California has expanded its regulation of workplace artificial intelligence beyond the automated decision-making technology (ADMT) provisions of the California Consumer Privacy Act (CCPA), according to a new analysis published by Lexology.

The development signals that employers deploying AI in California now face a regulatory perimeter that reaches further than the CCPA's ADMT framework alone. For compliance teams, that means the CCPA rulemaking on automated decision-making — long treated as the principal compliance benchmark for workplace AI in the state — no longer marks the outer boundary of exposure.

Why does this matter for employers?

The CCPA, as amended by the California Privacy Rights Act, obliges businesses to handle consumer personal data under a set of statutory duties. Its ADMT provisions, developed through California Privacy Protection Agency rulemaking, govern how businesses use automated decision-making technology — including tools used in hiring, promotion, and workforce management.

The new regulatory expansion described in the Lexology analysis means workplace AI in California is now caught by additional rules sitting outside that privacy-law framework. Employers who structured compliance programs solely around CCPA ADMT obligations may find those programs incomplete.

What should practitioners do now?

For legal teams advising California employers, the practical consequence is straightforward: audit the full inventory of workplace AI tools — not only those that process personal information in ways triggerable under the CCPA, but any system touching employment decisions, monitoring, or workforce analytics.

Recommended steps include:

• Mapping all AI tools used in hiring, evaluation, monitoring, and management functions.
• Assessing which tools fall within CCPA ADMT scope and which fall under the newly extended regulatory reach.
• Reviewing vendor contracts and allocation of compliance responsibility.
• Updating employee notices and internal policies to reflect the broader rule set.

Lexology's analysis, titled "California Just Expanded Regulation of Workplace AI Beyond CCPA ADMT," frames the shift as a material change for employment and privacy practitioners advising clients with California workforces.

What comes next?

California remains the most active US state jurisdiction on AI oversight. Employers operating there should expect continued rulemaking and enforcement activity across both privacy and employment channels, and should treat CCPA ADMT compliance as a floor rather than a ceiling.

Practitioners advising multistate employers will need to track how California's expanded approach interacts with AI laws in other jurisdictions, including Colorado's AI Act and local New York City rules on automated employment decision tools.