California Civil Rights Council Regulations on Automated-Decision Systems in Employment
United States · Regulation · California Civil Rights Council
Our summary
These regulations clarify how California's existing workplace antidiscrimination laws apply to algorithmic and AI-based employment decisions such as hiring, recruitment, and promotion. They establish that such systems are unlawful if they produce disparate impacts based on protected traits, require employers to keep relevant records for four years, and specify that automated assessments requesting disability information constitute prohibited medical inquiries. The rules aim to address discrimination risks that arise when algorithms perpetuate historical workplace biases or direct opportunities differently across demographic groups.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
3 sections
Jump to a chapter
Announcement of approved regulations
The California Civil Rights Council approved regulations on June 27, 2025 to protect against employment discrimination from artificial intelligence and automated-decision systems, clarifying how existing antidiscrimination laws apply to these technologies. The regulations take effect on October 1, 2025.
Need for regulations and approval process
Automated-decision systems used increasingly in employment for recruitment, hiring, and promotion decisions can exacerbate existing biases and produce discriminatory outcomes. The Civil Rights Council developed these regulations under California law after public hearings and consideration of expert and public input, followed by approval from the Office of Administrative Law.
Key provisions of the regulations
These regulations interpret how existing California antidiscrimination law applies when employers and covered entities use automated systems to make employment decisions. They require employers and covered entities to keep employment records containing automated system data for at least four years, prohibit automated systems that harm applicants or employees based on protected traits such as gender, race, or disability, and clarify that disability-related assessments through automated systems may be unlawful medical inquiries. The regulations also define key terms including automated-decision system, agent, and proxy.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.