You’re Not the Boss of Me: California's “No Robo Bosses Act” and Other New Workplace AI Laws, and How They Intersect with CCPA’s ADMT Regulation

by: Dave Radmore

On September 30, California Governor Gavin Newsom signed four bills described as "first-in-the-nation" worker protections against AI and AI-powered workplace surveillance: SB 947, SB 951, AB 1331, and AB 1883. The headlines have focused on SB 947's ban on AI-only firings, but equally as newsworthy is how these laws will sit alongside the CPPA regulations on automated decisionmaking technology ("ADMT"), which take effect for existing uses on January 1, 2027. The two regimes regulate many of the same tools under different tests, so complying with one does not necessarily mean complying with the other. In this post, we discuss the suite of new laws, how they intersect with the ADMT regulations, and suggest a practical approach to compliance.

What did California enact?

• SB 947 bans AI-only discipline and terminations. SB 947 governs employers' use of automated decision systems ("ADS"), broadly defined as any machine learning, statistical, data analytics, or AI process that issues a simplified output, such as a score or recommendation, used to assist or replace human discretionary decisionmaking. Beginning July 1, 2027, an employer may not rely solely on an ADS to discipline or terminate an employee. If the employer primarily relies on an ADS output to discipline or terminate an employee, a human reviewer must independently investigate and corroborate the decision using sources such as personnel files or witness interviews; if the ADS output cannot be corroborated by the human reviewer, the employer cannot use the ADS output. The employer must also give the employee a stand-alone written notice, in plain language, when it communicates the decision, and the employee may request a description of their own data used by the ADS.

  The Labor Commissioner and public prosecutors (e.g., the Attorney General, District or City Attorneys, County Counsel, etc.) can enforce SB 947, with $500 civil penalties per violation, plus injunctive relief, punitive damages, and attorneys' fees in civil actions. Most importantly, once ADS use is shown, the burden shifts to the employer to prove it did not primarily rely on the ADS or that it complied with SB 947. Simply put, if the human review was not documented, assume it will be treated as if it never happened.

• SB 951 adds AI disclosures to Cal/WARN notices. Where a mass layoff, relocation, or termination is caused in whole or in substantial part by AI or other automated technology, the Cal/WARN notice must also identify the affected positions, the job functions being automated, and the technology responsible, under the heading "This notice is for a technology displacement." Note that SB 951 creates no new trigger; it applies only where Cal/WARN already applies, meaning a layoff of 50 or more employees at an establishment with 75 or more employees. The law also calls for the Employment Development Department to issue a report on AI’s effect on business hiring practices by January 1, 2028, which may include a recommendation for an additional public notice requirement regarding a business permanently ending hiring for a particular occupation or position due to the business’ use of AI technology. This law goes into effect on January 1, 2027.

• AB 1331 bans bathroom surveillance. Absent a court order, employers may not use surveillance tools to monitor employees in workplace bathrooms, and employees may leave such tools behind when entering one. An employer does not violate the ban if an employee voluntarily brings a tool into the bathroom, or brings a required ID, safety, or access badge that does not record audio or video and has no embedded or attached AI. This law takes effect on January 1, 2027.

• AB 1883 bans AI emotion recognition and neural data collection. Employers may not use an AI-enabled workplace surveillance tool on employees to recognize or infer an individual's emotional state, or to collect neural data. However, AB 1883 does not prohibit using a surveillance tool to “ensure safety,” but the law does not clarify further what may or may not meet the safety exception. Both AB 1331 and AB 1883 carry penalties of up to $500 per violation but unlike AB 1331, AB 1883 expressly allows employees to pursue claims. This law goes into effect on January 1, 2027.

How do the new laws intersect with the CCPA ADMT regulations?

