In 2025, the California Privacy Protection Agency finalized regulations under the California Consumer Privacy Act that govern automated decision-making technology, which the rules call ADMT. Most of the early coverage focused on consumer uses such as lending and housing. The rules also reach hiring, and the compliance date for employers already using these tools is now less than three months away. The agency's announcement put it in one sentence: "Businesses that use ADMT to make significant decisions must comply with the ADMT requirements beginning January 1, 2027."

On October 8, 2026, the law firm Squire Patton Boggs published a survey of state obligations for employers that use AI in human resources. It lists the CCPA ADMT regulations as "in force January 1, 2027," alongside new or amended laws in California, Colorado, Connecticut, and Delaware. For California hiring teams, this is the next deadline on the calendar.

This Is Not the Rule We Covered Before

We have written about California's automated-decision system regulations under the Fair Employment and Housing Act, issued by the Civil Rights Council, and about Senate Bill 947, which addresses automated discipline and termination decisions. The CCPA regulations come from a different regulator, under a different law, with different obligations. They do not replace the earlier rules. Littler, reviewing the two sets of definitions, observes that although they differ in some respects, "the two definitions largely overlap." The same screening tool can fall under both.

What Counts as a Hiring Decision

The regulations apply when ADMT is used to make a "significant decision." That term includes "employment or independent contracting opportunities or compensation," which the regulations define to cover hiring; allocation or assignment of work and compensation; promotion; and demotion, suspension, and termination.

Not every employer is covered. According to Littler, the regulations generally apply only to businesses that do business in California and either have gross annual revenues exceeding $26.6 million or process large volumes of personal data. Littler adds: "Small employers, non-profit organizations, and employers that do not have applicants, employees, or independent contractors in California need not comply with the CCPA or its regulations." Staffing firms and mid-size employers that screen large applicant volumes should confirm where they stand with counsel rather than assume.

The Test That Decides Most Cases: Human Involvement

The regulations define ADMT as technology that processes personal information and uses computation "to replace human decisionmaking or substantially replace human decisionmaking." The second half of that phrase is the part a hiring team can act on. Under section 7001, to substantially replace human decisionmaking "means a business uses the technology's output to make a decision without human involvement." The regulation then spells out what human involvement requires. The reviewer must:

"(A) Know how to interpret and use the technology's output to make the decision; (B) Review and analyze the output of the technology, and any other information that is relevant to make or change the decision; and (C) Have the authority to make or change the decision based on their analysis in subsection (B)."

Read that against how many screening setups run in practice. A system that rejects every applicant below a score threshold, with no one looking at the rejected resumes, has no human involvement in those rejections. A recruiter who receives a ranked list, opens the resumes, and decides whom to call is in a different position. Littler states the consequence directly: "employers can remove such technologies (as well as more sophisticated AI technologies that infer or learn) from the ADMT regulations entirely by ensuring that employment decisions are made with meaningful human involvement."

All three elements matter. A reviewer who approves whatever the tool recommends, who sees only a score and not the resume behind it, or who has no authority to override the result does not meet the test.

If a Tool Does Make the Decision

Where a tool does decide outcomes on its own, the regulations require several things before January 1.

A pre-use notice. Applicants must receive a notice that explains the specific purpose of the ADMT. The regulation is explicit that a vague label will not do: "The business must not describe the purpose in generic terms, such as 'to make a significant decision' without further information, because this does not describe to the consumer the specific decision for which the business plans to use ADMT with respect to them." The notice must also describe the right to opt out or to appeal, the right to access information about the ADMT, the prohibition on retaliation, and how the ADMT works, including how the decision would be made if the applicant opts out. The regulation's own example of an output is telling for hiring teams: "numerical scores of compatibility."

An opt-out, or a qualifying exception. Applicants generally have the right to opt out, but the regulations allow exceptions. One is a human appeal: the business provides "a method to appeal the decision to a human reviewer who has the authority to overturn the decision." Another applies specifically to hiring, and only when both conditions are true: the business uses the ADMT "solely for the business's assessment of the consumer's ability to perform at work," and "The ADMT works for the business's purpose and does not unlawfully discriminate based upon protected characteristics." That second condition calls for evidence, not a vendor's assurance. As the Squire Patton Boggs survey puts it, "bias and risk assessments are prudent even when not expressly required."

A risk assessment, and records. According to the Squire Patton Boggs survey, CCPA risk assessments must be kept for as long as the processing continues or for five years after the assessment is completed, whichever is later, and must be reviewed at least every three years, or within 45 calendar days of a material change. Records of consumer requests must be kept for 24 months. Separately, Littler notes that the Fair Employment and Housing Act regulations generally require employers to keep the inputs to and outputs from automated-decision systems for four years.

What to Do Before January 1

Inventory every tool that touches applicants. That includes resume scoring and ranking, filters, chatbot screeners, assessments, and the knockout questions in your applicant tracking system. For each one, write down the exact point where its output becomes an outcome for a candidate.

Find the decisions no person makes. Automatic rejections, automatic advancement to the next stage, and rankings that cut a list before anyone reads it are the places to look first.

Decide, for each one, whether to redesign or comply. Redesign means a trained reviewer who sees the output and the full application, and who has authority to change the result. Comply means the notice, the opt-out or exception, and the risk assessment. Either path is a choice; drifting into January with neither is not.

Ask your vendors for evidence. Request plain documentation of how each tool reaches its output and the results of any bias or adverse impact testing. If a vendor cannot provide them, that is a finding in itself.

Train and document the reviewers. Human involvement is a practice, not a setting. Record who reviews, what they see, and how often they change the tool's recommendation.

Set the retention clock. Align record retention with the longest period that applies to you, and confirm the details with counsel.

Where TrueScan HR Fits

TrueScan HR was built to support the person making the call, not to replace them. It scores a resume against the job and shows the matched and missing skills behind the score, so the reviewer can see why a candidate scored as they did and disagree when the resume tells a different story. That design lines up with the human involvement test. The test, though, is about how your team uses any tool, including ours. A score that no one reads past is still a decision made without a person. You can see how the scoring works in How TrueScan HR Scores a Resume.

The Bottom Line

California's privacy regulator has drawn a clear line: technology that makes hiring decisions without meaningful human involvement carries notice, opt-out, and risk assessment obligations starting January 1, 2027. The most practical question for a hiring team is not which tool it uses, but where in the process a person with authority actually reads the application. Answer that for every tool now, while there is still time to change the answer.

This post is general information, not legal advice. Confirm how the regulations apply to your organization with employment or privacy counsel.

California AI Hiring Guides

Practical guides to each piece of California's automated-decision rules for hiring:

Free download: the one-page California AI Hiring Compliance Checklist, with the regulation section behind every item. Get the checklist

Sources: