Most coverage of these rules stops at the effective date. A defence lawyer starts somewhere else, at the arguments an employer will actually make when a screening tool produces a complaint, and those arguments are answerable from a document almost nobody reads.
The Civil Rights Council published a final statement of reasons running to 256 pages, in which it answers public comment after public comment, naming the commenter and stating what it did. Over 40 comment letters came in from the business community, trade associations and civil rights groups. Eight of the defences employers will raise are tested below against what the Council said when a named organisation asked for exactly that protection. Some hold. Most do not.
The exclusion list in Section 11008.1 releases ordinary software only on a condition
The defence: the tool is ordinary business software, not a screening system.
FEHA now defines an automated-decision system in the final text of the regulations as “a computational process that makes a decision or facilitates human decision making regarding an employment benefit,” which may derive from artificial intelligence, machine learning, algorithms, statistics “and/or other data processing techniques.” Facilitating a human decision is enough. The tool does not have to decide anything.
An automated-decision system exclusion list does follow, at Section 11008.1(a)(2): word processing software, spreadsheet software, map navigation, web hosting, domain registration, networking, caching, website loading, data storage, firewalls, anti-virus, anti-malware, spam and robocall filtering, spellchecking, calculators and databases. Read the qualifier attached to it. Each of those technologies is excluded only “provided that these technologies do not make a decision regarding an employment benefit.”
An automated-decision system can therefore be a spreadsheet. One that ranks candidates on a weighted score sits inside the definition, and the same file holding contact details sits outside it. Drawing that boundary is the same exercise as deciding what belongs on a register, which our guide to system registry versus model inventory works through. The Alliance for Digital Innovation argued the wording would capture “a vast array of workplace software” and asked the Council to exclude public bodies from the rulemaking entirely. The Council tailored several definitions in response and refused the carve-out.
Workday asked the Council for a safe harbour and the Council refused on authority grounds
The argument: we ran a bias audit, so we are covered.
FEHA mentions anti-bias testing throughout the amended regulations, and never once as immunity. Section 11009(f) makes it unlawful to use such a system or selection criteria that discriminates, “subject to any available defense,” and then adds a sentence the Council planted in eight separate places across the chapter: “Relevant to any such claim or available defense is evidence, or the lack of evidence, of anti-bias testing or similar proactive efforts to avoid unlawful discrimination, including the quality, efficacy, recency, and scope of such effort, the results of such testing or other effort, and the response to the results.”
FEHA grades six attributes in that sentence. Quality, efficacy, recency, scope, results, and response to results. A two-year-old audit of one hiring stage, with findings nobody acted on, is evidence on the plaintiff’s side of that sentence.
Where the Council placed that sentence is worth counting, because the placements are not uniform. Reading the adopted text section by section puts it in eight: 11009 on general principles, 11020 on aiding and abetting, 11028 on specific employment practices, 11032 and 11033 in the sex discrimination article, 11038 and 11039 in the pregnancy article, and 11063 in the religious creed article. Two protected-characteristic articles were passed over, disability and age, and both received something sharper instead. Across the 21 sections this rulemaking amended, the phrase automated-decision system appears 48 times.
The Civil Rights Council answered Workday’s request to convert that into a safe harbour in one sentence: “The Council declines to include a ‘safe harbor’ provision because doing so would exceed the authority of the Fair Employment and Housing Act, which these regulations implement, interpret, and make specific.” Elsewhere the Council put it more bluntly, saying the Act “provides no ‘safe harbor’ for discrimination and the Council cannot create one through these proposed regulations.”
The Council’s own response is the cleanest authority on the point, and our guide to bias risk detection and testing treats recency and response as the two attributes most testing programmes fail. California has now written both into the text.
The agent definition follows Raines, so vendor status neither creates nor excuses liability
The deflection: the vendor built the model, so the vendor is liable.
FEHA defines an agent at Section 11008(a) as any person acting on behalf of an employer, directly or indirectly, to exercise a function traditionally exercised by the employer or any other regulated activity, “including when such activities and decisions are conducted in whole or in part through the use of an automated decision system.” An agent of an employer is also an employer under the Act.
The U.S. Chamber of Commerce warned the wording would “exponentially expand litigation” against vendors. TechNet asked for developers and providers to be excluded. The Council narrowed the drafting twice, striking “advertisement,” “sale” and “provision” and replacing “practices related to the design, development, advertisement, sale, provision, and/or use” with “practice conducted in whole or in part by using an automated-decision system,” later “through the use of.”
