California AI Hiring Compliance in 2026: How FEHA and CCPA Automated Decision Rules Fit Together

For an employer using AI or automated technology to recruit, screen, rank, interview, or recommend candidates in California, the first compliance question is not simply whether the product uses AI. The useful questions are which legal framework applies, which entity is regulated, what the system actually does, how people use its output, what personal information is processed, and when the relevant obligation becomes operative.

California's employment-discrimination and privacy regimes answer different questions. The Fair Employment and Housing Act framework asks whether an employment practice—including one carried out through an automated-decision system—causes unlawful discrimination or otherwise violates FEHA. The California Consumer Privacy Act framework governs covered businesses' processing of personal information, including specified risk assessments and, beginning in 2027, rights associated with a defined category of automated decisionmaking technology used for significant decisions.

The overlap is real, but the terminology is not interchangeable. “Automated-decision system” under the Civil Rights Council rules is broader than “ADMT” under the final California Privacy Protection Agency regulations. An employer may therefore conclude that a tool is not covered by CCPA Article 11 because a qualified human genuinely makes the decision, yet still need to evaluate the tool under FEHA because it facilitates human decision-making about an employment benefit.

This guide states the law as verified on September 25, 2026. It provides general regulatory information, not legal advice about a particular product or hiring process.

Why California is different

California's compliance architecture is layered. The Civil Rights Department enforces FEHA, and the Civil Rights Council's automated-decision-system amendments became effective October 1, 2025. The CPPA and California Attorney General enforce the CCPA and its regulations. The CPPA's 2025 rulemaking is complete: the final regulations became effective January 1, 2026, but the regulation expressly gives businesses until January 1, 2027 to comply with Article 11 when they use covered ADMT for significant decisions.

That date distinction is essential. It would be inaccurate to call the CCPA ADMT provisions merely proposed; they are final. It would also be inaccurate to say every Article 11 notice and opt-out duty was already operative throughout 2026. Meanwhile, the risk-assessment article has its own timing rules and is not postponed wholesale until 2027.

FEHA: automated hiring is still an employment practice

The Civil Rights Council regulations define an automated-decision system as a computational process that makes a decision or facilitates human decision-making regarding an employment benefit. The system may use or be derived from artificial intelligence, machine learning, algorithms, statistics, or other data-processing techniques. The definition is functional and extends beyond tools marketed as “AI.”

The regulations give hiring-specific examples: computer-based tests or games used to measure skills, abilities, personality, aptitude, attitude, or cultural fit; tools that screen, evaluate, categorize, or recommend applicants or employees; targeted delivery of job advertisements; resume screening for terms or patterns; analysis of facial expression, word choice, or voice in online interviews; and analysis of applicant or employee data obtained from third parties.

The operative legal point is not that these tools are prohibited. Rather, an employer or other covered entity may violate FEHA by using an automated-decision system or selection criterion that discriminates against an applicant or employee on a protected basis. Existing disparate-impact and other FEHA principles remain relevant. A product's automation, consistency, or vendor-supplied fairness report does not itself establish that its use is lawful.

The regulations also address disability-related risks. An automated assessment that elicits information about a physical or mental disability or medical condition may constitute a prohibited inquiry. A test that measures the effects of a disability instead of relevant job skills can also raise FEHA and reasonable-accommodation questions. The analysis depends on the assessment, the job, the information elicited, and the employer's process.

Recordkeeping is a concrete operational requirement. Covered employers, employment agencies, labor organizations, and apprenticeship programs generally must retain covered employment records for at least four years. The amended rules expressly include defined automated-decision-system data, which encompasses data used in or resulting from application of the system and data used to develop or customize it for a particular employer or covered entity, within the final definition's boundaries.

• California SB 947 and AB 1883 workplace-AI lawsSee the enacted human-corroboration, emotion-inference, and neural-data rules that begin in 2027.
• California FEHA automated-decision-system recordReview the effective rule, dates, requirements, and primary sources.
• California state intelligence pageSee current duties, future deadlines, historical proposals, and watch items.

CCPA: a narrower ADMT definition and a privacy-rights framework

The final CPPA regulations define automated decisionmaking technology as technology that processes personal information and uses computation to replace human decision-making or substantially replace human decision-making. The final language does not use the broader “substantially facilitates” formulation found in earlier drafts and commentary. For this definition, substantial replacement means the business uses the technology's output to make a decision without qualifying human involvement.

Qualifying human involvement requires more than placing a person somewhere in the workflow. The human reviewer must know how to interpret and use the output, review and analyze both the output and other information relevant to making or changing the decision, and have authority to make or change the decision based on that analysis. If those elements are present in practice, the technology may not replace or substantially replace human decision-making. If review is nominal, constrained, or limited to approving a score, the result may be different.

