Approved by the Office of Administrative Law and filed June 27, 2025, and in force since October 1, 2025, the Civil Rights Council's regulations state that using an automated-decision system that discriminates against applicants or employees on a basis protected by the Fair Employment and Housing Act is unlawful. They define ADS broadly (computational processes that make or facilitate employment decisions, including those derived from machine learning or AI), define proxies for protected characteristics, treat anti-bias testing and its results as relevant evidence, extend liability to third parties acting as the employer's agent, and require employers to keep ADS-related records for four years.
| Document | Civil Rights Council ADS employment regulations — Modifications to Employment Regulations Regarding Automated-Decision Systems (Fair Employment and Housing Act regulations, 2 CCR) |
| Issued by | California — Privacy Protection Agency (CCPA/CPRA automated decisionmaking, risk-assessment and cybersecurity-audit regulations), Attorney General, and Civil Rights Council |
| Type | Regulation |
| Status | In force |
| Published | Jun 27, 2025 |
| Effective | Oct 1, 2025 |
| Applies to | Employers with five or more employees, employment agencies and their agents — including vendors of hiring, screening and productivity tools — for any California applicant or employee |
| Official source | calcivilrights.ca.gov ↗ |
| Use cases | Third-party & vendor AI · Data & privacy · AI governance (general) |
What are the key points of Civil Rights Council ADS employment regulations?
- Applies to employers with five or more employees — every bank and credit union with California staff
- ADS covers résumé screening, assessments, targeting of job ads, video-interview analysis and any tool that makes or facilitates decisions on hiring, promotion, pay, discipline or termination
- Discriminatory ADS outcomes violate FEHA; the employer's anti-bias testing — its scope, quality, timing and response to results — is relevant evidence in any claim
- Vendors and other third parties can be liable as agents of the employer when they administer the ADS on its behalf
- Record retention for ADS data, inputs and outputs extended to four years
- Interacts with the CPPA's ADMT regulations, under which employment is a 'significant decision' subject to notice, opt-out or appeal, and access rights from January 1, 2027
What did Civil Rights Council ADS employment regulations change for banks?
For banks the immediate California AI exposure is in HR, not credit: GLBA keeps most lending data outside the CCPA, but hiring and promotion tools sit under both these FEHA regulations and the CPPA's ADMT rules. Vendor contracts, bias testing and four-year retention are now examinable compliance items.
Do California's ADS employment regulations apply to banks?
Yes. They apply to any employer with five or more employees, with no financial-services exemption, and cover vendors acting as the employer's agent.
Is bias testing mandatory under the regulations?
Not expressly — but the regulations make anti-bias testing and its results relevant evidence of whether the employer took reasonable steps, so its absence weighs against the employer in a claim.
| Date | Document | Status |
|---|---|---|
| Sep 22, 2025 | CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6) | In force |
| Jan 13, 2025 | California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence | Final |
| Jun 28, 2018 | Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) — California Consumer Privacy Act — exemptions, including the data-level exemption for information subject to the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act (Civil Code §1798.145) | In force |
| Aug 31, 2026 | FSB Chair's letter to G20 (Aug 2026) — FSB Chair's letter to G20 Finance Ministers and Central Bank Governors: August 2026 — risks arising from frontier artificial intelligence models | Final |
| Aug 11, 2026 | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) | Comment period open |
| Jul 31, 2026 | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models | In force |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →