California's AI Hiring Regulations Explained: FEHA Compliance for Automated Decision Systems
FEHA / EEO Defense
California's AI hiring law doesn't just regulate your hiring software. It also affects the third parties that provide or operate those tools on your behalf. The Civil Rights Council's Automated-Decision System regulations, in effect since October 1, 2025, extend FEHA liability to any vendor, recruiter, or staffing agency acting as your "agent."
This means the contract you signed with your applicant tracking vendor is now part of your compliance picture, not just a procurement decision. This guide explains what the regulation defines, where vendor liability actually lands, and what your contracts need to say.
Key Takeaways
An Automated Decision System is broadly defined to include any computational process that assists in an employment decision. Resume screeners, assessment tools, and scheduling software all qualify, while basic word processing and spreadsheet tools don't.
A "proxy," a neutral-seeming characteristic correlated with a protected class, can create liability even without any tool ever referencing race, age, or disability directly.
Vendors, recruiters, and staffing agencies acting as an employer's "agent" under FEHA may be treated as employers for liability purposes.
Liability doesn't attach to a vendor merely for building or selling an ADS tool; it attaches only when they perform an actual employment function on your behalf.
Pre-offer assessment tools that elicit disability-related information can constitute an unlawful medical inquiry, separate from any discrimination claim.
Four years of ADS-related recordkeeping are required across the full employment lifecycle, including hiring, promotion, compensation, discipline, and termination, not just hiring.
What Counts as an "Automated-Decision System" Under FEHA
The regulations, codified at 2 Cal. Code Regs. §11008.1 and following, define an Automated-Decision System (ADS) precisely:
"A computational process that makes a decision or facilitates human decision-making regarding an employment benefit, which may be derived from and/or use artificial intelligence, machine-learning, algorithms, statistics, and/or other data processing techniques."
That definition is intentionally broad; it explicitly covers resume screeners, interview-analysis software, scheduling tools that weigh availability scores, and any assessment game, puzzle, or challenge used in hiring. It does not cover basic word processing, spreadsheet software, or map navigation tools, which the regulations explicitly carve out.
Two other defined terms matter as much as "ADS" itself:
"Proxy" (§11008(l)): a technically neutral characteristic or category correlated with a protected class. A tool that screens for "gaps in employment history" or "commute distance" can serve as a proxy for age, disability, or national origin, even without directly referencing any protected category.
The business necessity defense (§11017(e)): a facially neutral ADS tool that produces an adverse impact on a protected class is unlawful unless the employer can show the selection practice is job-related and consistent with business necessity. The same standard FEHA has long applied to other selection criteria and is now explicitly extended to algorithmic tools.
If you want the fuller picture of what FEHA covers beyond AI specifically, our guide on what FEHA actually is and how it works is the foundational piece worth reading alongside this one.
The Part Most Employers Miss: Your Vendor Can Be an "Employer" Too
This is where the regulations do something genuinely unusual, and it's the detail that should change how you approach every AI vendor contract you sign.
The regulations define "agent" broadly: any person acting on behalf of an employer, directly or indirectly, to exercise a function traditionally performed by the employer, including applicant recruiting, screening, hiring, or decisions about benefits and leave, even when performed in whole or in part through an ADS. Under FEHA, an agent is itself deemed an "employer," meaning a staffing agency, recruiting platform, or vendor performing these functions on your behalf can be sued directly.
The important limit: the regulations do not create liability for a vendor merely for designing, developing, or selling an ADS tool. A company that builds AI hiring software isn't automatically an "agent" just because you bought its product.
Liability attaches when that vendor or its tool, acting on your behalf, actually performs an employment function: screening, ranking, or scoring your applicants. That distinction matters when you're deciding which vendor relationships actually need the contract protections below, and which don't.
The Medical Inquiry Trap Almost Nobody Flags
FEHA has long prohibited medical or psychological examinations before a conditional job offer. The regulations extend that prohibition explicitly to ADS tools. This means a pre-offer assessment game, personality test, or "challenge" that's likely to elicit information about a disability may itself constitute an unlawful medical inquiry, independent of any discrimination claim.
If your hiring process includes any pre-offer assessment beyond a straightforward skills test, reaction-time games, personality profiling, or similar tools, that's worth a specific compliance check, separate from the broader discrimination analysis.