Article 11 applies when a CCPA-covered business uses ADMT to make a significant decision concerning a consumer. “Significant decision” includes the provision or denial of employment or independent-contracting opportunities or compensation. The employment category expressly includes hiring; allocation or assignment of work and compensation; promotion; and demotion, suspension, and termination. Advertising alone is excluded from the significant-decision definition, although other CCPA provisions may still apply to the underlying personal information.

CCPA coverage is not universal. The statute generally applies to for-profit entities doing business in California that determine the purposes and means of processing and meet a statutory threshold. CPPA guidance identifies the adjusted 2025 revenue threshold as $26.625 million, alongside the alternative thresholds involving 100,000 California residents or households and revenue derived from selling or sharing personal information. Employees and job applicants who are California residents are consumers under the CCPA; the former general employment-data exemption expired at the end of 2022.

What applies in 2026—and what begins in 2027

The CPPA regulations became effective January 1, 2026. Beginning then, a covered business must conduct and document a risk assessment before initiating processing that the regulations identify as presenting significant privacy risk. That list includes using ADMT for a significant decision, specified processing of sensitive personal information, certain automated inferences about job applicants or employees based on systematic observation, and processing personal information to train defined technologies.

The transition rule matters. Covered processing initiated before January 1, 2026 and continuing afterward must be assessed by December 31, 2027. For new covered processing, the assessment comes before initiation. Assessments must be reviewed at least once every three years and updated as necessary. A material change that creates new negative impacts, increases identified risks, or weakens safeguards requires an update as soon as feasible and no later than 45 calendar days after the change. Original and updated assessments must be retained for as long as the processing continues or five years after completion of the assessment, whichever is later.

Risk-assessment reporting follows another schedule. For assessments conducted in 2026 and 2027, the required submission to the CPPA is due by April 1, 2028. The submission is not necessarily the full assessment report, although the CPPA or Attorney General may demand reports under the regulation. This is separate from the duty to perform and document the assessment itself.

Article 11's ADMT requirements begin January 1, 2027. A business already using covered ADMT for a significant decision before that date must be compliant by January 1, 2027; a business using it on or after that date must comply whenever it uses the technology for that purpose.

1. Pre-use notice: before the relevant processing, the business must provide a prominent notice explaining the specific purpose, the applicable opt-out right or exception, the access right, nonretaliation, and required information about how the ADMT works and how an alternative decision would be made.
2. Access: on a verified request, the business must provide plain-language information about the purpose, the logic as applied to the consumer, the output, and how the output affected the significant decision, subject to specified protections.
3. Opt-out: consumers generally may direct the business not to use covered ADMT for the significant decision, but the regulations contain exceptions. The scope of an exception must be established rather than assumed.
4. Human appeal exception: a business may avoid offering the opt-out when it supplies a qualifying appeal to a human reviewer with the knowledge and authority required by the regulation.
5. Limited hiring exception: the opt-out is not required for an admission, acceptance, or hiring use when the ADMT is used solely to assess ability to perform and the system works for that purpose without unlawful discrimination. Notice and access duties remain relevant.

• California CCPA ADMT regulatory recordReview the final rule's current risk-assessment duties and future Article 11 date.

Does keeping a human involved make an AI hiring system compliant?

Not automatically. Human involvement can change whether a technology meets the CCPA definition of ADMT, but the regulation sets a substantive test. A reviewer who understands the output, considers it alongside other relevant information, and can change the decision is different from a reviewer who sees only a score, lacks access to contradictory information, or cannot depart from the system's recommendation.

Even genuine human involvement does not create a general safe harbor. First, the broader FEHA automated-decision-system definition covers computational processes that facilitate human decision-making about employment benefits. Second, discriminatory selection criteria remain subject to FEHA regardless of whether a person clicks the final button. Third, CCPA duties unrelated to Article 11 may still apply to the collection and use of applicant information, and risk assessments may be triggered by other categories of processing such as sensitive information or systematic observation.

The result is a two-step analysis. Determine whether the system and actual review process replace or substantially replace human decision-making under the CCPA. Then separately analyze the entire employment practice under FEHA. The answer should reflect operating reality, not a workflow diagram that labels one box “human review.”

Common California AI hiring scenarios

Employer and vendor responsibilities are related but not identical

The employer controls the hiring process, defines roles and criteria, chooses how a tool is configured, and decides how outputs affect candidates. Outsourcing software does not outsource the employer's FEHA obligations. At the same time, the regulations do not make every HR-technology company automatically liable as an employer. Under FEHA, a vendor may be an agent when it acts on an employer's behalf in a traditionally employer function; that is a relationship-specific question.

