California AB 331 was a 2023 bill that would have created a broad framework for regulating automated decision tools used in hiring, lending, housing, healthcare, and other high-stakes areas, but it died in Assembly committee on January 31, 2024 without reaching a floor vote.1California Legislative Information. California Assembly Bill 331 Bill History A successor bill, AB 2930, failed the following year. Even so, much of what AB 331 tried to do by statute now applies to California businesses through two sets of regulations that took effect January 1, 2026.
What AB 331 Would Have Required
Introduced in January 2023 by Assemblymember Rebecca Bauer-Kahan, AB 331 targeted any AI-based system developed or modified to make, or serve as a controlling factor in making, what the bill called a “consequential decision.” The bill defined that term broadly to cover decisions with a legal or material effect on someone’s life in eleven categories: employment, education, housing, essential utilities, family planning, healthcare, financial services, criminal justice, legal services, voting, and government benefits.2California Legislative Information. California Assembly Bill 331 – Automated Decision Tools
That scope went well beyond the hiring algorithms most people picture when they think of AI regulation. The bill would also have reached a utility deciding service eligibility, a school using software to flag suspected plagiarism, or a court using a pretrial risk assessment.
Impact Assessments
The centerpiece of the bill was an impact assessment requirement that split responsibility between two groups: developers who build the tools and deployers who use them to make decisions about people. Both would have had to complete an assessment before first use and then annually afterward.3California Legislative Information. California Assembly Bill 331 – Automated Decision Tools – Compare Versions
A deployer’s assessment had to analyze whether the tool could cause harm based on race, sex, age, disability, religion, ethnicity, national origin, veteran status, genetic information, or limited English proficiency, document how a human would oversee the tool, and describe how it had been evaluated for accuracy. Where the deployer’s actual use diverged from the developer’s stated purpose, that gap had to be documented.3California Legislative Information. California Assembly Bill 331 – Automated Decision Tools – Compare Versions Developers faced a parallel set of requirements focused on design-level risks: the tool’s intended purpose, the data it collects, and measures taken to reduce discriminatory outcomes.
The split matters because a developer might sell one hiring algorithm to dozens of employers. AB 331 would have made the developer answer for how it was built and each employer answer for how it performed in their workplace.
Rights for the People Being Scored
AB 331 layered three individual rights on top of the assessment regime. Deployers had to notify people, at or before the decision, that an automated tool was being used and state its purpose.2California Legislative Information. California Assembly Bill 331 – Automated Decision Tools Individuals had to be given a chance to correct inaccurate personal data the tool relied on. And when a decision was made entirely by an automated tool with no human involvement, the deployer had to accommodate a request to opt out and use an alternative process instead, where technically feasible.4Assembly Committee on Privacy and Consumer Protection. AB 331 Bauer-Kahan APCP Analysis
That opt-out had a notable limit: it applied only to fully automated decisions, not those where a human exercised final judgment. A hiring manager who rubber-stamped an algorithm’s recommendation would have been outside the alternative-process right.
Penalties
Noncompliance would have carried administrative fines of up to $10,000 per violation. The bill did not name an enforcement agency, a gap that drew criticism during legislative review.
Why the Bill Failed
AB 331 failed to advance before the constitutional deadline and died in the Assembly on January 31, 2024.1California Legislative Information. California Assembly Bill 331 Bill History Technology industry groups opposed it, arguing the scope was too broad and the annual impact assessments operationally impractical.
A retooled successor, AB 2930, was introduced during the 2024 session and expanded the list of consequential decisions to include government benefits and penalties. It cleared the Assembly but stalled in the Senate and was ordered to the inactive file on August 31, 2024. In the 2025–2026 session, SB 420 picked up the thread, proposing to regulate “high-risk automated decision systems” using the developer-deployer distinction AB 331 established. Its fate is undecided.
What Actually Governs Automated Decision Tools in California Now
While the legislature stalled, two California agencies finalized rules that cover much of the same ground. Both sets took effect January 1, 2026.
FEHA Rules for Automated Employment Decisions
The California Civil Rights Department finalized regulations under the Fair Employment and Housing Act addressing automated decision systems in the workplace.5California Civil Rights Department. Final Text Regulations – Automated Employment Decision Systems It is unlawful for an employer to use an automated system that discriminates against applicants or employees on a protected basis. Employers must:
- Notify applicants and employees that an automated system will be used, including its purpose, the data it collects, and the identity of any third-party vendor providing it
- Provide reasonable accommodations for individuals with disabilities who are subject to automated screening
- Conduct annual assessments for disparate impact on protected groups and address any disparate impact found
These rules are narrower than AB 331 because they stop at employment, but they carry weight: whether an employer conducted bias testing is admissible evidence in discrimination claims, which gives businesses a strong incentive to document their work.
CCPA Rules for Automated Decision-Making
The California Privacy Protection Agency finalized regulations under the California Consumer Privacy Act covering automated decision-making technology, risk assessments, and cybersecurity audits. The Office of Administrative Law approved them on September 22, 2025, with a January 1, 2026 effective date.6California Privacy Protection Agency. CCPA Updates – Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology Covered businesses must conduct risk assessments, complete annual cybersecurity audits, and honor consumer rights to access information about and opt out of automated decision-making.
The CCPA rules apply to any business subject to the CCPA that uses automated decision-making technology affecting consumers, so their reach extends beyond employment into much of what AB 331 would have covered.
What This Means in Practice
California businesses using automated decision tools now face binding obligations from two directions despite AB 331’s failure. Employers must comply with the FEHA automated decision system regulations. Businesses more broadly must comply with the CCPA’s automated decision-making rules, including consumer opt-out rights.
For consumers, the current rules are stronger than AB 331 would have been in one way: the CCPA opt-out is not limited to decisions made solely by an automated tool, while AB 331’s alternative-process right was. In other ways consumers are worse off. There is no single comprehensive framework covering housing, criminal justice, education, or other areas AB 331 named, so recourse when an automated tool produces a harmful decision outside employment and CCPA-covered activity remains thin.
Companies that invested in impact assessments and bias testing in anticipation of AB 331 or AB 2930 are well positioned for the 2026 regulatory deadlines. Those who waited for legislation now face compliance obligations that arrived through rulemaking instead.