California's Automated Decision Rules Start January 1, 2027: A Hiring Compliance Guide
Prices and facts checked October 13, 2026. We don't accept payment for rankings.
On this page
What happened: California's privacy agency (CPPA) finalized rules on automated decisionmaking technology (ADMT) in 2025, and the employment obligations begin January 1, 2027, now under three months away (Bass Berry & Sims; Digital Policy Alert). HR Dive flagged them alongside California's new workplace AI laws signed on September 30, 2026 (HR Dive).
Why it matters today: if a covered employer uses a tool that substantially replaces human judgment to screen, rank or decide on candidates, it needs a pre-use notice, an opt-out or appeal path in some cases, and a risk assessment. Recruiters and agencies running those tools on employers' behalf need to be ready too.
Not legal advice. These summaries come from law-firm analyses of Title 11 of the California Code of Regulations. Check the regulation text.
Who's covered
The CCPA applies to businesses doing business in California with over $26.6 million in annual revenue, or that process large volumes of personal data. Small employers, nonprofits and employers with no California applicants or staff are excluded (Littler).
What counts as ADMT
Technology that processes personal information and uses computation to replace, or substantially replace, human decision-making, including profiling tools that predict traits like performance or reliability. Even simple rule-based tools can qualify (Littler).
The key exception: "meaningful human involvement." A tool falls outside the rules if the human decision-maker:
- can interpret the tool's output,
- analyzes it together with other relevant information, and
- has authority to make or change the decision.
Significant decisions include hiring, work assignment, compensation, promotion, demotion and termination.
What employers must do
| Obligation | Detail |
|---|---|
| Pre-use notice | At or before data collection: the tool's purpose, how it works, what personal information affects the output, the output type and how it's used, plus access, opt-out and appeal rights and a non-retaliation statement. Can be embedded in applicant notices |
| Opt-out (hiring) | Can be denied if the ADMT is used solely for hiring, assignment or compensation decisions, assesses ability to perform, and doesn't unlawfully discriminate |
| Appeal (promotion to termination) | No opt-out needed if a meaningful human appeal is offered |
| Access | Plain-language explanation of purpose, logic, output and how it was used, minus trade secrets |
| Risk assessment | Before using ADMT for significant decisions; updated every 3 years or after material changes; executive attestation |
| Submission | Risk assessment summaries for 2026–2027 due to the CPPA by April 1, 2028 |
Sources: Littler; Bass Berry & Sims; CDF Labor Law.
Vendors don't shift liability. Outsourcing the tool doesn't remove the employer's obligations (CDF Labor Law).
How this layers with other California rules
- Civil Rights Council regulations (since Oct 2025): anti-discrimination, 4-year records, vendors as agents (our guide)
- SB 947 (from Jul 2027): no AI-only discipline or firing (our guide)
- Litigation: FCRA and discrimination suits against AI screening vendors (our explainer)
A 90-day plan for recruiters
- List every tool that scores, ranks or filters California candidates, including ATS features and sourcing agents like LinkedIn Hiring Assistant.
- Decide for each: human involvement or ADMT? If a recruiter genuinely reviews outputs with other information and can override, document that process. It may take the tool outside the rules.
- Draft the pre-use notice and add it to job postings or application flows.
- Set up an access-request process and an appeal path.
- Start the risk assessment, with input from vendors and data owners.
- Agencies: agree with clients who sends notices and handles requests.
FAQ
Does a recruiter skimming AI rankings count as "meaningful human involvement"?
Probably not if they just approve the ranking. The test requires interpreting the output, weighing other information and having authority to change the result.
Do small agencies need to comply?
Only if they meet the CCPA thresholds. Your clients may still require it contractually.
Is this the same as the Colorado law?
No. Colorado's SB 26-189 also starts January 1, 2027, with similar notice and human-review ideas but different details (our Colorado guide).
Sources
Pages we used for this article, checked on or before the update date above.
- Bass Berry & Sims · bassberry.com
- Digital Policy Alert · digitalpolicyalert.org
- HR Dive · hrdive.com
- Littler · littler.com
- CDF Labor Law · cdflaborlaw.com
Changelog: Oct 13, 2026: first published.