The Civil Rights Council refused to exclude third parties. Its response anchors the test in Raines v. U.S. Healthworks Medical Group (2023) 15 Cal.5th 268: “qualifying as an agent does not, on its own, establish liability,” because an agent’s liability “results from the entity’s own engagement in FEHA-regulated activities on the employer’s behalf.”
A federal court has already applied that line to a screening platform. In Mobley v. Workday, Judge Rita Lin held on 12 July 2024 that the platform could be liable as an agent, because its tools are alleged to perform “a traditional hiring function of rejecting candidates at the screening stage and recommending who to advance to subsequent stages.” The same order rejected the employment agency theory. What decided it was that the software “is not simply implementing in a rote way the criteria that employers set forth, but is instead participating in the decision-making process.”
The defence therefore cuts both ways, and mostly against the employer. A vendor that merely licenses software is unlikely to be an agent, which leaves the employer alone on the claim. A vendor that screens on the employer’s behalf may be an agent, which adds a defendant without subtracting one, and the records deciding which description fits are the ones our AI hiring tools compliance guidance tells employers to keep.
Striking one word from Section 11008.1(d)(2) removed training data from the four-year box
The claim: that was training data, so we did not keep it.
One deleted word is why this defence works. The National Payroll Reporting Consortium objected that the data definition combined with the retention rule would force companies “to keep very large amounts of data for very long periods of time.”
The Civil Rights Council agreed in part. In the second modified text it struck the word “design” from Section 11008.1(d)(2), leaving data used to “develop or customize” a system for a particular employer. Its own response states the effect plainly: the change “excludes from the definition both ‘data used to train a machine-learning algorithm utilized as a part of an automated-decision system’ as well as ‘data produced from the application of an automated-decision system operation.'”
Generic training data behind a vendor’s base model sits outside the retention duty. Data used to tune that model for one employer sits inside it, along with any data used in or resulting from the system’s application, including data about individual applicants and data reflecting outcomes. The boundary is customisation, and an employer relying on it should be able to show which side of that line each dataset falls on.
Section 11013 binds an employer to records it created or received, not to an agent’s copies
The position: our agent holds those records, not us.
FEHA record retention doubled. Section 11013(c) moves the period from two years to four, running from the date the record was made or the date of the personnel action, whichever is later, and names the data from those systems in the list of what is covered alongside applications, personnel records, membership records, employment referral records and selection criteria.
CalChamber challenged the feasibility of retaining “all automated-decision system data.” The Council agreed in part and rewrote the trigger to records the entity “created or received,” confirming in its response that “an employer is not required to proactively seek copies of those records from the agent in order to meet the data retention requirement.” Proposed Section 11013(c)(8) was removed for the same reason.
One condition destroys the defence. Section 11013(c)(4) requires a respondent, on notice or knowledge that a complaint has been filed, to preserve all relevant records until the later of two dates, and defines relevant records to include automated-decision system data “completed by the complainant and by all other candidates for the same position at that facility or other relevant subdivision.” A single complaint converts a narrow retention duty into a pool-wide preservation duty, and data sitting only with a vendor becomes data an employer needs contractual access to before the complaint arrives, not after. Holding that in a governed register rather than in a mailbox is the point of an AI governance platform.
Section 11072(b)(1) waives statistical proof for a disability screen-out claim
The objection: there is no statistical evidence of adverse impact.
FEHA makes this the weakest defence on the list, through two changes. Section 11072(b)(1) prohibits qualification standards, employment tests, proxies or other selection criteria that screen out or tend to screen out applicants or employees on the basis of disability, “including but not limited to those administered through the use of an automated-decision system.” Then it adds: “Statistical comparisons between persons with disabilities and persons who are not disabled are not required to show that an individual with a disability or a class of individuals with disabilities is screened out by selection criteria.”
Recall the two articles the testing-evidence sentence skipped. Disability is the first, and this is what it received instead. The same subsection also extends the business necessity defence. A standard is lawful when job-related and consistent with business necessity “and there is no less discriminatory standard, test, or other selection criteria that serves the employer’s goals as effectively.” A less discriminatory alternative now defeats a job-related test, which is a materially harder standard than showing validity alone.
FEHA proxy exposure follows the same logic. Section 11008 defines a proxy as “a characteristic or category closely correlated with a basis protected by the Act,” and when the Disability Rights Education and Defense Fund asked the Council to loosen that wording, the Council declined and stated that the definition “does not require mathematical evidence to establish a close relationship,” citing Pacific Shores Properties, LLC v. City of Newport Beach (2013) 730 F.3d 1142. An impact ratio still helps, which is why the arithmetic in our Local Law 144 bias audit guide transfers, and in California its absence is not a defence.
