California Employers Should Build a Defensible Process for AI Before California’s January 1, 2027 Deadline

As businesses integrate artificial intelligence (“AI”) and automated decision systems (“ADS”) into business operations, they must be cognizant of California’s new AI employment laws targeting the implementation and use of automated decision systems in their operations, practices, and procedures.

On September 30, 2026, Governor Newsom signed Senate Bill 947 dubbed “No Robo Bosses” bill, which becomes operative on July 1, 2027. (See Stats. 2026, ch. 859, adding Lab. Code, §§ 1520–1526.7.) This law joins two sets of laws related to automated decisions systems that are already in effect, including the Civil Rights Council's regulations on "automated-decision systems" under the Fair Employment and Housing Act (“FEHA”), which has been in effect since October 1, 2025 and the California Privacy Protection Agency's regulations on "automated decisionmaking technology" under the California Consumer Privacy Act (CCPA), which requires compliance by January 1, 2027. (See Cal. Code Regs., tit. 2, § 11008.1; Cal. Code Regs., tit. 11, § 7200(b).)

All three of these laws, the FEHA regulations, the CCPA regulations, and SB 947, reach different employers, define covered technology differently, and are enforced by different agencies, but they all regulate the HR decision about an applicant and/or employee wherein an AI software tool helped, assisted, and/or made the decision. Employers who treat them as three separate checklists run the risk of creating inconsistent documents that plaintiffs’ attorneys will exploit. One process, built around documented and human review, can satisfy all three.

CDF updated you on each. See SB 947 (Inside SB 947, Sept. 3, 2026), the FEHA regulations (Apr. 4, 2025; Aug. 22, 2025), the CCPA ADMT regulations (Aug. 11, 2025), and the full slate of 2027 employment laws (Oct. 16, 2026).

Which Employers Do These Laws Apply To?

The laws reach different sets of employers, and some employers are covered by all three.

• SB 947-AI Automated Decisionmaking —every California employer irrespective of size. An "employer" is any person who "directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, hours, or working conditions of any person." (Lab. Code, § 1520(d)(3)(A).) The definition also generally includes state and local public entities and labor contractors. (Id., § 1520(d)(3)(B)–(D).) The law protects employees (i.e., “any person employed by an employer”) and does not apply to employees covered by a collective bargaining agreement that meets the statute's waiver requirements, or to certain federally required aerospace and defense uses. (Lab. Code §§ 1520(d)(2),1526.5, 1526.6.).
• FEHA regulations — most California employers. FEHA applies to any person "regularly employing five or more persons," and to "any person acting as an agent of an employer, directly or indirectly." (Cal. Gov’t. Code, § 12926(d).) Employees working outside California count toward the five, and part-time employees and employees on leave count the same as full-time employees. (Cal. Code Regs., tit. 2, § 11008 [definition of "employer"].) Nonprofits and religious associations are generally not considered “employers” under FEHA. (Cal. Gov’t. Code, § 12926(d).) FEHA protects applicants as well as employees. (Cal. Code Regs., tit. 2, § 11008(b), (d).)
• CCPA regulations —larger for-profit businesses. The CCPA applies to a for-profit entity that does business in California, collects California residents' personal information, determines the purposes and means of processing it, and meets at least one of three thresholds: (1) annual gross revenues over $26,625,000 in the preceding calendar year (adjusted for inflation); (2) annually buys, sells, or shares the personal information of 100,000+ consumers or households; or (3) derives 50 percent or more of its annual revenue from selling or sharing personal information. (Civ. Code §§ 1798.140(d)(1), 1798.199.95(d).) Government entities and many nonprofits are not “businesses” under the law. (Cal. Code Regs., tit. 11, § 7001(v).) The rules protect California residents, including California applicants, employees, and independent contractors. (See Civ. Code § 1798.145(m)(4) (the former exemption for applicant, employee, and contractor data became inoperative on January 1, 2023.)

What Constitutes An “Automated Decision System”?

