Bias Audits for Employment AI: What California Employers Must Document Now
FEHA / EEO Defense
Here's the detail that surprises most employers: California doesn't technically require an AI bias audit that California employers can point to as a checkbox. What the law does is treat the absence of one as evidence against you. The presence of a well-documented bias audit can become important evidence that an employer exercised reasonable care to evaluate and mitigate discriminatory outcomes before relying on an automated decision system.
That distinction changes how you should think about this. It isn't simply a compliance form to file. It's a legal record you build before you need it. Here's what a legally defensible bias audit actually involves, the methodology behind it, and what to document.
Key Takeaways
California's FEHA regulations don't explicitly mandate bias audits, but treat the quality and recency of anti-bias testing as central to liability.
The standard methodology uses the adverse impact ratio (the "four-fifths rule"): if a protected group is selected at less than 80% of the highest-selected group's rate, the tool flags it for review.
A blanket "notify every candidate when AI is used" requirement is not part of California's FEHA ADS regulations specifically. That broader notice obligation comes from other frameworks, such as Colorado's AI Act.
Conducting the audit under attorney-client privilege, rather than as an internal HR project, is the single decision that most affects whether findings are protected or discoverable later.
Undocumented testing carries little to no evidentiary weight, even when the underlying work was done well.
What Is an AI Bias Audit?
An AI bias audit is a structured evaluation of an automated decision system (ADS), such as a resume screener, video-interview scorer, or promotion algorithm, to determine whether it produces disparate outcomes across groups protected under the Fair Employment and Housing Act.
It's not a one-time technical check. It's an ongoing evaluation process that generates a documented record.
California's FEHA regulations, in effect since October 1, 2025, don't explicitly mandate bias audits as a standalone requirement. But the regulations make the quality, scope, and recency of anti-bias testing directly relevant to liability. A documented audit functions as an affirmative defense in a discrimination claim, while the absence of one, or evidence that you found a problem and deployed the tool anyway, becomes evidence against you.
In practice, that makes conducting one closer to mandatory than the "not required" framing suggests.
How Employers Should Conduct an AI Bias Audit
Most coverage of this topic names the categories audits, testing, documentation without explaining the mechanics. Here's what a defensible process actually involves:
1.
Inventory every ADS in use.
Applicant tracking systems, resume parsers, video-interview scoring platforms, and any tool influencing hiring, promotion, discipline, or termination decisions.
2.
Collect outcome data segmented by protected characteristic.
This means selection rates, scoring distributions, and pass rates broken out across the FEHA-protected categories relevant to your applicant or employee pool: race, sex, age, disability, national origin, and the law's other protected classes.
3.
Calculate the adverse impact ratio.
The standard benchmark practitioners and courts use, derived from the federal Uniform Guidelines on Employee Selection Procedures, compares each group's selection rate to that of the highest-selected group. If a protected group's selection rate falls below 80% of the highest group's rate, that's the "four-fifths rule" threshold, and the tool flags it for deeper review.
4.
Document findings in detail,
whether or not disparity is found. A clean result still needs a record showing you tested for it.
5.
Record corrective action
if disparity is found: what changed, who approved it, and when. An identified problem with no documented response is worse evidence than no audit at all.
6.
Retain everything for at least four years,
the regulatory minimum for ADS-related records, including dataset descriptors, scoring outputs, and audit findings themselves.
Structuring the audit through employment counsel may allow certain legal analyses and communications to qualify for attorney-client privilege or work-product protection, depending on how the review is conducted. Because privilege is highly fact-specific, employers should work with counsel before beginning the audit.
Correcting a Common Mistake: What Notice Is Required
You'll frequently see it claimed that FEHA requires notifying every candidate whenever an ADS is used. That's not accurate to the adopted regulation itself.
What the actual regulatory text requires is narrower and more specific: online application tools that screen or rank candidates based on schedule availability must include a mechanism for the applicant to request an accommodation if the tool has a disparate impact based on religion, disability, or medical condition. Similarly, an ADS measuring an applicant's skill, dexterity, or reaction time may need to accommodate applicants whose disability affects those measures.
A blanket requirement for a "we're using AI to screen you" notice doesn't come from these regulations. It's a feature of other frameworks, such as Colorado's AI Act. If you're building a compliance program based on guidance that describes a broad notice mandate under FEHA specifically, it's worth double-checking against the actual regulatory text before you build a process around it.
Watch: California AI Compliance Update: a direct rundown of what's actually required if you're using AI for hiring or other business decisions in California right now.