Section 11071 turns a pre-offer personality assessment into a medical inquiry
The characterisation: it is a game, not a medical test.
Automated-decision systems are defined to include computer-based assessments using “questions, puzzles, games, or other challenges” to make predictive assessments, to measure “skills, dexterity, reaction-time” and other abilities, and to measure an applicant’s “personality trait, aptitude, attitude, and/or cultural fit.”
FEHA makes a pre-offer medical or psychological examination or inquiry unlawful at Section 11071(a), and defines that examination as “a procedure or test that seeks information about an individual’s physical or mental conditions or health.” Nothing in either provision turns on what the vendor calls the product.
The Civil Rights Department said so directly in its own announcement, listing among the regulations’ effects that they “affirm that automated-decision system assessments, including tests, questions, or puzzle games that elicit information about a disability, may constitute an unlawful medical inquiry.” A gamified pre-offer assessment measuring reaction time is a candidate for that reading, and the compliance question is what the instrument elicits rather than how it is marketed.
California imposes no notice duty, after the Council declined one and the Governor vetoed SB 7
The last resort: the applicant never told us they needed an accommodation.
Two separate attempts to create a disclosure obligation failed within twelve months of each other. The Association of California State Employees with Disabilities asked the Council to require advance notice of screening-tool use so that an applicant could request accommodation before the interaction. The Council declined, calling the proposal outside the scope of a rulemaking that clarifies the Act. The Center for AI and Digital Policy asked that anti-bias test results be published, and the Council declined again, on the ground that publication “would create a new obligation for employers that is not required in FEHA.”
Senate Bill 7, the No Robo Bosses Act, would have required written notice before an employer used such a system, barred sole reliance on one for discipline or termination, and given workers a right to the data behind the decision. Governor Newsom vetoed it on 13 October 2025, objecting that “the bill imposes unfocused notification requirements on any business using even the most innocuous tools” and directing the state to first assess the efficacy of the new regulations.
So California regulates algorithmic hiring with no notice duty at all, which is the opposite of the position in Illinois under HB 3773 from 1 January 2026. The defence still fails, because the Council added to Sections 11016(c)(5) and (d)(1) that “to avoid unlawful discrimination, an employer or other covered entity may need to provide reasonable accommodation to an applicant.” An accommodation duty with no notice duty in front of it leaves the employer carrying the risk that an applicant never knew there was anything to ask for.
Section 11076 gives age claims a presumption, and Mobley v. Workday is an age case
Age is the second article the testing-evidence sentence skipped, and what it received instead is the strongest provision in the chapter. Section 11076(a) states that “there is a presumption of discrimination whenever a facially neutral practice, including but not limited to the use of an automated-decision system, has an adverse impact on an applicant(s) or employee(s) age 40 or older, unless the practice is job-related and consistent with business necessity.”
FEHA shifts the burden there rather than weighing evidence. A presumption is not a factor the Council will consider, it is a starting position the employer has to displace, and the same subsection adds that a job-related practice may still be impermissible “where it is shown that an alternative practice could accomplish the business purpose equally well with a lesser discriminatory impact.” Adverse impact on the over-40 group is enough to put an employer on the back foot, and a validated tool does not end the argument.
Read that alongside the litigation. Mobley v. Workday, No. 3:23-cv-00770-RFL before Judge Rita F. Lin in the Northern District of California, is an Age Discrimination in Employment Act disparate impact claim. Judge Lin granted preliminary certification on 16 May 2025, for applicants aged 40 or older denied employment recommendations through the platform at any point after 24 September 2020. The court then authorised notice on 17 February 2026, and roughly 14,000 people are reported to have joined by the opt-in deadline of 7 March 2026. The named plaintiff alleges he submitted more than 100 applications through employers using the platform and was rejected every time.
Scale is why the case matters from a records perspective. In the certification proceedings Workday’s own filing referred to its tools rejecting applications numbering in the billions across the relevant period, a figure that appears to cover global operations rather than the United States alone and that the company has not broken down.
Read the case against Section 11013. Four years of that data, plus a pool-wide preservation duty from the moment a complaint lands, plus a claim theory that reaches a platform as an agent, describes an evidence problem rather than a policy problem. An employer that cannot produce the version of the model in use on a given date, the configuration applied to a given requisition and the outcomes it generated is arguing about intent with no exhibits.
The privacy regime runs on a separate track. Automated decision-making technology under the separate CPPA regulations carries risk assessment and opt-out duties that FEHA does not, on dates of their own, and our CPPA ADMT guide covers those. The Council confirmed it coordinated with the agency so the two sets of rules would not conflict, noting that its own regulations interpret existing law while the privacy rules create new obligations.
