California Assembly Bill 331 was a proposed law that would have created one of the most sweeping state frameworks for regulating automated decision tools, requiring impact assessments, consumer notices, and opt-outs across eleven areas of life. Introduced in January 2023 by Assemblymember Rebecca Bauer-Kahan, it died in committee on January 31, 2024 without reaching a floor vote.1California Legislative Information. California Assembly Bill 331 Bill History A retooled successor, AB 2930, failed the following year. Even so, the framework AB 331 proposed has largely arrived in California through regulation rather than legislation, with new rules under the Fair Employment and Housing Act and the California Consumer Privacy Act taking effect January 1, 2026.
What the Bill Would Have Covered
AB 331 applied to any system using artificial intelligence that was developed or modified to make, or serve as a controlling factor in making, what the bill called a “consequential decision.”2California Legislative Information. California Assembly Bill 331 – Automated Decision Tools The definition was broad. A consequential decision was any decision with a legal or material effect on someone’s life in one of eleven categories:
- Employment, including hiring, firing, pay, promotion, and automated task assignments
- Education, including admissions, financial aid, accreditation, and plagiarism detection
- Housing, including rental and short-term lodging
- Essential utilities, including electricity, water, heat, internet access, and transportation
- Family planning, including adoption, reproductive services, and child protective services assessments
- Healthcare, including medical care, health insurance, mental health, dental, and vision
- Financial services, including mortgage lending and credit
- Criminal justice, including pretrial risk assessments, sentencing, and parole
- Legal services, including private arbitration and mediation
- Voting
- Access to government benefits or assignment of penalties
The scope reached well beyond hiring algorithms. A utility using an automated tool to decide service eligibility, or a school using AI to flag suspected cheating, would have fallen within the bill’s reach.
Impact Assessments
The core mechanism was an annual impact assessment, required before a tool was first used and every year afterward.3California Legislative Information. California Assembly Bill 331 – Automated Decision Tools – Compare Versions The bill split obligations between two roles.
Deployers, meaning the companies actually using a tool to make decisions about people, had to complete assessments documenting the tool’s purpose, the personal data it processed, how its outputs shaped real decisions, and the safeguards against discrimination. Deployers had to analyze whether the tool could cause harm based on race, sex, age, disability, religion, ethnicity, national origin, veteran status, genetic information, or limited English proficiency. They also had to explain how humans would oversee the tool and document any divergence between how they used the tool and the purpose the developer described.
Developers, meaning the companies building the tools, had their own parallel assessments describing intended purpose, data collected, and measures taken to reduce discriminatory outcomes. The split mattered because a single developer might sell one hiring algorithm to dozens of employers. Under AB 331, the developer would have been accountable for design-level risks and each employer for how the tool performed in context.
Rights the Bill Would Have Given Consumers
AB 331 layered three individual rights on top of the assessment framework.
Deployers had to notify individuals that an automated decision tool was being used before or at the time the decision was made, along with a statement of the tool’s purpose.2California Legislative Information. California Assembly Bill 331 – Automated Decision Tools Individuals had to be given an opportunity to correct any personal data the tool relied on. And where a consequential decision was made entirely by an automated tool with no human involvement, the deployer had to accommodate a request to opt out and use an alternative process instead. That opt-out came with two important limits: it only applied to fully automated decisions, not those in which a human exercised final judgment, and the alternative had to be technically feasible to offer.4Assembly Committee on Privacy and Consumer Protection. AB 331 Bauer-Kahan APCP Analysis
Penalties
Violations would have triggered administrative fines of up to $10,000 per violation for both deployers and developers. The bill did not name a specific enforcement agency, a gap that drew attention during legislative debate over whether the framework could be workably enforced.
Why It Failed
AB 331 failed to advance before a constitutional deadline and died in the Assembly on January 31, 2024.1California Legislative Information. California Assembly Bill 331 Bill History Technology industry groups had opposed it, arguing the scope was too broad and the annual assessment mandate operationally impractical for companies of varying sizes.
Bauer-Kahan reintroduced the framework as AB 2930 in the 2024 session, expanding the list of consequential decisions to include government benefits and penalties. That version cleared the Assembly but stalled in the Senate, where it was ordered to the inactive file on August 31, 2024 at the request of Senator Umberg. In the 2025–2026 session, SB 420 picked up the thread with a similar framework aimed at “high-risk automated decision systems,” borrowing the developer-deployer distinction AB 331 established.
What Replaced It Through Regulation
While the legislature stalled, two California agencies moved on parallel tracks. Both sets of rules took effect January 1, 2026 and together cover much of the ground AB 331 tried to claim.
FEHA Employment Rules
The California Civil Rights Department finalized regulations under the Fair Employment and Housing Act aimed specifically at automated decision systems in the workplace.5California Civil Rights Department. Final Text Regulations – Automated Employment Decision Systems It is unlawful for an employer to use an automated system that discriminates against applicants or employees on a protected basis. Employers must:
- Notify applicants and employees that an automated system will be used to assess them, including its purpose, the data it collects, and any third-party vendor providing it
- Provide reasonable accommodations for individuals with disabilities subject to automated screening
- Conduct annual assessments for disparate impact based on protected characteristics and take steps to address any disparate impact found
The rules apply only to employment decisions, a narrower scope than AB 331 proposed, but they connect to existing anti-discrimination remedies. Complaints can be filed with the Civil Rights Department and civil suits can proceed under the FEHA. Whether an employer conducted bias testing is admissible as evidence in discrimination claims.
CCPA Automated Decision-Making Rules
The California Privacy Protection Agency finalized separate regulations under the California Consumer Privacy Act. Approved by the Office of Administrative Law on September 22, 2025 and effective January 1, 2026, they require certain businesses to conduct risk assessments, complete annual cybersecurity audits, and honor consumer rights to access information about and opt out of automated decision-making technology.6California Privacy Protection Agency. CCPA Updates – Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology The CCPA rules are broader than the FEHA rules because they reach any business subject to the CCPA that uses automated decision-making in ways affecting consumers, not just employers.
What It Means Now
AB 331 itself is not law and will not become law. But California businesses using automated decision tools face binding obligations from two regulatory directions. Employers must meet the FEHA notice, accommodation, and annual assessment requirements. Businesses subject to the CCPA must meet its automated decision-making rules, including consumer opt-out rights.
For consumers, one piece of the current framework is actually wider than AB 331 would have been. The CCPA opt-out right is not limited to decisions made solely by an automated tool, whereas AB 331’s alternative-process right would have applied only where no human was involved. What consumers do not have is the single comprehensive framework AB 331 envisioned, so recourse in areas like housing, criminal justice, and education remains limited compared with what the bill would have provided.