The differences matter:

• SB 947 [July 1, 2027]. An "automated decision system" (“ADS”) is "any computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons." (Lab. Code § 1520(c).) An “ADS output” is “any information, data, assumptions, predictions, scoring, recommendations, decisions, or conclusions generated by an ADS.” (Id., § 1520(a).) The law excludes spam filters, firewalls, antivirus software, identity and access management tools, calculators, databases, datasets, and other compilation data. (Id., § 1520(c).)
• FEHA regulations [in effect now]. An automated-decision system (“ADS”) is "[a] computational process that makes a decision or facilitates human decision making regarding an employment benefit," and “may be derived from and/or use artificial intelligence, machine-learning, algorithms, or statistics, and/or other data processing techniques.” (Cal. Code Regs., tit. 2, § 11008.1(a).) An “employment benefit” is defined as any benefit of employment covered by [FEHA], including hiring, employment, promotion, selection for training programs leading to employment or promotion, … discharge from employment or training program, compensation, a discrimination-free workplace, and any other favorable term, condition, or privilege of employment.” (Cal. Code Regs. tit. 2, § 11008 (h).) An ADS performs tasks such as computer-based assessments about an employee or applicant (e.g., to measure skills, dexterity, aptitude, etc. or screen, evaluate, and recommend), directs job advertisements to targeted groups, screens resumes, analyzes online interviews and data acquired from third parties. (Id., § 11008.1(a)(1).) The law excludes specific ordinary tools from the definition of ADS, such as word processing, spreadsheets, and databases but only "provided that these technologies do not make a decision regarding an employment benefit." (Id., § 11008.1(a)(2).)
• CCPA regulations [January 1, 2027]. "Automated decisionmaking technology" (ADMT) is "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking." (Cal. Code Regs., tit. 11, § 7001(e).) An ADMT tool "substantially replace[s] human decisionmaking” when its output is used to make a decision “without human involvement.” (Id., § 7001(e)(1).) The law defines “human involvement” as a human reviewer who knows how to interpret and use the output, who reviews and analyzes the output and any other information relevant to the decision, and who has the authority to make or change the decision. (Id., § 7001(e)(1).)

FEHA: When AI Discriminates The Employer Is Liable

Under FEHA, it is unlawful to use an automated-decision system "that discriminates against an applicant or employee or a class of applicants or employees on a basis protected by the Act, subject to any available defense." (Cal. Code Regs. tit. 2, §§ 11009, subd. (f); see also Id., §§ 11038 (b), 11063 (b).) Intent is not required. “Relevant to any such claim or available defense is evidence of anti-bias testing or similar proactive efforts to avoid unlawful discrimination, including the quality, efficacy, recency, and scope of such effort, the results of such testing or other efforts, and the response to the results.” (Cal. Code Regs. tit. 2 § 11009 (f).)

ADS used to measure skill, dexterity, or reaction time, or analyze tone of voice, physical characteristics, or facial expressions, during the hiring process (i.e., application, interview, or other screening process) may discriminate against applicants based on protected characteristics, which may trigger reasonable-accommodation obligations. (Id., § 11016(c)(5), (d)(1).)

An ADS tool that is facially neutral but has an adverse impact on a protected group is permissible only if the selection process is job-related and consistent with business necessity. (Id., § 11017, subds. (a), (e); see also id., § 11010 (b) [definition of business necessity].)

Employers must keep "automated-decision system data," including the data used in and produced by the ADS tool for four years. (Id., §§ 11008.1(d) & 11013(c).)

Vendors and service providers do not absorb this risk. A vendor that acts on an employer's behalf in recruiting, screening, hiring, promotion, or pay, benefit, or leave decisions, "including when such activities and decisions are conducted in whole or in part through the use of an automated decision system," is the employer's agent, and "[a]n agent of an employer is also an 'employer’ for purposes of [FEHA]." (Id., § 11008(a).) The California Supreme Court has held that a business-entity agent with at least five employees can be directly liable under FEHA, and that this "neither delegates the employer's FEHA obligations nor abrogates the employer's FEHA liability." (Raines v. U.S. Healthworks Medical Group (2023) 15 Cal.5th 268, 290–291; see our blog: California’s FEHA Liability Extends to Service Providers (August 24, 2003)

CCPA: Advance Notice And Opt-Out Requirements Start January 1, 2027

The CCPA ADMT regulations are narrower than FEHA in one critical respect. ADMT means technology that "processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking." (Cal. Code Regs., tit. 11, § 7001(e).) A tool substantially replaces human decisionmaking when its output is used to decide without human involvement. Human involvement requires a reviewer who knows how to interpret and use the output, reviews and analyzes it along with any other relevant information, and has authority to make or change the decision. (Id., § 7001(e)(1).)