The CCPA uses a different set of roles. A vendor may be a service provider, contractor, third party, or business depending on its contracts and processing. Service providers and contractors have role-specific restrictions and cooperation duties. For example, they must assist a business with information necessary for covered risk assessments and with verified ADMT access requests when the required information is in their possession. A vendor that independently determines why and how it processes information outside its service-provider role may have its own business obligations.

Contracts can allocate tasks—data access, notices, request handling, assessment inputs, change notices, and retention—but cannot rewrite statutory status. Procurement teams should distinguish who promises to perform a task from which entity remains accountable under FEHA or the CCPA.

Practical compliance questions for employers

1. What decisions does the system affect? Map recruiting, screening, ranking, interview evaluation, advancement, offers, and compensation rather than relying on the product category.
2. Does the tool make or facilitate an employment decision under FEHA? Preserve the selection criteria, inputs, outputs, outcomes, configuration, and records needed to evaluate that use.
3. Is the organization a CCPA business, and what role does each vendor occupy? Coverage cannot be resolved from employee count alone.
4. Does the technology replace or substantially replace human decision-making? Document what reviewers know, what information they examine, and whether they can change the result.
5. Did covered processing begin before or after January 1, 2026? New processing may require a prior risk assessment; continuing legacy processing has the December 31, 2027 transition deadline.
6. Does another risk-assessment trigger apply? Sensitive information, systematic observation, physical or biological profiling, and training activity may matter independently of Article 11.
7. What changes require assessment updates? Establish a process for identifying changes that create or increase negative impacts or reduce safeguards, rather than treating every software patch as automatically material.
8. Can the organization deliver Article 11 notices and rights by January 1, 2027? Test access responses, opt-out routing, vendor instructions, and any human-appeal process against the final text.
9. Do vendor contracts supply the necessary facts and operational support? Address data provenance, system logic, outputs, human-review design, changes, request assistance, retention, and risk-assessment inputs without assuming contract language transfers legal responsibility.

What HR-tech companies should be watching

HR-tech providers should identify when they act only on documented instructions and when they independently determine processing purposes or means. They should also determine whether their product design allows customers to provide meaningful notices, respond to access requests, honor opt-outs, operate a qualifying appeal, preserve required records, and complete risk assessments. The final CPPA rules require a business that makes ADMT available to another business for significant decisions to provide facts available to it that are necessary for the recipient business's risk assessment when the ADMT was trained using personal information.

Versioning deserves particular attention. A change does not automatically trigger a new legal conclusion merely because a release number changed. Under the CCPA risk-assessment rule, the defined question is whether the change creates new negative impacts, increases the magnitude or likelihood of identified impacts, or diminishes safeguards. Under FEHA, the practical question remains whether the changed employment practice produces unlawful discrimination or creates other covered problems.

California developments still evolving

Implementation and enforcement are the principal developments to watch. The CPPA has already emphasized that job applicants are CCPA consumers and has brought an enforcement matter involving applicant privacy notices, although that matter did not adjudicate the new ADMT article. The Civil Rights Department may likewise develop enforcement positions or litigation involving automated hiring tools under FEHA.

Legislation also remains possible, but historical proposals should not be mistaken for current duties. SB 7 would have created a broader employment automated-decision framework; Governor Gavin Newsom vetoed it in October 2025. Its proposed notice, appeal, and human-oversight provisions are not operative law. Future bills must be evaluated on their own text and status.

California's two operative frameworks should also not be collapsed into New York City's bias-audit model or Colorado's 2027 consequential-decision framework. New York City uses a one-year audit-recency condition for covered AEDTs. Colorado assigns documentation, notice, data, and human-review duties under a different statute. Neither supplies the definitions or deadlines for California.

• AI bias audits: audit versus monitoringCompare audit cadence, discrimination law, and governance controls.
• New York City Local Law 144 explainedSee how NYC's covered-tool audit model differs.
• Colorado AI employment law for 2027Compare Colorado's developer-deployer framework and human-review rights.

Key takeaways

• FEHA's automated-decision-system regulations are already effective and can reach tools that facilitate human employment decisions.
• The final CCPA regulations became effective January 1, 2026; qualifying new high-risk processing requires a risk assessment before it begins.
• CCPA Article 11's ADMT notice, access, opt-out, and applicable appeal requirements begin January 1, 2027.
• The final CCPA definition is based on replacing or substantially replacing human decision-making—not the broader language used in earlier drafts.
• Genuine human involvement can affect CCPA ADMT coverage, but it is not a universal compliance safe harbor and does not displace FEHA.
• Employer and vendor duties depend on their actual roles, conduct, contracts, and control; outsourcing technology does not automatically outsource legal exposure.