Why This Isn't Theoretical: The Litigation Backdrop
If the audit obligation feels abstract, the litigation environment makes it concrete. In Mobley v. Workday, a federal court conditionally certified a nationwide collective action in May 2025 covering job applicants over 40 who were screened through Workday's AI recommendation system. Separately, in June 2026, the court allowed FEHA-adjacent claims to proceed based on the theory that Workday could be held liable as an "agent" for the discriminatory outcomes of tools it built and operated.
We cover this case and what it means for your own hiring liability in full in AI Hiring Discrimination in California: What the Workday Ruling Means for Your Business. Employers relying on similar third-party screening tools should assume courts will closely examine both the vendor's role and the employer's oversight of the system.
That's the backdrop against which a documented, privileged bias audit does real work. It's the evidence that separates an employer who can show good-faith, ongoing evaluation from one who simply deployed a vendor's tool and never looked again.
What HR and Employment Counsel Are Discussing About AI Hiring Risk
Recent discussions among HR professionals and hiring managers on Reddit show that many employers are becoming less concerned about whether they use AI and more concerned about whether they can explain and defend how it works.
Following the ongoing Workday litigation, employers are questioning how much they should rely on vendor claims that an AI tool has already been "validated" and whether they need to conduct their own internal reviews.
Others have raised practical concerns about resume parsers incorrectly interpreting employment histories, automated candidate rejections without meaningful human review, and whether relying entirely on vendor documentation would withstand legal scrutiny if a discrimination claim were filed.
For California employers, the recurring takeaway is consistent: vendor assurances alone are unlikely to be enough.
HR teams increasingly discuss maintaining records of internal testing, documenting human oversight of automated decisions, periodically reviewing hiring outcomes for adverse impact, and preserving evidence showing that AI-assisted recommendations were evaluated rather than accepted unquestioningly.
Those discussions closely mirror the direction that California's regulations and the recent Workday litigation are pushing employers toward demonstrating active oversight rather than passive reliance on AI vendors.
AI Bias Audit Documentation Checklist
If a claim arrives, this is roughly what a plaintiff's attorney will request, and what your file needs to contain already:
Document | Why It Matters |
|---|---|
ADS inventory and business justification | Shows you know what tools you're using and why |
Outcome data by protected characteristic | The raw basis for any disparity finding |
Adverse impact ratio calculations | The actual analysis, not just a summary conclusion |
Corrective action records | Shows disparity findings were acted on, not ignored |
Vendor bias-testing documentation | Confirms the vendor's own testing, separate from yours |
Privilege log/counsel involvement records | Establishes the audit was conducted under privilege |
Missing any one of these doesn't necessarily sink a defense, but it narrows your options, and undocumented testing carries essentially no evidentiary weight even if the work was genuinely done well.
How to Begin an AI Bias Audit
Engage employment counsel before starting, so privilege attaches from the first step, not after a concerning finding surfaces.
Inventory your ADS tools, including anything a vendor operates on your behalf.
Request vendor bias-testing documentation for the specific model version you're using. A generic company-wide statement isn't sufficient.
Run the adverse impact analysis across your actual applicant and employee data.
Document every finding and every corrective step, whether or not a disparity was found.
Build a four-year retention system for the full record, not just the summary conclusion.
If your business uses AI-assisted hiring or evaluation tools and hasn't structured bias testing under privilege, that's a gap worth closing before a claim forces the question.
Our FEHA/EEO Defense team structures this kind of privileged review, working with counsel from the outset rather than reviewing results that a technical team has already generated independently. Reach out to schedule a paid consultation to assess where your current audit practices actually stand.
Conclusion
An AI bias audit isn't a standalone legal requirement under California's FEHA regulations, but the quality, scope, and recency of anti-bias testing directly determine liability in a discrimination claim. This makes a documented audit function as your primary defense rather than an optional best practice.
The actual methodology centers on the adverse impact ratio (the "four-fifths rule"), applied to outcome data segmented by protected characteristic, with every finding and corrective action documented and retained for at least four years.
If your business needs its AI bias testing structured under privilege, DefendMyBiz can help you build that process correctly from the start. Contact our employer defense team to schedule a paid 1-hour consultation.
If you're already facing a discovery dispute, a discrimination claim, or an active inquiry tied to your AI tools, mention that when you reach out, and a free 15-minute consultation is available to assess your specific situation.
Frequently Asked Questions
What is an AI bias audit?
Are AI bias audits required by law in California?
Does California require notifying candidates when AI is used in hiring?
Who is responsible for AI bias compliance: the employer or the vendor?
What is the four-fifths rule?
Disclaimer: The above content is for informational purposes only. This is not legal or tax advice. Laws, IRS guidance, and withholding requirements can change, and outcomes depend on specific facts. You are advised to contact a qualified attorney for any legal advice.
