California employers face one AI rulebook from three overlapping regimes

Employers must align human oversight, notices and record-keeping as rules governing AI-assisted workplace decisions take effect across 2025, 2027 and beyond.

California employers are entering a more crowded and more demanding compliance landscape as the state layers fresh workplace rules on top of existing privacy and anti-discrimination requirements. On September 30, 2026, Governor Gavin Newsom signed Senate Bill 947, the “No Robo Bosses” Act, which becomes operative on July 1, 2027. According to the Senate’s announcement and coverage of the law by employment lawyers, the new measure is designed to keep human judgement at the centre of disciplinary and termination decisions when employers use artificial intelligence tools or other automated decision systems.

The new statute does not stand alone. It sits alongside the California Civil Rights Council’s regulations under the Fair Employment and Housing Act, which have applied since October 1, 2025, and the California Privacy Protection Agency’s rules on automated decision-making technology under the California Consumer Privacy Act, which take effect on January 1, 2027. Although the three regimes are drafted differently, they all reach workplace decision-making that is influenced, assisted, or driven by algorithmic tools. That overlap is what makes compliance difficult: an employer that treats each framework as an isolated exercise risks producing inconsistent policies, notices and review procedures that are harder to defend if challenged.

The scope of each regime is not identical. SB 947 applies broadly to California employers and focuses on automated decision systems used in employment decisions. The FEHA regulations cover most employers with five or more workers and apply to applicants as well as employees. The CCPA rules are narrower in one respect because they apply only to covered for-profit businesses that meet the statute’s thresholds, but they still extend to California applicants, employees and independent contractors. For employers, the practical message is that a single AI tool may fall within more than one rule depending on how it is used, who is affected and what data it processes.

The definitions also differ in ways that matter operationally. Under the FEHA regulations, an automated-decision system includes computational tools that make or facilitate a decision about an employment benefit, such as hiring, promotion, training, compensation or termination. The CCPA’s automated decision-making technology definition turns on whether the tool processes personal information and substantially replaces human decision-making, with human involvement requiring a reviewer who can interpret the output, assess other relevant information and change the result. SB 947 is aimed at automated systems that generate outputs used to assist or replace human discretion and materially affect people. The laws also carve out different exclusions, including ordinary software tools that do not themselves make employment decisions.

The shared theme is human oversight. Under the FEHA regulations, employers may face liability if an automated-decision system discriminates against an applicant or employee, even without proof of intent. The CCPA rules add notice, access and, in some cases, opt-out obligations before a covered business uses automated decision-making technology for a significant employment decision. SB 947 goes further in the discipline and termination context: employers may not rely solely on an automated output, and if they primarily rely on one, a human reviewer must corroborate it with supporting information such as personnel records, performance data, witness accounts or customer feedback. If the output cannot be corroborated, or if it is incomplete or misleading, it cannot be used. The law also requires a stand-alone post-use notice when an employer has primarily relied on an automated system to reach a disciplinary or termination decision.

Enforcement and record-keeping obligations are equally important. The FEHA regulations require employers to retain automated-decision system data for four years. The CCPA regime is enforced by the Privacy Protection Agency and the Attorney General, while SB 947 is enforceable by the Labour Commissioner, public prosecutors and, in some cases, through civil actions. Employment lawyers quoted in recent coverage say the safest approach is not to build three separate compliance workflows, but one documented process centred on meaningful human review, clear notices, and records showing exactly how the final decision was reached. With the CCPA deadline arriving on January 1, 2027, and SB 947 following six months later, the time for employers to tighten governance, documentation and vendor oversight is already here.