California AI hiring rules: separate the obligations.

Two frameworks to keep distinct

California’s employment regulations addressing automated decision systems took effect October 1, 2025. They clarify how existing employment discrimination protections apply when technology supports employment decisions. Using a vendor does not remove the employer’s responsibility for its decisions.

The California Privacy Protection Agency has a separate regulatory framework. Its regulations took effect January 1, 2026, with different compliance dates for different obligations. Risk-assessment requirements begin in 2026; ADMT requirements begin January 1, 2027 for covered businesses and uses. The rules’ effective date is not the same as every compliance deadline.

Confirm coverage before building a checklist

The CCPA generally applies to for-profit businesses that meet its criteria. It generally does not apply to nonprofits or government agencies, although related entities, contracts, and other legal obligations can require separate analysis. Being an employer or using AI does not, by itself, settle coverage.

Map the workflow

• What does the tool do: draft, score, rank, recommend, monitor, or decide?
• Whose information goes into it, and where do those people work or apply?
• Can an accountable person question the output and change the outcome?
• What records, notices, accessible alternatives, and vendor information are needed?

Ask more of the vendor

Request an explanation of the intended use, known limitations, testing, data handling, and change process. A vendor’s broad statement that its product is “compliant” is not a substitute for reviewing your use of it.

Educational guidance, not legal advice or a certification of compliance. Requirements depend on location, employer size, industry, and the facts. Consult qualified employment counsel for decisions involving legal obligations.