As businesses integrate artificial intelligence (\u201cAI\u201d) and automated decision systems (\u201cADS\u201d) into business operations, they must be cognizant of California\u2019s new AI employment laws targeting the implementation and use of automated decision systems in their operations, practices, and procedures. <\/p>\n
On September 30, 2026, Governor Newsom signed Senate Bill 947 dubbed \u201cNo Robo Bosses\u201d bill, which becomes operative on July 1, 2027. (See
\nStats. 2026, ch. 859, adding Lab. Code, \u00a7\u00a7 1520\u20131526.7.) This law joins two sets of laws related to automated decisions systems that are already in effect, including the Civil Rights Council’s regulations on “automated-decision systems” under the Fair Employment and Housing Act (\u201cFEHA\u201d), which has been in effect since October 1, 2025 and the California Privacy Protection Agency’s regulations on “automated decisionmaking technology” under the California Consumer Privacy Act (CCPA), which requires compliance by January 1, 2027. (See Cal. Code Regs., tit. 2, \u00a7 11008.1; Cal. Code Regs., tit. 11, \u00a7 7200(b).)<\/p>\n
All three of these laws, the FEHA regulations, the CCPA regulations, and SB 947, reach different employers, define covered technology differently, and are enforced by different agencies, but they all regulate the HR decision about an applicant and\/or employee wherein an AI software tool helped, assisted, and\/or made the decision. Employers who treat them as three separate checklists run the risk of creating inconsistent documents that plaintiffs\u2019 attorneys will exploit. One process, built around documented and human review, can satisfy all three. <\/p>\n
CDF updated you on each. See SB 947 (Inside SB 947, Sept. 3, 2026<\/a>), the FEHA regulations (Apr. 4, 2025<\/a>; Aug. 22, 2025<\/a>), the CCPA ADMT regulations (Aug. 11, 2025<\/a>), and the full slate of 2027 employment laws (Oct. 16, 2026<\/a>). <\/p>\n Which Employers Do These Laws Apply To?<\/p>\n The laws reach different sets of employers, and some employers are covered by all three.<\/p>\n SB 947-AI Automated Decisionmaking \u2014every California employer irrespective of size. An “employer” is any person who “directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, hours, or working conditions of any person.” (Lab. Code, \u00a7 1520(d)(3)(A).) The definition also generally includes state and local public entities and labor contractors. (Id., \u00a7 1520(d)(3)(B)\u2013(D).) The law protects employees (i.e., \u201cany person employed by an employer\u201d) and does not apply to employees covered by a collective bargaining agreement that meets the statute’s waiver requirements, or to certain federally required aerospace and defense uses. (Lab. Code \u00a7\u00a7 1520(d)(2),1526.5, 1526.6.). FEHA regulations \u2014 most California employers. The differences matter:<\/p>\n SB 947 [July 1, 2027]. An “automated decision system” (\u201cADS\u201d) is “any computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons.” (Lab. Code \u00a7 1520(c).) An \u201cADS output\u201d is \u201cany information, data, assumptions, predictions, scoring, recommendations, decisions, or conclusions generated by an ADS.\u201d (Id., \u00a7 1520(a).) The law excludes spam filters, firewalls, antivirus software, identity and access management tools, calculators, databases, datasets, and other compilation data. (Id., \u00a7 1520(c).)FEHA regulations [in effect now]. Under FEHA, it is unlawful to use an automated-decision system “that discriminates against an applicant or employee or a class of applicants or employees on a basis protected by the Act, subject to any available defense.” (Cal. Code Regs. tit. 2, \u00a7\u00a7 11009, subd. (f); see also Id., \u00a7\u00a7 11038 (b), 11063 (b).) Intent is not required. \u201cRelevant to any such claim or available defense is evidence of anti-bias testing or similar proactive efforts to avoid unlawful discrimination, including the quality, efficacy, recency, and scope of such effort, the results of such testing or other efforts, and the response to the results.\u201d (Cal. Code Regs. tit. 2 \u00a7 11009 (f).)