CCPA’s ADMT regulations, which go into effect on January 1, 2027, apply where a covered business uses ADMT to make a "significant decision," which for employers includes hiring, work allocation, compensation, promotion, demotion, suspension, and termination. Covered employers must provide a pre-use notice, opt-out and access rights (with some exceptions for opt-out rights), and a risk assessment. Six points of intersection stand out:

1. The human review tests are different. Under the CCPA regulations, a tool is ADMT only if the business uses the technology’s output to make a decision without human involvement, where human involvement is defined as the human reviewer knowing how to interpret the technology’s output, analyzes the output with other relevant information, and has authority to change the decision based on such analysis. SB 947 works differently: if the employer "primarily relies" on the ADS output, human corroboration is required, using the data used to produce the ADS output, and regardless of human involvement in the original decision. This means that a tool can fall outside the CCPA regulations and still be squarely within SB 947.

2. There is no notice safe harbor for CCPA-covered employers. SB 947 excuses compliance with substantially similar ADS notice requirements under other state laws but expressly preserves the CCPA ADMT regulations. CCPA-covered employers will therefore need to give employees both a pre-use notice at or before collection of data to be processed by ADMT, and an SB 947 post-use notice with the decision to fire or discipline an employee.

3. The access rights have different scopes. CCPA requires plain-language explanations of the purpose and logic of the ADMT and how its output was used, subject to a trade secret carve-out. SB 947 instead requires an objective description of the employee's own data that was used by the ADS, with others' information anonymized.

4. An appeal is not corroboration. An employer can avoid offering a CCPA opt-out by providing affected employees the right to appeal decisions to a qualified human reviewer, which is the only exception for promotion, demotion, suspension, and termination decisions. But an appeal follows the decision, while SB 947 corroboration necessarily precedes it because the text of the law expressly forbids use of the ADS output to make the disciplinary or termination decision if it cannot be corroborated. Thus, providing a right of appeal likely will not be sufficient to satisfy SB 947’s requirements.

5. Coverage gaps run in both directions. The CCPA regulations cover more decision types but fewer employers, reaching only for-profit businesses that meet revenue, data-sales, or data-volume thresholds. SB 947 applies to all employers, including public entities, but its human review duty covers only discipline and termination. And SB 947 covers employees only, while the CCPA also reaches independent contracting decisions.

6. Bans replace balancing for surveillance. The CCPA regulations require a risk assessment before using automated processing to infer an employee's performance or behavior through systematic observation, or processing sensitive personal information, which includes neural data. AB 1883 and AB 1331 go further; subject to AB 1883’s safety exception, no risk assessment can justify the use of AI emotion recognition, AI neural data collection, or bathroom monitoring of employees. And because AB 1883 covers only "employees," emotion recognition in job interviews, which the CCPA regulations cite as requiring a risk assessment, appears to remain a CCPA and anti-discrimination question.

Business Takeaways

There are a few compliance actions employers should take now:

1. Know your tools: Identify every AI tool touching hiring, work allocation, pay, discipline, termination, or monitoring, and map the decisions each informs. Turn off any prohibited uses before January 1, 2027.

2. Build the corroboration record and notices: Adopt a protocol identifying corroboration sources, reviewer authority, and documentation standards, and prepare both notices and a combined access template.

3. Revisit vendor contracts: Secure the data access and cooperation commitments needed to answer both access rights and to complete any Cal/WARN notice (and remember that while CCPA requires service providers to assist with ADMT access requests, you should make sure your contracts say so).

4. Align your descriptions: HR, privacy, and workforce planning teams should describe each tool consistently, since a risk assessment describing a tool as automating job functions may later be evidence that a layoff was caused "in substantial part" by AI.

California has continued to layer workplace AI and privacy regulation across the Labor Code and its privacy law. As these new laws illustrate, the patchwork layering does not always fit together elegantly, and it can sometimes be challenging for employers to reconcile the competing statutory and regulatory requirements. Unfortunately, these laws also show that employers can expect that layering to continue into the near future.

Originally published by InfoLawGroup LLP. If you would like to receive regular emails from us, in which we share updates and our take on current legal news, please subscribe to InfoLawGroup’s Insights HERE. This summary does not constitute legal advice.