California's FEHA regulations, in effect since October 1, 2025, govern Automated-Decision Systems (ADS) used for hiring, promotion, and other employment decisions. Approved by the California Civil Rights Council and cleared by the Office of Administrative Law on June 27, 2025, they confirm that California's anti-discrimination protections apply in full to automated tools, and they raise the recordkeeping bar for employers. What they do not do, despite widespread early reporting, is impose sweeping joint liability on the vendors that build these tools; the final text pulled that back.

The rules confirm that FEHA's anti-discrimination protections, including a disparate-impact standard, apply to ADS used in hiring, promotion, and other employment decisions, and they require employers to retain ADS records for four years. Importantly, the regulations narrowed the treatment of technology vendors: liability rests primarily with the employer, and a vendor is exposed only when it acts as the employer's “agent” by exercising a function traditionally performed by the employer. The final version removed the broad aiding-and-abetting liability for developers and sellers of ADS tools that appeared in earlier drafts.

The regulations emerged from a multiyear rulemaking process and extensive public comment. Before them, California employers faced a gray area: many used AI hiring tools with limited guidance on how FEHA applied to automated decisions. The framework removes that uncertainty. Anti-discrimination protections now clearly extend to computational processes used across the employment lifecycle, from candidate sourcing and screening through interviewing, promotion, and compensation, whether or not a human reviews the output before the final decision.

What Are the California FEHA AI Regulations?

California's FEHA regulations are a set of rules, in effect since October 1, 2025, that clarify how the Fair Employment and Housing Act applies to automated employment decision tools. They establish that any computational process used to screen, rank, or evaluate job candidates and employees must not produce discriminatory outcomes, and they set recordkeeping duties for the employers that deploy these systems. Because they now apply in full, employers should audit existing automated systems and confirm their compliance measures are in place.

Key regulatory features:

  • Apply to all employers operating in California, regardless of size.
  • Apply FEHA's disparate-impact standard, where outcomes matter more than intent.
  • Require employers to retain ADS-related data and related records for four years.
  • Require reasonable accommodations so an ADS does not disadvantage candidates with disabilities or religious needs, and treat some assessment tools as potential unlawful medical inquiries.
  • Define an employer's “agent” narrowly, reaching a third party only when it exercises a function traditionally performed by the employer.

The regulations address a growing gap between existing anti-discrimination law and the rapid adoption of automated hiring tools. They make clear that an employer's core FEHA duties do not disappear simply because a decision was informed by software.

What Is an Automated-Decision System Under FEHA?

An Automated-Decision System (ADS) under the California FEHA regulations is any computational process that makes or substantially helps make employment decisions, including screening, scoring, ranking, or evaluating candidates and employees. The definition is intentionally broad and covers systems well beyond machine learning or artificial intelligence.

The California Civil Rights Department defines an ADS as a system that uses rules, statistical models, or algorithms to inform employment outcomes. The system does not need to operate autonomously; a tool counts as an ADS even when a human makes the final decision, if the software provides scores, rankings, or recommendations that influence the outcome.

What counts as an ADS:

  • Resume screening tools that rank applicants by keywords or criteria.
  • Skills assessments and pre-employment tests that score candidates.
  • Video interview analysis tools that evaluate speech, tone, or expression.
  • Job advertisement systems that target or exclude specific demographics.
  • Promotion and compensation recommendation algorithms for existing employees.
  • Training and professional-development matching systems.

California FEHA covers roughly 18 protected characteristics, including race, age, sex, gender identity, sexual orientation, disability, religion, and medical condition, among others. Because FEHA applies a disparate-impact standard, an employer can face liability even without evidence of intentional discrimination: the outcome of the tool matters, not just the intent behind its design.

How the Rules Treat Vendors: Narrow “Agent” Liability, Not Blanket Joint Liability

Early drafts of these regulations would have swept technology vendors into direct FEHA liability. The final text did not. This is the single most misunderstood point about the rules, and getting it right matters for both employers and vendors.

Three changes in the final version tell the story. First, the definition of “agent” in Section 11008(b) was narrowed: it now reaches a third party only when that party acts on the employer's behalf to “exercise a function traditionally exercised by the employer,” such as recruiting, screening, hiring, promotion, or compensation decisions, including when those functions are carried out through an ADS. Second, the provision that would have extended aiding-and-abetting liability to “developers, designers, advertisers, sellers, or other mere providers of ADS tools” was deleted from Section 11020. Third, the four-year record-retention duty no longer applies to any person who merely sells or provides an ADS.

The net effect, as employment-law analyses have noted, is that liability primarily falls on the employer deploying the system, not on a vendor that merely builds or sells the tool. A vendor is exposed under these regulations only when it steps into a traditional employer function and acts as an agent, not simply by offering software.

What this means in practice:

  • A pure tool provider is generally not an “agent” and does not face direct FEHA liability under these rules just for selling or licensing an ADS.
  • A vendor that actually performs screening, ranking, or decision-making on the employer's behalf can qualify as an agent and face liability on that basis.
  • Because the primary exposure sits with the employer, employers cannot assume a vendor absorbs the risk, which makes independent verification of any tool essential.

What Employers Must Do to Comply

The core obligations fall on employers, and they are straightforward to state even if they take real work to meet. Employers using automated systems for hiring, promotion, or other employment decisions should run a gap analysis if they have not already.