<\/p>\n ADS used to measure skill, dexterity, or reaction time, or analyze tone of voice, physical characteristics, or facial expressions, during the hiring process (i.e., application, interview, or other screening process) may discriminate against applicants based on protected characteristics, which may trigger reasonable-accommodation obligations. (Id., \u00a7 11016(c)(5), (d)(1).) <\/p>\n An ADS tool that is facially neutral but has an adverse impact on a protected group is permissible only if the selection process is job-related and consistent with business necessity. (Id., \u00a7 11017, subds. (a), (e); see also id., \u00a7 11010 (b) [definition of business necessity].)<\/p>\n Employers must keep “automated-decision system data,” including the data used in and produced by the ADS tool for four years. (Id., \u00a7\u00a7 11008.1(d) & 11013(c).)<\/p>\n Vendors and service providers do not absorb this risk. A vendor that acts on an employer’s behalf in recruiting, screening, hiring, promotion, or pay, benefit, or leave decisions, “including when such activities and decisions are conducted in whole or in part through the use of an automated decision system,” is the employer’s agent, and “[a]n agent of an employer is also an ’employer\u2019 for purposes of [FEHA].” (Id., \u00a7 11008(a).) The California Supreme Court has held that a business-entity agent with at least five employees can be directly liable under FEHA, and that this “neither delegates the employer’s FEHA obligations nor abrogates the employer’s FEHA liability.” (Raines v. U.S. Healthworks Medical Group CCPA: Advance Notice And Opt-Out Requirements Start January 1, 2027<\/p>\n The CCPA ADMT regulations are narrower than FEHA in one critical respect. ADMT means technology that “processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking.” (Cal. Code Regs., tit. 11, \u00a7 7001(e).) A tool substantially replaces human decisionmaking when its output is used to decide without human involvement. Human involvement requires a reviewer who knows how to interpret and use the output, reviews and analyzes it along with any other relevant information, and has authority to make or change the decision. (Id., \u00a7 7001(e)(1).)<\/p>\n The CCPA\u2019s ADMT regulations apply when a covered business uses ADMT to make a “significant decision.” (Id., \u00a7\u00a7 7001(ddd), 7221 (a).) For employment, a \u201csignificant decision\u201d is when it is regarding hiring, allocation or assignment of work, salary, hourly or per-assignment compensation, bonuses, benefits, promotion, demotion, suspension, and termination. (Id., \u00a7 7001(ddd) (4).) For practical steps on risk assessments and AI governance, see our blog: AI in the Workplace: Managing Bias, Privacy and Legal Risk<\/a> (June 3, 2026).<\/p>\n When ADMT is used to make a “significant decision,” the rules impose three duties. <\/p>\n Pre-Use Notice. Any business that uses ADMT, must provide consumers with a pre-use notice, either at or before either collecting or processing a consumer\u2019s personal information, informing the consumer about the business\u2019s use of ADMT, specific purpose of the ADMT, how the ADMT works to make significant decisions about the consumers, the consumer\u2019s right to opt out or appeal (or the exception relied on), the consumer\u2019s right to access ADMT information, and the prohibition on retaliation. (Cal. Code Regs. tit. 11, \u00a7 7220, subds. (a)\u2013(c), see also id., \u00a7 7003, 7222(a).)Opt-Out. A covered business must provide employees and applicants with the ability to opt-put of the use of ADMT to make significant decisions. (id., \u00a7 7221(a).) No opt-out is required (1) if the business offers an appeal to a qualified human reviewer with authority to overturn the decision, (2) if the tool is used solely to assess the consumer\u2019s ability to perform at work or in an educational, program to determine whether to admit, accept, hire the consumer, (3) if the tool is used solely for the allocation\/assignment of work or compensation, or (4) if the ADMT tool \u201cworks for the business\u2019s purpose and does not unlawfully discriminate based upon protected characteristics.