The CCPA’s ADMT regulations apply when a covered business uses ADMT to make a "significant decision." (Id., §§ 7001(ddd), 7221 (a).) For employment, a “significant decision” is when it is regarding hiring, allocation or assignment of work, salary, hourly or per-assignment compensation, bonuses, benefits, promotion, demotion, suspension, and termination. (Id., § 7001(ddd) (4).) For practical steps on risk assessments and AI governance, see our blog: AI in the Workplace: Managing Bias, Privacy and Legal Risk (June 3, 2026).

When ADMT is used to make a "significant decision," the rules impose three duties.

• Pre-Use Notice. Any business that uses ADMT, must provide consumers with a pre-use notice, either at or before either collecting or processing a consumer’s personal information, informing the consumer about the business’s use of ADMT, specific purpose of the ADMT, how the ADMT works to make significant decisions about the consumers, the consumer’s right to opt out or appeal (or the exception relied on), the consumer’s right to access ADMT information, and the prohibition on retaliation. (Cal. Code Regs. tit. 11, § 7220, subds. (a)–(c), see also id., § 7003, 7222(a).)
• Opt-Out. A covered business must provide employees and applicants with the ability to opt-put of the use of ADMT to make significant decisions. (id., § 7221(a).) No opt-out is required (1) if the business offers an appeal to a qualified human reviewer with authority to overturn the decision, (2) if the tool is used solely to assess the consumer’s ability to perform at work or in an educational, program to determine whether to admit, accept, hire the consumer, (3) if the tool is used solely for the allocation/assignment of work or compensation, or (4) if the ADMT tool “works for the business’s purpose and does not unlawfully discriminate based upon protected characteristics.” (Id., § 7221(a), (b)(1)–(3).) The business must honor opt-out requests. (Id., § 7221(m), (n).)
• Risk Assessment. A written assessment is required before using ADMT for a “significant decision” and before using automated processing to infer a person's ability, performance at work, reliability, behavior, location, or movements based on "systematic observation" of that person as a "job applicant, student, employee, or independent contractor for the business." (Id., § 7150(b)(3), (4).) For processing activity already underway before January 1, 2026, the risk assessment is due by December 31, 2027, and information about assessments conducted in 2026 and 2027 must be submitted to the Privacy Protection Agency by April 1, 2028. (Id., §§ 7155(b), 7157(a)(1).) For practical guidance on risk assessments and AI governance, see our blog post from [June 3, 2026].

Only the Privacy Protection Agency and the Attorney General can enforce these rules, with administrative fines or civil penalties currently capped at $2,663 per violation and $7,988 per intentional violation. (Civ. Code §§ 1798.155(a), 1798.199.90(a).) The CCPA's private right of action is limited to certain data breaches, and the statute may not serve "as the basis for a private right of action under any other law." (Civ. Code § 1798.150(a), (c).) Because the CCPA is not part of the Labor Code, ADMT violations also cannot support a PAGA claim. (See Lab. Code § 2699(a).)

California residents, applicants, employees, and contractors must be told about the ADMT tool before it is used. A genuine human reviewer who understands the output, considers other information, and can change the result may take the decision outside the opt-out and access rules. Notice and risk assessment duties always apply.

SB 947: A Human Must Corroborate The Ads Output

Under SB 947, an employer cannot use ADS to (1) "[p]revent compliance with or violate any federal, state, or local labor, occupational health and safety, employment, or civil rights laws or regulations"; (2) "[i]nfer an employee's protected status" under FEHA; or (3) "[p]redict and take adverse action against a worker for exercising their legal rights." (Lab. Code § 1522(a).)

An employer also cannot “rely solely on an ADS when making a disciplinary or termination decision." (Lab. Code § 1522(b)(1).) When an employer "primarily relies upon an ADS output to make a disciplinary or termination decision,” it is required for a human being to “corroborate the [ADS output] decision using the data that was collected or used to produce the ADS output or other relevant corroborating or supporting information” including, but not limited to, supervisory evaluations, personnel files, work product, peer reviews, witness interviews, performance records, and customer reviews. (Id., § 1522(b)(2).) If the ADS output cannot be corroborated or the human reviewer finds the output "inaccurate, incomplete, or misleading," the output may not be used in making the disciplinary or termination decision. (Id., § 1522(c).)

