Do the California rules require every employer to run a bias audit?

The regulations make evidence of anti-bias testing or similar proactive efforts relevant to claims and available defenses. The rulemaking record gives the evidence a case-specific role tied to the applicable claim or defense. A defensible program tests the actual employment use because the absence, age, scope, quality, result, and response can each affect the evidence available later. Counsel should map the testing plan to the employer's covered system and FEHA obligations.

Does human review remove an employment tool from scope?

A human reviewer's final call leaves the tool in scope when the computational process aids the employment decision. Inventory systems that rank, screen, recommend, route, or prioritize candidates and employees, including tools used before the named decision-maker sees the file. Record how the reviewer used the output and what authority existed to depart from it.

Which records need the four-year retention treatment?

The rulemaking record ties section 11013 to records the employer or other covered entity created or received. Covered automated-decision data can include applicant or employee data used in the application of the system, decision or outcome data, and data used to develop or customize a system for that employer, subject to the final definitions. Build the retention schedule with California employment counsel because the trigger depends on record type and employment action.

California AI Employment Regulations: The CRD Evidence Record

The California Civil Rights Council AI regulations took effect on October 1, 2025. They apply California's employment antidiscrimination rules to a computational process that makes or aids a decision about an employment benefit. That reaches past a fully autonomous hiring model. Resume screening and targeted job advertising can enter scope. So can online interview analysis and applicant assessments, along with some uses of third-party data. The operational burden sits in the record: identify which system ran and what data it used. Preserve the recommendation and the person who acted on it. Keep the bias work that existed at that time.

TL;DR

Effective October 1, 2025, the regulations clarify how the Fair Employment and Housing Act applies to automated-decision systems in employment.
A tool remains in scope when it aids a decision about an employment benefit, including when a human makes the final call.
Covered entities must preserve employment records, including automated-decision system data they created or received, under a four-year rule.
Evidence of anti-bias testing or similar proactive work can be relevant to a claim or defense. Its role is evidentiary and specific to the claim.
An HTTP policy gateway can record and control authenticated LLM requests. Ranking fairness and vendor model internals require separate evidence. So does the legality of a final employment action.

The regulations apply existing FEHA duties to automated decisions

The California Civil Rights Department's June 30, 2025 announcement says the Office of Administrative Law approved the regulations on June 27, 2025. The rules became effective on October 1, 2025. Their function is specific: they clarify how existing Fair Employment and Housing Act protections apply when employers use artificial intelligence or algorithms. Other automated-decision systems are also covered.

That distinction changes the implementation plan. A compliance team should resist treating this as a new AI registration exercise. The relevant question is how a selection practice affects an applicant or employee on a basis protected by FEHA. The system can create exposure through disparate treatment or disparate impact, just as another employment selection criterion can.

I would block any procurement memo that closes with "a human makes the final call." The regulations cover a process that facilitates human decision-making. A recruiter clicking the green "recommended" badge remains part of an automated selection path when the ranking determined which files reached the screen.

The automated-decision system definition reaches the employment workflow

The Council's final regulatory text defines an automated-decision system around a computational process that makes a decision or aids human decision-making regarding an employment benefit. The rulemaking record says the process may use machine learning and algorithms. It may also use statistics or other data processing. Artificial intelligence is included. Coverage therefore turns on the function in the employment workflow, rather than an AI label in a vendor's product sheet.

Examples in the record include computer-based assessments and directing recruiting material to targeted groups. Other examples are screening resumes and analyzing online interviews. The record also names analysis of applicant or employee data acquired from third parties. Passive infrastructure and ordinary software remain outside the definition when detached from making or aiding the employment decision. The Council expanded the exclusions during rulemaking for technologies such as web hosting and caching. Data storage and cybersecurity tools can also be excluded under those conditions. Calculators and spreadsheets complete the list.

Start the inventory at each employment benefit. Map recruitment and screening first. Continue through hiring and promotion, then pay and benefits. Add leave and performance management, followed by discipline and termination. Then identify every computational output that changes who gets seen or scored. Include outputs that determine who gets prioritized or recommended. Record rejections as well. Our broader California AI law compliance guide separates this FEHA rule from the state's privacy and model-developer requirements.

Employers need a joined four-year evidence record

The regulations connect automated-decision data to California's employment-record retention duty. The final statement of reasons explains that Government Code section 12946 requires covered entities to preserve applications and personnel records. Membership records and employment-referral records must also be preserved for at least four years after creation or receipt, or after the employment action. The final rule narrows the duty to records the employer or covered entity created or received.

