Artificial intelligence has quietly become part of how work gets done. Employees are using it to draft emails, summarize documents, build spreadsheets, and answer customer questions — often without anyone in management deciding that should happen. For employers, the question is no longer whether AI is in the workplace. It is whether it is being used on the company’s terms, with the right guardrails in place.
California has also moved quickly. New regulations now govern how employers can use AI in employment decisions, and existing confidentiality and privacy obligations apply to AI just as they apply to everything else. A clear, written AI policy is the most practical way to encourage productive use while managing the risks. Here are five reasons every California employer should have one.
1. New California regulations now govern AI in employment decisions
Effective October 1, 2025, the California Civil Rights Council adopted regulations under the Fair Employment and Housing Act (FEHA) addressing “automated-decision systems” (ADS) — broadly, any computational tool that makes or helps make employment decisions. (2 Cal. Code Regs., tit. 2, §§ 11008.1 et seq.)
The regulations confirm that using an AI tool to assist with hiring, screening, scheduling, evaluations, promotion, or discipline can violate California law if it produces discriminatory results — whether intentionally or through disparate impact — based on protected characteristics. Three points stand out for employers: the rules require retaining ADS-related data for at least four years; liability extends to the employer even when the tool comes from a third-party vendor; and bias testing of a tool is treated as relevant evidence supporting an employer’s defense, while the absence of testing can be used against you. A policy requiring meaningful human review before AI drives any employment decision is the necessary first step.
2. AI can compromise confidential information and trade secrets
This is the risk that catches most employers off guard. Many AI tools store the information users submit, process it on outside servers, and may use it to train the underlying model. When an employee pastes pricing, recipes, formulas, supplier terms, or business strategy into a public AI tool, the company can lose control of that information.
That creates two problems. Information generally qualifies for trade secret protection only if the company takes reasonable steps to keep it secret, and disclosing it to a public AI tool can be treated as a failure to do so. Separately, most employers owe confidentiality obligations to their own customers, guests, and vendors under contracts and nondisclosure agreements — and disclosing that information to an AI tool can breach those agreements. A policy that prohibits entering confidential information into any AI tool without approval draws the line before the leak happens.
3. Employee and customer privacy obligations still apply
Feeding personal information about employees, customers, or guests into an AI tool implicates California’s privacy laws, including the CCPA and CPRA. The fact that the information is being handed to software rather than a person does not change the obligation to protect it. A policy should make clear that personal information does not go into an AI tool unless the specific use has been approved and the tool meets the company’s security and privacy requirements.
4. Accuracy and accountability cannot be outsourced
AI tools produce confident, polished output that is sometimes inaccurate, incomplete, or entirely fabricated. The employer inherits those errors — in internal work product, in customer communications, and, in some well-publicized cases, in documents filed with courts and agencies. “The AI said so” is not a defense.
A good policy makes employees responsible for verifying anything they rely on and treats AI output as a first draft rather than a final answer. That single expectation, communicated clearly and in writing, prevents a great deal of avoidable trouble.
5. Your employees are already using it
The most important reason may be the simplest. Employees are already using AI at work whether or not their employer has authorized it — often through personal accounts on personal devices. A 2025 Cybernews survey of more than 1,000 U.S. employees found that 59% use AI tools their employer never approved, and that 75% of those workers admit to sharing potentially sensitive information — including employee data, customer details, and internal documents — with those tools. This “shadow AI” is the real status quo. Without leaning into AI, providing safe AI tools for employees to use, and developing an AI policy, employers have no notice of what tools are in use, no monitoring, and no documented expectation that company AI activity is tracked and stored like other technology.
A policy does not stop employees from using AI. It channels behavior that is already happening into approved tools, with clear rules, monitoring, and a stated lack of any expectation of privacy when using company systems. That is far better than learning about a problem after the fact.
A practical next step
An AI policy does not need to be long or complicated to be effective. It should encourage employees to use approved tools, prohibit putting confidential information into AI without approval, require human review of AI-assisted employment decisions, and make clear that company AI use is monitored. We have prepared a model AI use policy and a one-page employee quick guide that our clients are using to put these protections in place. If you would like to discuss adopting a policy for your business — or you are already using AI in any part of your hiring or HR process and want to assess your exposure under the new FEHA regulations — we are happy to help.