\u201d (Id., \u00a7 7221(a), (b)(1)\u2013(3).) The business must honor opt-out Only the Privacy Protection Agency and the Attorney General can enforce these rules, with administrative fines or civil penalties currently capped at $2,663 per violation and $7,988 per intentional violation. (Civ. Code \u00a7\u00a7 1798.155(a), 1798.199.90(a).) The CCPA’s private right of action is limited to certain data breaches, and the statute may not serve “as the basis for a private right of action under any other law.” (Civ. Code \u00a7 1798.150(a), (c).) Because the CCPA is not part of the Labor Code, ADMT violations also cannot support a PAGA claim. (See Lab. Code \u00a7 2699(a).)<\/p>\n California residents, applicants, employees, and contractors must be told about the ADMT tool before it is used. A genuine human reviewer who understands the output, considers other information, and can change the result may take the decision outside the opt-out and access rules. Notice and risk assessment duties always apply. <\/p>\n SB 947: A Human Must Corroborate The Ads Output<\/p>\n Under SB 947, an employer cannot use ADS to (1) “[p]revent compliance with or violate any federal, state, or local labor, occupational health and safety, employment, or civil rights laws or regulations”; (2) “[i]nfer an employee’s protected status” under FEHA; or (3) “[p]redict and take adverse action against a worker for exercising their legal rights.” (Lab. Code \u00a7 1522(a).) <\/p>\n An employer also cannot \u201crely solely on an ADS when making a disciplinary or termination decision.” (Lab. Code \u00a7 1522(b)(1).) When an employer “primarily relies upon an ADS output to make a disciplinary or termination decision,\u201d it is required for a human being to \u201ccorroborate the [ADS output] decision using the data that was collected or used to produce the ADS output or other relevant corroborating or supporting information\u201d including, but not limited to, supervisory evaluations, personnel files, work product, peer reviews, witness interviews, performance records, and customer reviews. (Id., \u00a7 1522(b)(2).) If the ADS output cannot be corroborated or the human reviewer finds the output “inaccurate, incomplete, or misleading,” the output may not be used in making the disciplinary or termination decision. (Id., \u00a7 1522(c).) <\/p>\n Post-Use Notice. When an employer \u201cprimarily relied upon an ADS to make a disciplinary or termination decision,\u201d the employer must provide a written post-use notice at the time it informs the employee of the decision, which notifies the employee that the it primarily relied on the ADS to make the decision, that a human revised the decision and corroborated the ADS output, and contact information for whom the employee can contact for more information regarding the decision and a description of the data used. (Lab. Code \u00a7 1524 (a)-(b).) The notice must be a stand-alone communication, in the language used for routine employee communications, and delivered by email, hyperlink, or another simple written method. (Id., \u00a7 1524(a).) Upon request, the employer must provide “a meaningful, objective description of the employee’s own data used by the ADS” in making the disciplinary or termination decision. (Id., 1522(d).) Employers may not retaliate against any employee for exercising these rights, complaining to the Labor Commissioner, alleging a violation, or cooperating in an investigation. (Id., \u00a7 1526.)<\/p>\n The Labor Commissioner may investigate, order temporary relief, issue citations, and sue employers for violations of Labor Code section 1522. (Id., \u00a7 1526.1(a).) Public prosecutors may also enforce the law. (Id., \u00a7 1526.1(a), (b), (d).) Violations carry a civil penalty of $500 per violation. (Id., \u00a7 1526.1(e).) <\/p>\n Notably, in any civil action or administrative proceeding under SB 947, “once it has been demonstrated that an ADS was used to make a disciplinary or deactivation decision,” the employer must prove that it did not primarily rely on the ADS or that it complied with the human-review and notice requirements. (Id., \u00a7 1526.1(c).) Therefore, documenting the human review process is critical.