What a defensible California file holds
| Defence an employer will raise | What the record says | Artefact that settles it |
| Ordinary software, not an ADS | Exclusions apply only where the technology makes no employment-benefit decision | Tool register with the decision each tool informs |
| We ran a bias audit | No safe harbour; testing graded on six attributes | Dated test, scope statement, findings, remediation log |
| The vendor is liable | Agency follows Raines; status alone is neither liability nor excuse | Contract terms on screening functions and data access |
| It was training data | “Design” struck from 11008.1(d)(2) | Data lineage showing generic versus customised sets |
| Our agent holds the records | Duty limited to records created or received | Retention schedule plus vendor production clause |
| No statistical evidence | Statistics not required for disability screen-out; 11076(a) presumes discrimination at age 40 and over | Less discriminatory alternative analysis, run by protected group |
| It is only a game | Pre-offer instruments eliciting condition information | Item-level review of every pre-offer assessment |
| No accommodation was requested | Accommodation duty stands with no notice duty | Accommodation pathway documented at each ADS stage |
Govern365.ai is built for the column on the right. Each model and each tool sits once in an AI system inventory with its version, its vendor, the requisitions it touched and its testing history, so the record that answers a Civil Rights Department request is a query rather than a reconstruction. Four-year retention is a property of the record, not a folder somebody remembers to keep.
Reuse is what makes that structure worth building. The same evidence answers the annual bias audit in New York City, the notice and impact duties in Illinois, and the documentation an employer needs under our AI hiring tools compliance guidance, which is why treating California as a separate project is the expensive way to do it.
Frequently Asked Questions
When did California’s FEHA rules on algorithmic hiring take effect?
The Office of Administrative Law approved them on 27 June 2025 and they took effect on 1 October 2025.
What counts as an automated-decision system in California?
A computational process that makes a decision or facilitates human decision making regarding an employment benefit, which may use artificial intelligence, machine learning, algorithms, statistics or other data processing techniques. Resume screening, targeted job advertising, video interview analysis and computer-based assessments are named examples. Public employers are covered; the Council declined a request to exclude public bodies.
Is anti-bias testing mandatory in California?
No. Section 11009(f) makes evidence, or the lack of evidence, of anti-bias testing relevant to a discrimination claim and to any available defence, graded on quality, efficacy, recency, scope, results and the response to results. The Civil Rights Council expressly declined to create a safe harbour.
How long must employers keep automated-decision system data?
Four years, up from two, running from the date the record was made or the date of the personnel action, whichever is later, for records the employer created or received.
Are vendors liable under the California regulations?
A vendor can be liable where it meets the definition of an agent, which follows Raines v. U.S. Healthworks Medical Group. Agency status alone does not establish liability; liability follows from the entity’s own engagement in FEHA-regulated activities on the employer’s behalf.
Does California require employers to tell applicants that AI is used?
No. The Civil Rights Council declined to add a notice requirement, and Senate Bill 7, which would have imposed one, was vetoed on 13 October 2025.
Do the regulations cover training data?
Not generic training data. The Council struck “design” from the definition of automated-decision system data, excluding data used to train a machine-learning algorithm. Data used to develop or customise a system for a particular employer remains covered.
Can a personality test or hiring game be an unlawful medical inquiry?
Yes, where a pre-offer instrument seeks information about an individual’s physical or mental condition or health. The Civil Rights Department states that puzzle games eliciting information about a disability may constitute an unlawful medical inquiry.
What is a proxy under the regulations?
A characteristic or category closely correlated with a basis protected by the Act. The Council confirmed that establishing the close relationship does not require mathematical evidence.
Is there a presumption of discrimination for age claims?
Yes. Section 11076(a) creates a presumption of discrimination where a facially neutral practice, expressly including an automated-decision system, has an adverse impact on applicants or employees aged 40 or older, unless the practice is job-related and consistent with business necessity. A less discriminatory alternative can still defeat it.
How do the FEHA rules differ from the CPPA ADMT regulations?
FEHA interprets existing antidiscrimination law and creates no opt-out or impact assessment duty. The CPPA regulations create new privacy obligations including opt-outs and risk assessments. The Council coordinated with the agency to avoid conflict between the two.
What is the significance of Mobley v. Workday?
The Northern District of California authorised notice on 17 February 2026 to applicants aged 40 or older who applied through the Workday platform since 24 September 2020, testing whether a screening platform can be liable as an agent of the employers using it.
