Your AI Hiring Tool Falls Under California Civil Rights Rules Even if the Privacy Rules Skip You

The Civil Rights Council’s automated decision system rules reach any California employer with five or more employees, so they cover a company of 10 to 150 people. The privacy agency’s rules start January 1, 2027 and reach only businesses above the CCPA thresholds, which many small employers stay under and some do not. Check both this month.

I am Mac Malbrough. I hold a J.D. and an MS-HRM, I am not an attorney, and I write for California employers who use an applicant tracking system and wonder which AI rules apply to them. Where a point is my reading and not the regulation’s words, I say so.

Which California AI hiring rules reach a small employer?

Two sets of rules matter, and they have different reach. The Civil Rights Council regulations under the Fair Employment and Housing Act apply to you. The California Privacy Protection Agency’s rules apply to you only if your business crosses a privacy-law threshold.

The Civil Rights Council rules took effect on October 1, 2025, per the Civil Rights Department announcement and the Council’s rulemaking page. The final text defines an employer as one regularly employing five or more individuals. I found no higher threshold for the automated decision rules, so every employer with 10 to 150 people is inside them.

The privacy rules are different. They start from the California Consumer Privacy Act, which covers employee and applicant data and reaches only businesses that meet one of three tests. I explain those in section three. Legislation is a third track: the Governor vetoed SB 7 on October 13, 2025, per his veto message, and my guide to the No Robo Bosses Act covers the bill that followed.

What do the Civil Rights Council rules require of you?

They require that your tools do not discriminate, and that you keep the records. The rules do not ban AI. They apply the existing anti-discrimination law to it.

The definition is broad. Under section 11008.1(a), an automated decision system is a computational process that makes a decision, or helps a human make one, about an employment benefit. The listed examples include screening resumes for particular terms or patterns. Word processors, spreadsheets and spam filters are excluded when they do not make a decision about an employment benefit. In my reading, an applicant tracking system that ranks, scores or filters candidates fits the definition. My guide to how applicant tracking systems screen candidates explains what these tools do.

Four duties follow from the final text.

• You may not use an automated decision system or selection criteria that discriminate on a basis the Fair Employment and Housing Act protects, subject to any available defense (section 11009(f)).
• Evidence of anti-bias testing, or the lack of it, can be relevant to a claim or a defense, including the quality, recency and scope of the testing and your response to the results. It is not a safe harbor.
• An agent of an employer is also an employer, and the definition reaches people who screen applicants for you, including through an automated system (sections 11008(a) and (e)(3)). I read that to make a screening vendor a possible co-employer under the law, although the text never says vendor.
• You must keep applications and automated decision system data for four years, up from two (section 11013(c)), measured from the record or the personnel action, whichever is later.

Two older rules now reach your software as well. The criminal history rule bars inquiries before a conditional offer, and section 11017.1(a)(1) lists inquiries made through an automated decision system. The medical rule bars examinations or inquiries before an offer, and section 11071(e) includes any made through an automated system, such as a game that is likely to elicit information about a disability.

When do the privacy agency’s rules apply to you?

They apply when your business meets a CCPA threshold and uses automated decisionmaking technology for a significant decision about a person. That is a smaller group than the group the Civil Rights Council rules reach.

The agency’s regulations were approved by the Office of Administrative Law on September 22, 2025, per its Notice of Approval. The approved text requires a business already using the technology for a significant decision to comply by January 1, 2027. A significant decision includes hiring, assigning work, pay, promotion, demotion, suspension and termination.

Your business is covered under Civil Code 1798.140(d) if it does business in California and meets any one of three tests: annual gross revenue above the adjusted threshold, buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half its revenue from selling or sharing personal information. The agency’s CPI adjustment page lists the revenue figure as $26,625,000 and says adjustments come every odd-numbered year. The agency’s FAQ confirms the figure and says employees and applicants count as consumers.

Many employers with 10 to 150 people stay under every test, but do not assume it. A 150-person firm can pass $26.6 million in revenue. Check your last full year of gross revenue, and ask whether you sell or share customer data.

One more point helps. The rules define the technology as something that replaces or substantially replaces human decisionmaking, and they say a person counts only if they know how to interpret the output, review it and other information, and have the authority to change the decision. A tool whose output a trained person reviews with real authority may fall outside the definition, which is my reading of the text.

What should you ask your applicant tracking vendor this month?

Ask in writing, and save the answers. A vendor that screens for you is part of your compliance, and its answers become part of your record. I use seven questions.

• Does the product rank, score, filter or reject applicants, or only store them?
• What criteria does it use, and can you see and change them?
• What anti-bias testing has been done, when, by whom and with what results?
• Can you export applications and automated decision data for four years?
• Does it ask about criminal history or medical conditions, and at what stage?
• Does it use games or assessments that could elicit disability information?
• Does it post jobs to boards, and does it carry your pay scale?

The last question comes from Labor Code 432.3, which requires employers with 15 or more employees to include a pay scale in postings and to give the pay scale to a third party that publishes the posting. If your vendor auto-posts, check what it actually publishes. My guide to HR software for talent acquisition covers the selection side, and my AI and HR page collects the rest of my AI work.

What should a person review before a tool rejects anyone?

A person who can say yes, who knows what the output means and who has looked at more than the score. That is both good practice and the privacy rules’ definition of human involvement.

Build the checkpoint on three tests. The reviewer understands how the tool reached its output, reviews the output and the application together, and has authority to overrule it. A recruiter who clicks approve on every rejection does not meet that test. Record who reviewed each rejection and when, and keep it with the application for the four-year retention period.

Start the review with the knockout rules. Look at every automatic rejection your system applies: minimum experience, gaps in work history, location, a degree requirement and any question about convictions. A rule that screens out applicants at higher rates because of a protected trait is the kind of problem the regulations address.

If you also have staff in another state, read Illinois’s AI employment law and what it means for a California employer.

What should you do this week?

Do four things before the end of the month.

• List every tool that touches hiring, from your applicant tracking system to any assessment or sourcing tool.
• Send the seven questions above to each vendor.
• Find your last full year of gross revenue and compare it to $26,625,000.
• Name the person who reviews automatic rejections, and give that person the authority to overrule them.

If you want a second reader on the whole picture, my HR compliance check-up includes the hiring tools and the records behind them. For the other changes that arrive with the new year, see my guide to California’s new employment laws for 2027.

The rules for software that disciplines or fires employees are covered in what SB 947 lets an employee request when software drives discipline, and the 2027 ban on emotion recognition tools at work under AB 1883 covers tools that infer emotion.

For the everyday side, an AI starter plan for HR lists what to hand to a tool and what to keep.

For a set of rules your team can follow, see a safe prompt library for HR tasks.

Related reading: a plain-English glossary of AI terms for HR.

Related reading: The HR AI Field Guide, my book of plain-English terms, prompts and safe rules for AI in HR.

Sources

• Civil Rights Council, final text of the automated-decision system regulations, read October 26, 2026
• Civil Rights Council, rulemaking actions, read October 26, 2026
• Civil Rights Department announcement, June 30, 2025, read October 26, 2026
• California Privacy Protection Agency, OAL Notice of Approval, read October 26, 2026
• California Privacy Protection Agency, approved regulation text, read October 26, 2026
• California Privacy Protection Agency, CPI adjustment, read October 26, 2026
• Governor Newsom, SB 7 veto message, October 13, 2025, read October 26, 2026

McKinley holds a J.D. but is not a licensed attorney. Articles here are general information, not legal advice. For your specific situation, talk with an employment attorney.