<\/p>\n Building One Defensible AI\/Ads Process<\/p>\n The thread running through all three laws is the same. Whether the audience is the Civil Rights Department, the Privacy Protection Agency, the Labor Commissioner, or a jury, the defense of an AI-assisted employment decision will rest on records showing that a qualified human being genuinely reviewed the ADS output and made the call. With the CCPA compliance date now less than three months away (January 1, 2027) and the SB 947 compliance date less than a year away (June 1, 2027), now is the time to build that record. Below are some tips for employers to build a defensible AI process to demonstrate compliance with these new laws. <\/p>\n Inventory All Tools. Inventory every tool that scores, ranks, flags, recommends, and\/or provides any output regarding applicants and employees, including features built into the HR, scheduling, and timekeeping systems. \u00a0 AI\/ADS Policy. Prepare written AI policies, where \u201cprimarily\u201d is defined and applied consistently. Implement Human-Review Step. Implement a human-review step that satisfies both SB 947 “corroboration” and CCPA “human involvement,” and prepare a standard review form that records what the human reviewed checked, analyzed, and concluded. CCPA Pre-Use Notice. Issue the CCPA “before” notice by January 1, 2027, and set up opt-out, appeal, and access procedures.Prepare \u201cAfter\u201d Notice. Prepare the SB 947 “after” notice and data-access response. Retain records for four years. Keep all data that goes into all ADS tools, the ADS outputs, and the documentation related to the decision made for at least four years. Revisit vendor contracts. Revisit vendor contracts and\/or ask all vendors to provide bias-testing disclosures (including what bias testing it performs, how often, and the results), for access to all data, and for cooperation with notices and data requests, among other important items. Train managers and document the program. For questions about the new AI employment laws and their requirements, contact Adelyn Vigran, Dan Forman, Linda Wang, or your favorite CDF attorney. <\/p>\n AI in employment decisions will be a central topic of our upcoming webinar “AI & Privacy in the Workplace: Employment Decisions, CCPA\/CPRA & Privacy Claims” on October 22, 2026, from 10:00 am to 11:00 am (PST) with CDF Partners Dan M. Forman and Linda Wang. Please register here<\/a>
\nFEHA applies to any person “regularly employing five or more persons,” and to “any person acting as an agent of an employer, directly or indirectly.” (Cal. Gov\u2019t. Code, \u00a7 12926(d).) Employees working outside California count toward the five, and part-time employees and employees on leave count the same as full-time employees. (Cal. Code Regs., tit. 2, \u00a7 11008 [definition of “employer”].) Nonprofits and religious associations are generally not considered \u201cemployers\u201d under FEHA. (Cal. Gov\u2019t. Code, \u00a7 12926(d).) FEHA protects applicants as well as employees. (Cal. Code Regs., tit. 2, \u00a7 11008(b), (d).) CCPA regulations \u2014larger for-profit businesses. The CCPA applies to a for-profit entity that does business in California, collects California residents’ personal information, determines the purposes and means of processing it, and meets at least one of three thresholds: (1) annual gross revenues over $26,625,000 in the preceding calendar year (adjusted for inflation); (2) annually buys, sells, or shares the personal information of 100,000+ consumers or households; or (3) derives 50 percent or more of its annual revenue from selling or sharing personal information. (Civ. Code \u00a7\u00a7 1798.140(d)(1), 1798.199.95(d).) Government entities and many nonprofits are not \u201cbusinesses\u201d under the law. (Cal. Code Regs., tit. 11, \u00a7 7001(v).) The rules protect California residents, including California applicants, employees, and independent contractors. (See Civ. Code \u00a7 1798.145(m)(4) (the former exemption for applicant, employee, and contractor data became inoperative on January 1, 2023.)