A useful case file joins five evidence classes:

Decision context: applicant or employee identifier and job or employment benefit. Add the responsible team and decision date.
System context: product and version. Record the configured workflow and input fields, followed by output fields and vendor role.
Decision data: information supplied to the system and the recommendation or score received. Preserve thresholds and the final human action.
Bias evidence: test scope and comparison groups. Preserve the method and results, along with limitations and review date. Add the response to detected disparities.
Governance history: approval and accommodation route. Record each exception and complaint. Preserve every model or configuration change and its retention trigger.

A screenshot of a score is weak evidence. It omits the system version and the candidate data behind the output. A vendor's annual fairness report is also incomplete when the employer changed thresholds or supplied a different applicant population. The archive needs enough detail to reconstruct the selection path four years later.

Anti-bias testing is relevant evidence without becoming a safe harbor

Section 11009 addresses automated-decision systems alongside other selection criteria. The Council's final statement says evidence, or the absence of evidence, of anti-bias testing or similar proactive efforts may be relevant to a claim or available defense. The quality, recency, scope, results, and response all matter. The statement also rejects the idea that testing creates a new defense to intentional discrimination.

That makes a one-page vendor certificate a poor control. Testing should match the employer's use, affected population, job, decision threshold, and current version. Preserve the test plan and failed runs. Record what changed after a disparity appeared. A clean aggregate result can conceal a problem at one stage of the funnel or for an intersectional group, so the review needs decision-stage detail.

The AI bias detection guide covers test design and monitoring. For these California regulations, connect that work to the employment case file. The test identifier should point to the system version and configuration used for the actual decision. If the vendor swaps a model, the old test stays with the old version and a new review trigger opens.

Disability inquiries and accommodations belong in the design

The regulations also clarify that an automated assessment can amount to a medical or psychological examination or a disability-related inquiry. The final statement names a test, question, puzzle, game, or other challenge that is likely to elicit information about a disability. Calling it a "skills assessment" leaves the legal analysis unchanged.

Map what each assessment measures and what it can infer. Reaction time, speech characteristics, facial movement, attention patterns, and personality-style responses can intersect with disability. The workflow needs an accommodation route before the applicant reaches a dead end. Preserve the request, the alternate process offered, and the outcome without exposing disability information to reviewers who lack a need to know.

This is also where a generic human-review promise falls apart. The reviewer needs authority and a usable alternative. Sending the same score to a second recruiter repeats the original mechanism. The record should show which input or assessment was changed, who approved the accommodation, and how the final decision was reached.

Vendor contracts need evidence delivery, not a liability handoff

The regulations define an agent around a person acting for an employer in a function traditionally exercised by the employer or another FEHA-regulated activity. The final statement ties that approach to the California Supreme Court's 2023 Raines decision. A third party can qualify in appropriate circumstances, including when it creates or uses an automated-decision system on an employer's behalf. Software suppliers qualify when their role satisfies that agent test.

Procurement still needs a precise evidence clause. Require version notices, configuration history, applicant-level outputs received by the employer, test documentation, known limitations, accommodation support, incident notice, and export on termination. Assign the four-year retention owner for each record. A deletion clause that wipes the vendor workspace after 90 days can destroy information the employer expected to produce later.

Link the vendor package to the employer's own case record rather than storing a PDF in a separate compliance folder. The AI audit-trail requirements reference explains the fields needed to connect a policy decision, system event, and accountable identity without pretending that one log proves the whole employment decision.

DeepInspect

DeepInspect can govern one bounded part of an employment workflow: authenticated HTTP traffic sent by a user or agent to an LLM endpoint. At that boundary, it can evaluate identity, route, request content, and policy before the request reaches the model. It can also write a per-decision record containing the principal, policy version, decision, and timestamp.

Those records can show that a recruiter was blocked from sending a protected data class to an unapproved LLM, or that a named route applied the policy in force on a given date. Resume-ranking fairness requires separate evaluation evidence. A vendor's internal training process, assessment validity, accommodation handling, and the final employment decision sit outside DeepInspect's HTTP enforcement boundary. Keep the gateway record linked to the larger employment case file and preserve that boundary in every control claim.

Book a technical deep dive at deepinspect.ai.