• Post-Use Notice. When an employer “primarily relied upon an ADS to make a disciplinary or termination decision,” the employer must provide a written post-use notice at the time it informs the employee of the decision, which notifies the employee that the it primarily relied on the ADS to make the decision, that a human revised the decision and corroborated the ADS output, and contact information for whom the employee can contact for more information regarding the decision and a description of the data used. (Lab. Code § 1524 (a)-(b).) The notice must be a stand-alone communication, in the language used for routine employee communications, and delivered by email, hyperlink, or another simple written method. (Id., § 1524(a).) Upon request, the employer must provide "a meaningful, objective description of the employee's own data used by the ADS" in making the disciplinary or termination decision. (Id., 1522(d).) Employers may not retaliate against any employee for exercising these rights, complaining to the Labor Commissioner, alleging a violation, or cooperating in an investigation. (Id., § 1526.)

The Labor Commissioner may investigate, order temporary relief, issue citations, and sue employers for violations of Labor Code section 1522. (Id., § 1526.1(a).) Public prosecutors may also enforce the law. (Id., § 1526.1(a), (b), (d).) Violations carry a civil penalty of $500 per violation. (Id., § 1526.1(e).)

Notably, in any civil action or administrative proceeding under SB 947, "once it has been demonstrated that an ADS was used to make a disciplinary or deactivation decision," the employer must prove that it did not primarily rely on the ADS or that it complied with the human-review and notice requirements. (Id., § 1526.1(c).) Therefore, documenting the human review process is critical.

Building One Defensible AI/Ads Process

The thread running through all three laws is the same. Whether the audience is the Civil Rights Department, the Privacy Protection Agency, the Labor Commissioner, or a jury, the defense of an AI-assisted employment decision will rest on records showing that a qualified human being genuinely reviewed the ADS output and made the call. With the CCPA compliance date now less than three months away (January 1, 2027) and the SB 947 compliance date less than a year away (June 1, 2027), now is the time to build that record. Below are some tips for employers to build a defensible AI process to demonstrate compliance with these new laws.

• Inventory All Tools. Inventory every tool that scores, ranks, flags, recommends, and/or provides any output regarding applicants and employees, including features built into the HR, scheduling, and timekeeping systems.  
• AI/ADS Policy. Prepare written AI policies, where “primarily” is defined and applied consistently.
• Implement Human-Review Step. Implement a human-review step that satisfies both SB 947 "corroboration" and CCPA "human involvement," and prepare a standard review form that records what the human reviewed checked, analyzed, and concluded.
• CCPA Pre-Use Notice. Issue the CCPA "before" notice by January 1, 2027, and set up opt-out, appeal, and access procedures.
• Prepare “After” Notice. Prepare the SB 947 "after" notice and data-access response.
• Retain records for four years. Keep all data that goes into all ADS tools, the ADS outputs, and the documentation related to the decision made for at least four years.
• Revisit vendor contracts. Revisit vendor contracts and/or ask all vendors to provide bias-testing disclosures (including what bias testing it performs, how often, and the results), for access to all data, and for cooperation with notices and data requests, among other important items.
• Train managers and document the program. Training managers on corroboration and anti-retaliation, combined with written policies and audits, can be considered evidence of "all reasonable steps" that can cap PAGA penalties.
• Conduct Bias Audits. Consult employment counsel to conduct bias audits. Under the new FEHA regulations, anti-bias testing is “relevant” evidence, therefore, testing run solely by HR or a vendor may not be privileged.

For questions about the new AI employment laws and their requirements, contact Adelyn Vigran, Dan Forman, Linda Wang, or your favorite CDF attorney.

AI in employment decisions will be a central topic of our upcoming webinar "AI & Privacy in the Workplace: Employment Decisions, CCPA/CPRA & Privacy Claims" on October 22, 2026, from 10:00 am to 11:00 am (PST) with CDF Partners Dan M. Forman and Linda Wang. Please register here for the CDF Webinar.