\nWhat Constitutes An \u201cAutomated Decision System\u201d?<\/p>\n
\nAn automated-decision system (\u201cADS\u201d) is “[a] computational process that makes a decision or facilitates human decision making regarding an employment benefit,” and \u201cmay be derived from and\/or use artificial intelligence, machine-learning, algorithms, or statistics, and\/or other data processing techniques.\u201d (Cal. Code Regs., tit. 2, \u00a7 11008.1(a).) An \u201cemployment benefit\u201d is defined as any benefit of employment covered by [FEHA], including hiring, employment, promotion, selection for training programs leading to employment or promotion, \u2026 discharge from employment or training program, compensation, a discrimination-free workplace, and any other favorable term, condition, or privilege of employment.\u201d (Cal. Code Regs. tit. 2, \u00a7 11008 (h).) An ADS performs tasks such as computer-based assessments about an employee or applicant (e.g., to measure skills, dexterity, aptitude, etc. or screen, evaluate, and recommend), directs job advertisements to targeted groups, screens resumes, analyzes online interviews and data acquired from third parties. (Id., \u00a7 11008.1(a)(1).) The law excludes specific ordinary tools from the definition of ADS, such as word processing, spreadsheets, and databases but only “provided that these technologies do not make a decision regarding an employment benefit.” (Id., \u00a7 11008.1(a)(2).)CCPA regulations [January 1, 2027].
\n“Automated decisionmaking technology” (ADMT) is “any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking.” (Cal. Code Regs., tit. 11, \u00a7 7001(e).) An ADMT tool “substantially replace[s] human decisionmaking\u201d when its output is used to make a decision \u201cwithout human involvement.\u201d (Id., \u00a7 7001(e)(1).) The law defines \u201chuman involvement\u201d as a human reviewer who knows how to interpret and use the output, who reviews and analyzes the output and any other information relevant to the decision, and who has the authority to make or change the decision. (Id., \u00a7 7001(e)(1).)
\nFEHA: When AI Discriminates The Employer Is Liable <\/p>\n
\n(2023) 15 Cal.5th 268, 290\u2013291; see our blog: California\u2019s FEHA Liability Extends to Service Providers<\/a> (August 24, 2003) <\/p>\n
\nrequests. (Id., \u00a7 7221(m), (n).)Risk Assessment. A written assessment is required before using ADMT for a \u201csignificant decision\u201d and before using automated processing to infer a person’s ability, performance at work, reliability, behavior, location, or movements based on “systematic observation” of that person as a “job applicant, student, employee, or independent contractor for the business.” (Id., \u00a7 7150(b)(3), (4).) For processing activity already underway before January 1, 2026, the risk assessment is due by December 31, 2027, and information about assessments conducted in 2026 and 2027 must be submitted to the Privacy Protection Agency by April 1, 2028. (Id., \u00a7\u00a7 7155(b), 7157(a)(1).) For practical guidance on risk assessments and AI governance, see our blog post from [June 3, 2026].<\/p>\n
\nTraining managers on corroboration and anti-retaliation, combined with written policies and audits, can be considered evidence of “all reasonable steps” that can cap PAGA penalties.Conduct Bias Audits. Consult employment counsel to conduct bias audits. Under the new FEHA regulations, anti-bias testing is \u201crelevant\u201d evidence, therefore, testing run solely by HR or a vendor may not be privileged. <\/p>\n
\nfor the CDF Webinar. <\/p>\n","protected":false},"excerpt":{"rendered":"As businesses integrate artificial intelligence (\u201cAI\u201d) and automated decision systems (\u201cADS\u201d) into business operations, they must be cognizant…\n","protected":false},"author":2,"featured_media":503296,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[2946,7,9,8],"class_list":["post-503295","post","type-post","status-publish","format-standard","has-post-thumbnail","category-california","tag-keywords","tag-california","tag-california-headlines","tag-california-news"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts\/503295","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/comments?post=503295"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts\/503295\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/media\/503296"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/media?parent=503295"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/categories?post=503295"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/tags?post=503295"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}