  • ‍Avoid unjustified disparate impact. Do not deploy an ADS that produces a disparate impact on a protected group unless the tool is job-related and consistent with business necessity. Validation, showing that the tool measures skills actually needed for the job, is the standard to meet.‍
  • Retain records for four years. Maintain ADS-related records, including the data used to develop or validate the system, individual scores or rankings it produces, and any bias-testing results or audit reports, for at least four years, and make them available to the California Civil Rights Department on request.‍
  • Provide accommodations and alternatives. Offer alternative application or assessment methods where an ADS creates a barrier for candidates with disabilities or religious needs, respond to accommodation requests promptly, and ensure no tool functions as an unlawful medical or disability inquiry.‍
  • Document your bias testing. The regulations do not mandate a named bias audit, but the quality and frequency of the testing you perform will factor into how a disparate-impact claim is evaluated, so treat thorough, documented testing as your strongest defense.

Note on candidate notice: unlike New York City's Local Law 144, these regulations do not impose an equivalent standalone candidate-notice or audit mandate. Notifying candidates when an ADS is used remains sound practice and is required in other jurisdictions, but confirm any California-specific notice language against the final regulatory text with counsel rather than assuming an NYC-style requirement applies.

How California FEHA Compares With Other AI Hiring Laws

California stands apart from most state AI rules in one respect worth noting: it applies a disparate-impact liability standard rather than the notice-and-audit approach of laws like NYC Local Law 144, and, contrary to early reporting, its final rules did not extend broad direct liability to vendors. For how California fits alongside the other state and federal AI hiring laws, and how a December 2025 federal executive order seeking to preempt state AI laws may affect them, see our Multi-State AI Hiring Compliance Guide, which maintains the full comparison.

What HR Tech Vendors Should Know About FEHA Liability

The most important thing for vendors to understand is that California's final regulations are less onerous for tool providers than the drafts suggested. The rules focus liability on employers and reach a vendor only when it acts as the employer's agent by exercising a traditional employer function. Merely designing, selling, or licensing an ADS does not, by itself, make a vendor directly liable under these regulations, and the seller-side recordkeeping and aiding-and-abetting provisions from earlier drafts were removed.

That is not a reason to stand down. The broader trajectory of vendor exposure is still rising, as the federal Mobley v. Workday litigation shows: in May 2025 a federal court granted conditional certification of a nationwide ADEA collective action against Workday on the theory that the vendor acted as the employers' agent; in 2026 the court held the ADEA covers applicants and revived the disability and California state-law claims, while the race claim was dismissed. That case is federal and separate from California's ADS regulations, and its agent theory is in fact broader than what California's final text adopted, but it signals where the risk is heading. See our explainer on the Workday class-action lawsuit.

Steps vendors should take:

  • Conduct independent bias testing of ADS products used in California hiring or employment decisions.
  • Document the data sources, decision criteria, and validation methods for each tool.
  • Keep testing results and remediation records so customers can meet their four-year retention duty.
  • Give employers enough information about ADS design and performance to support their compliance obligations.
  • Review customer contracts to reflect a shared, realistic allocation of compliance responsibility.

Because primary liability sits with the employer, the vendors that make it easiest for customers to verify fairness, through independent testing and clear documentation, hold a real advantage in procurement.

Ready to Ensure Your ADS Meets California FEHA Standards?

Now that the rules are in force, every organization using automated systems in California employment decisions is subject to them. Because primary liability sits with the employer, independent assessment provides the documented evidence that courts and regulators will examine, whether you are an employer evaluating your current tools or a vendor helping customers verify compliance.

Schedule a compliance review with Warden AI to assess your current ADS deployments and identify and close gaps, and learn how our independent AI assurance services and Warden Assured certification support your California FEHA compliance program.

Related Articles

Sources and Further Reading

California FEHA AI Rules: Frequently Asked Questions

They took effect on October 1, 2025. The Office of Administrative Law approved the final text on June 27, 2025, following the Civil Rights Council's rulemaking and public comment. Employers subject to them should audit their automated systems for disparate impact and confirm their recordkeeping meets the four-year standard.

No. Unlike New York City Local Law 144, the California FEHA regulations do not mandate a named bias audit. However, the quality and depth of the bias testing an organization performs will factor into how courts and regulators evaluate liability under the disparate-impact standard, so comprehensive, documented testing is a strong defense.

Only in limited circumstances. The final regulations narrowed the “agent” definition and removed the draft provisions that would have imposed direct aiding-and-abetting liability on developers, sellers, or mere providers of ADS tools. A vendor faces direct FEHA exposure only when it acts as the employer's agent by exercising a function traditionally performed by the employer, not merely by building or selling a tool. Primary liability rests with the employer that deploys the system.

FEHA covers more protected characteristics than federal law, roughly 18 versus about nine under Title VII, the ADEA, and the ADA combined. FEHA also applies a disparate-impact standard in the ADS context, meaning an employer can be liable for biased results even without evidence of intentional discrimination, though the burden-shifting framework differs from federal disparate-impact claims.

Employers must maintain ADS-related records for at least four years, including data used to develop or validate the system, individual scores or rankings, bias-testing results, accommodation requests and responses, and any audit reports, and must produce them to the California Civil Rights Department on request. Notably, the rules do not impose this retention duty on vendors that merely sell or provide an ADS.