Watch: California AI Compliance Update - a direct breakdown of what these regulations require if you're using AI for hiring or other business decisions.
Structuring Vendor Contracts to Allocate Liability
Since your agents can be independently liable and you remain liable for their conduct regardless, your vendor contracts are now a primary compliance tool rather than boilerplate. Based on how the regulations define agent liability, here's what a defensible vendor agreement needs:
Contract Element | What It Should Cover |
|---|---|
Compliance warranty | The vendor affirmatively warrants its tool complies with the FEHA ADS regulations, including anti-bias testing |
Testing transparency | The vendor discloses anti-bias testing results for the specific model version you're using, not a generic company-wide statement |
Indemnification | The vendor indemnifies you for claims arising from the tool's discriminatory output, not just general negligence |
Data and recordkeeping support | The vendor can produce four years of scoring outputs, dataset descriptors, and audit findings on request |
Change notification | The vendor notifies you before deploying a new model version, with updated bias testing before it goes live |
Termination rights | You can exit the agreement if the vendor can't produce required compliance documentation |
Human review | Vendor explains when human review is required and what documentation accompanies AI recommendations. |
Generic SaaS boilerplate rarely covers these points, because most vendor agreements were drafted before this regulation existed. If your current contracts predate October 2025, that represents a meaningful compliance gap.
What This Means for Your Recordkeeping
The regulations require retaining ADS-related records, such as inputs, scoring criteria, and outputs, for 4 years, and this obligation spans the full employment lifecycle: hiring, promotion, compensation, discipline, and termination decisions that are assisted by automated tools.
If a claim arises and you can't reconstruct how a tool scored or ranked a candidate, the absence of that record may significantly weaken your defense. The regulations specifically treat a lack of anti-bias testing or documentation as relevant evidence in a discrimination claim.
What HR Teams Are Discussing About AI Hiring Compliance
A recurring concern and topic of discussion on Reddit is recordkeeping.
HR teams are increasingly discussing how to retain evidence of model versions, bias testing, human review, and hiring decisions so they can explain an AI-assisted employment decision if it's challenged later. Those discussions closely mirror California's FEHA ADS regulations, which place significant weight on documentation and employer accountability, even when third-party vendors are involved.
California employers should view AI hiring as a governance and documentation issue rather than just a technology purchase.
Your Compliance Checklist
Inventory every ADS in use, including tools your vendors run on your behalf, not just software you built or licensed directly.
Classify each vendor relationship as an "agent" or not, based on whether they're performing an actual employment function (screening, ranking, scoring) versus simply providing a tool you control.
Pull every vendor contract for agent-classified relationships and check it against the six elements above.
Confirm your recordkeeping covers the full employment lifecycle, not just hiring decisions.
Flag any pre-offer assessment tool for a separate medical inquiry review, beyond the discrimination analysis.
Have counsel review contracts predating October 2025 before renewing them as-is.
Document every bias assessment performed by vendors.
If any part of your hiring stack runs through a vendor and you're not sure whether that relationship creates agent liability, that's exactly the kind of gap worth resolving before a claim forces the answer. Our FEHA / EEO Defense team reviews AI-related hiring and vendor arrangements for this specific exposure.
Watch: Bots Are Here, and They're Ready to Work - worth a look for the bigger picture on how quickly automated tools are moving into roles that used to be entirely human-run, and why the legal framework is racing to catch up
Conclusion
California's FEHA Automated-Decision System regulations extend employer liability to vendors, recruiters, and staffing agencies acting as your "agent." This means a third party performing a screening, ranking, or hiring function on your behalf can be independently liable, while you remain liable for their conduct regardless.
The regulations don't create liability for a vendor simply because they built or sold you an AI tool; liability attaches specifically to the party performing the employment function.
If your vendor agreements haven't been reviewed against these regulations, DefendMyBiz can assess your hiring stack and contracts as a whole. Book a free 15-minute consultation with our employer defense team.
Frequently Asked Questions
What is California's AI hiring law?
Can my AI vendor be sued directly, or just me?
Is my company liable just for buying AI hiring software?
What should my AI vendor contracts include?
Can a hiring assessment tool violate FEHA even without discriminating?
Disclaimer: The above content is for informational purposes only. This is not legal or tax advice. Laws, IRS guidance, and withholding requirements can change, and outcomes depend on specific facts. You are advised to contact a qualified attorney for any legal advice.
