMT regulations under the CCPA get most of the press: notice, opt-out, access and appeal rights tied to a rulemaking record the agency filed with the Secretary of State on September 22, 2025. Our own ADMT engineering guide walks through building for that side of it.
The Civil Rights Council runs a second, older law: the Fair Employment and Housing Act. Its final text, Regulations Regarding Automated-Decision Systems, amends California Code of Regulations Title 2, sections 11008 through 11017.1. The Council approved it June 27, 2025, and it took effect October 1, 2025, more than a year before the CPPA date most compliance calendars already have circled. A project plan with a 2027 line and nothing for 2025 is missing a year of exposure that already started.
What actually counts as an automated-decision system
Section 11008.1 defines an automated-decision system as "a computational process that makes a decision or facilitates human decision making regarding an employment benefit," and it doesn't require AI or machine learning to qualify: the definition also covers plain algorithms, statistics, or "other data processing techniques." The regulation names the jobs an ADS actually does: scoring or ranking applicants, measuring skill or reaction time through a game or puzzle, reading tone of voice or facial expression in a recorded interview, screening resumes for particular terms, or targeting job ads at specific groups.
It also lists what doesn't count, and the carve-out is worth reading closely: word processing, spreadsheet software, database tools, spam filters, spell-checkers and similar utilities are excluded, "provided that these technologies do not make a decision regarding an employment benefit." That clause is the whole test. A spreadsheet an HR coordinator sorts by hand is a spreadsheet. The same spreadsheet with a formula that auto-ranks applicants and hides the bottom half from the recruiter has crossed into the decision this rule is written to catch. If your only screening step is a plain keyword search with a person reading every result, you're very likely outside this definition as drafted, and building a bias-testing file for it would be effort spent on the wrong problem.
The evidence problem in section 11009(f)
Section 11009(f) should worry a GC more than the notice-and-consent mechanics everyone else is building for. It states that using an ADS or selection criteria that discriminates against an applicant or a class of applicants is unlawful, subject to any available defense, then names what counts as evidence either way: "evidence, or the lack of evidence, of anti-bias testing or similar proactive efforts to avoid unlawful discrimination, including the quality, efficacy, recency, and scope of such effort, the results of such testing or other effort, and the response to the results."
Read that against how most vendor-bought hiring tools get adopted: procurement checks the vendor's SOC 2, security signs off, and nobody asks for the vendor's own adverse-impact study, let alone runs one independently after the tool goes live. Vendor contracts rarely allocate that obligation clearly between the parties either, which is exactly what our piece on AI vendor contract requirements covers from the CCPA side. Under section 11009(f), that absence isn't neutral. It's evidence a plaintiff's counsel can point to directly. The fix isn't legal language in a contract, it's an actual test result on file, run on a cadence someone can defend, with a record of what the company did when the results came back mixed.
Your retention policy, and three places this already reaches into a hiring stack
Section 11013 also changed the number document-retention policies are usually built around. The prior rule required two years; the amended text requires four, and for the first time names automated-decision system data as its own record category alongside applications, personnel files and selection criteria. The clock runs from whichever is later: the date the record was made, or the date of the personnel action it relates to. Most retention schedules a mid-market California employer has on file were last touched by whoever wrote the HR handbook, not by whoever bought this year's applicant-tracking add-on. A schedule that still says two years isn't just outdated, it's a documented policy that contradicts a current regulation, which is a worse position than having no written policy at all.
Three specific provisions in the same rule name exactly where an engineering team should look next. Application software that limits, screens out, ranks or prioritizes candidates by schedule availability can discriminate against applicants on religious creed, disability or medical condition, and the rule requires the tool to include a way for the applicant to request an accommodation (§11016(c)(3)(A)). An interview tool that reads tone of voice, facial expression or other physical behavior carries the same disability-accommodation obligation (§11016(d)(1)). And criminal-history screening gets its own carve-out from the automated path entirely: an employer can't use "the use of an automated-decision system," any more than a background check or an internet search, to consider criminal history before a conditional offer is made (§11017.1(a)(1)), the same restriction that already applies to a human recruiter doing it by hand.
None of these are hypothetical vendor features. They describe the exact scheduling widget, video-interview product and background-check integration a Series B company's applicant-tracking stack already runs by default.
A worked example
Picture a 90-person insurance-services company running a scored applicant-ranking plugin inside its applicant-tracking system, bought eighteen months ago and never re-evaluated since. The same system also runs an availability screen that filters out anyone who can't confirm weekend coverage, because the role has rotating shifts. Nobody on the compliance side connected that screen to the accommodation requirement, because nobody classified a scheduling filter as an ADS at all; it reads as a form field, not an algorithm.
Two fixes close the gap, and neither requires replacing the tool. First, accommodation language goes on the screen itself, in the pattern the regulation gives: "Other than time off for reasons related to your religion, a disability, or a medical condition, are there any days or times when you are unavailable to work?" A candidate can flag a conflict without disclosing the protected reason behind it. Second, someone runs and files an adverse-impact check on the ranking plugin's output by protected category, on a cadence the company can point to later. That file is the difference between having a defense under section 11009(f) and not having one.
What this means for your team
If you're a CTO or GC at a California employer with five or more people, and any tool that scores, ranks, filters or analyzes an applicant or employee, three things are overdue: an inventory of which tools actually meet the section 11008.1 definition, an adverse-impact test on file for each one that does, and a retention policy moved from two years to four. None of that needs a lawyer to write code, and none of it should wait for the CPPA's 2027 date, which governs a different set of obligations entirely.
This is the kind of scoped engineering work our custom software team treats as a fixed-scope readiness pass, not an open-ended retainer, whether the tool in question is a vendor plugin or something built in-house. If you want a straight answer on which of your current hiring tools already meets the ADS definition and which don't, tell us what's in your stack and we'll scope it before anyone touches code, the same discipline our decision-logging guidance argues for on the CPPA side of this.
Sources
- California Civil Rights Council: Final Text of Proposed Employment Regulations Regarding Automated-Decision Systems (approved June 27, 2025; effective October 1, 2025)
- California Privacy Protection Agency: CCPA regulatory updates on ADMT, risk assessments and cybersecurity audits (approved by the Office of Administrative Law September 22, 2025)