California’s anti-employment-discrimination regulations now include AI, expand retention requirements

On June 27, 2025, the California Civil Rights Council, which is part of the Civil Rights Department, published revised regulations to protect against employment discrimination as a result of an employer’s use of artificial intelligence (AI) and other technologies that make decisions or facilitate human decision making regarding employment benefits.

These regulations contain many surprises, from covering technologies that merely assist humans with making a covered employment decision, to expanding record retention requirements. The regulations go into effect on October 1, 2025, so there’s not a lot of time to get into compliance.

Scope

Even if you are quite confident that your organization does not use AI to advertise job postings, screen applicants, or assess employee performance, you may still be subject to these new requirements, as the regulations include any “automated-decision system” that employers may use to assist with the recruitment and employee assessment process.

“Automated-Decision System” is defined as follows:

“Automated-Decision System.” A computational process that makes a decision or facilitates human decision making regarding an employment benefit, as defined in section 11008(i) of these regulations. An Automated-Decision System may be derived from and/or use artificial intelligence. machine-learning, algorithms, statistics, and/or other data processing techniques.

(Emphasis supplied).

Whereas some state laws governing AI have focused on technologies that solely make automatic decisions without human input, the term here is used more expansively. Even if a human ultimately makes the employment decision, technologies that facilitate or assist a human with making this decision may be covered (for example: a program that identifies job applicants without a Bachelor’s degree for potential exclusion from recruitment, for which sorting is then reviewed and assessed by a human). This outcome is in stark contrast with other states’ comprehensive privacy laws—such as Texas—which have restrictions on “profiling” that applies only for “solely automated processing.”

The regulation gives several examples of the in-scope tasks performed by the system:

• Screening, evaluating, categorizing, and/or recommending applicants or employees [Recall that a class action regarding Workday’s use of AI in screening is proceeding, see our post on that case here.];
• Directing job advertisements or other recruiting materials to targeted groups;
• Screening resumes for particular terms or patterns;
• Analyzing facial expression, word choice, and/or voice in online interviews; or
• Analyzing employee or applicant data acquired from third parties.

The regulation also includes several exceptions:

excludes word processing software, spreadsheet software, map navigation systems, web hosting, domain registration, networking, caching, website­loading, data storage, firewalls, anti-virus, anti-malware, spam- and robocall-filtering, spellchecking, calculators, database, or similar technologies, provided that these technologies do not make a decision regarding an employment benefit.

Notably, this does not exclude technologies that would not be considered AI, but are likely common to the HR recruitment and employee evaluation process, such as job application software that screens whether an employee meets required criteria.

Prohibitions

In brief, the amended regulations extend the existing prohibitions against discrimination to the use of these new technologies. More specifically, employers are prohibited from using:

• An Automated-Decision System or selection criteria that discriminates against an applicant or employee or a class of applicants or employees on a basis protected by the Act.
• Pre-employment inquiries that directly or indirectly identify an individual on a basis enumerated in the Act, unless made pursuant to a permissible defense.
• An Automated-Decision System that measures abilities or characteristics that may discriminate against individuals with protected disabilities or characteristics.
• An Automated Decision System that discriminates during the interview or other employment screening. For example, an Automated-Decision System that analyzes an applicant’s tone of voice, facial expressions or other physical characteristics or behavior “may discriminate against individuals based on race, national origin, gender, disability, or other characteristics protected under the Act.”

The regulation also includes this statement regarding defenses:

Relevant to any such claim or available defense is evidence, or the lack of evidence, of anti-bias testing or similar proactive efforts to avoid unlawful discrimination, including the quality, efficacy, recency, and scope of such effort, the results of such testing or other effort, and the response to the results.

Record Retention

The regulation expands an employer’s record retention obligation from two years to four years.

It also expands what must be retained:

This includes all applications, personnel records, membership records, employment referral records, selection criteria, automated-decision system data, and other records created or received by the employer or other covered entity dealing with any employment practice and affecting any employment benefit of any applicant or employee.

(Emphasis supplied).

Of note, the regulation defines “Automated-Decision System Data” as including data (1) used in or resulting from the application of the Automated-Decision System, or (2) used “to develop or customize the automated-decision system for use by a particular employer or covered entity.” Organizations using Automated-Decision Systems in the employment context can expect that they will likely need to retain a much broader scope of data that may not have otherwise been subject to record retention requirements.

As a practical matter, because companies are typically required to retain a wide array of personnel records for active employees as compared to job applicants, these expanded retention requirements will likely have an even more significant impact on a company’s record retention obligations for job applicants. The volume of information a company may need to retain may be particularly significant for companies who screen thousands–if not tens of thousands–of job applicants each year.

Our Take

The first step is to ask whether your Human Resources department (or its agent) is using Automated-Decision Systems in any way—not solely as decision-makers, but also to facilitate decisions.

If so, then what have you (or your vendor) done with respect to anti-bias training of that system? Anti-bias testing and evidence of quality controls can be used as a defense to demonstrate that the system does not engage in or facilitate discriminatory recruitment and employment practices. Experienced counsel can assist with this point.

Next, consider how the new rules may expand your record retention obligations. Compliance may include ensuring that any contracts with vendors include record retention provisions or requirements to provide or return data you may need for long-term retention. Given that the regulation requires retention of applicant and personnel data used by the Automated-Decision System, you should also consider to what extent this information may include sensitive personal information covered by privacy law which may require additional security safeguards. You should also consider the cost-benefit analysis of using an Automated-Decision System in the employment context, and whether it may be appropriate to minimize the use of such systems. Smaller organizations may consider that the benefits of using Automated-Decision Systems for recruitment or employee assessment purposes (as opposed to relying on solely human review) are outweighed by the additional compliance and retention costs associated with using these systems.