California No Robo Bosses Act Guide (SB 947): Human Review, Notices and Evidence for AI Discipline

From 1 July 2027, a California employer that relies primarily on an algorithm or AI system to discipline or fire someone must have a human corroborate the output, give the worker a written notice, and be ready to prove it in an enforcement action. Senate Bill 947, the No Robo Bosses Act, was signed on 30 September 2026 and chaptered as Chapter 859, Statutes of 2026. It adds Part 5.5.5 to the Labor Code, starting at section 1520. The law reaches far beyond tools sold as AI: productivity scores, attendance analytics and fraud flags that feed disciplinary decisions can all be automated decision systems. This guide explains what the law requires, what it dropped during passage, how it sits beside California's other workplace AI rules, and how HR, legal, security and data teams can build a defensible corroboration and evidence process. It reflects the chaptered law as at 11 November 2026. For California's wider AI rulebook see the California AI Laws Guide.

Source note: provisions are taken from the chaptered bill page on CalMatters Digital Democracy, checked against Reed Smith, Akin Gump, Covington and WilmerHale analyses; the official leginfo.legislature.ca.gov page could not be read. The law is enacted and operative from 1 July 2027. Confirm against the official text before relying on it. Compliance steps, decision guidance and checklists on this page are NHI Mgmt Group recommendations, not requirements of the text.

Key takeaways

• No AI-only discipline or termination. Employers may not rely solely on an automated decision system (ADS) for these decisions, and where they rely primarily on one, a human must corroborate the output with supporting information.
• Uncorroborated output is unusable. Output that cannot be corroborated, or is found inaccurate, incomplete or misleading, may not be used for discipline or termination.
• Notice and data access. Affected employees get a plain-language written post-use notice at the time of the decision and can request an objective description of their own data used by the system.
• The burden sits with the employer. Once ADS use in a discipline or termination decision is shown, the employer must show it did not primarily rely on the ADS or that it complied with the law.
• $500 per violation, public enforcement. The Labor Commissioner and public prosecutors enforce; there is no private right of action in the chaptered text, though commentators expect PAGA claims.

Scope: who and what is covered

Key obligations

1. Prohibited uses (any employment context)

• Using an ADS in a way that violates labour, occupational safety, employment or civil rights laws.
• Using an ADS to infer an employee's protected status.
• Using an ADS to predict that a worker will exercise legal rights and taking adverse action on that prediction.

2. Human corroboration for discipline and termination

An employer may not rely solely on an ADS. Where it primarily relies on ADS output, a human must corroborate the output using supporting information, such as performance evaluations, personnel files, the underlying data or witness interviews. If the output cannot be corroborated, or proves inaccurate, incomplete or misleading, it may not be used. The law does not define what makes the review adequate, so the quality of the reviewer's independent investigation will be the evidence that matters.

Worked example: a warehouse productivity system flags an employee as below rate for three weeks and recommends a final warning. Corroboration means the supervisor checks the underlying scan and task records, confirms whether equipment faults, reassignments, approved leave or system outages explain the gap, and speaks to the employee before deciding. If the scan data turns out to be incomplete because a handheld scanner was faulty, the output is incomplete and cannot be used. The supervisor's record of what was checked, and the notice issued with the warning, form the evidence pack the employer will need if the Labor Commissioner asks.

3. Post-use notice

A separate, plain-language written notice must be given to the affected employee at the time of the decision. It must state that:

• the employer primarily relied on ADS output for the decision;
• a human corroborated the output;
• the employee may request a description of their data the system used;
• who the human contact is; and
• retaliation for exercising these rights is prohibited.

Employers that comply with these notice requirements need not also comply with substantially similar notice provisions in other state laws. CCPA-covered businesses remain subject to the California Privacy Protection Agency's automated decisionmaking technology regulations.

4. Data access

Where an ADS is primarily used for discipline or termination, the employee may request an objective, meaningful description of their own data the system used. Information about third parties must be anonymised. Sources reviewed do not state a response deadline, so set an internal one and document it.

5. Anti-retaliation

Employers may not discharge, demote, suspend or otherwise retaliate against employees for exercising rights under the part, including requesting their data or ADS output, or for helping enforcement.

What changed during passage, and related laws

Reed Smith notes that the Governor vetoed a broader version of the bill a year earlier as too broad and burdensome. The 2026 Assembly amendments narrowed SB 947 again by removing the ban on using an ADS to "assist" decisions, the limits on compensation decisions and predictive behaviour analysis, the customer rating limits, independent contractor coverage and the private right of action, and by delaying the start to 1 July 2027. Sponsors have called the law a start, so further bills are likely.

The No Robo Bosses Act does not pre-empt local ordinances that give equal or greater protection. Employers hiring in New York City should also read the NYC Automated Employment Decision Tools (AEDT) Law Guide.

Exemptions

• Collective bargaining: covered parties are exempt where a collective bargaining agreement waives the part in clear and unambiguous terms and provides protection from algorithmic management.
• Federal requirements: use required by, or reasonably necessary to comply with, federal law or regulation, or binding federal contracts for aircraft development or national security, military, space or defence products.

Enforcement and penalties

• Labor Commissioner: may investigate, seek temporary relief and issue citations.
• Public prosecutors: may bring civil enforcement actions, with injunctive relief and fees available according to Reed Smith.
• Civil penalty: $500 per violation. Each uncorroborated decision or missing notice is a potential separate violation.
• Burden of proof: once ADS use in a discipline or termination decision is shown, the employer must demonstrate it did not primarily rely on the ADS, or that it corroborated the output and gave notice. Reed Smith warns this may be argued as a burden of persuasion, inviting discovery into ADS data, logic and the reviewer's work.
• No private right of action in the chaptered text; commentators expect plaintiffs to seek the penalty through the Private Attorneys General Act (PAGA).

Implementation: a phased programme to July 2027

1. Inventory (now to Q1 2027). List every system whose output reaches a discipline or termination decision: productivity and activity scoring, timekeeping and attendance analytics, call quality scoring, data loss prevention and insider risk alerts, fraud and policy violation flags, safety telematics, and AI assistants used by managers. Record vendor, data inputs, output type and who sees it.
2. Classify reliance. For each decision path, decide whether ADS output is the sole, primary or a minor input. Prohibit sole reliance in policy and in workflow.
3. Design corroboration. Write a standard for what the human reviewer must check (underlying records, context, the employee's account), require the reviewer to record what they examined and why the output was or was not corroborated, and give reviewers authority to reject output.
4. Build notices and data descriptions. Draft the post-use notice template with all required statements, and a data description template that is objective and anonymises third parties. Agree internal response times.
5. Pilot (Q2 2027). Run the process on a sample of real cases in one business unit; test that evidence can be retrieved and that notices issue on the decision date. Roll back to the prior process only for workflow changes, never for the corroboration rule once operative.
6. Train and launch (by 1 July 2027). Train managers, HR business partners and investigators, including anti-retaliation duties. Update vendor contracts so suppliers provide the data and logic descriptions you need.
7. Monitor. Review samples quarterly and after any vendor model change.

Decision guidance

• Primary reliance or not? The safest design keeps ADS output as one input among several and documents that. Where scale makes primary reliance unavoidable, accept the corroboration, notice and data access cost and build it into the workflow.
• Small employers: often use one or two vendor tools; a written review step, a notice template and a vendor data description may be enough.
• Large and multi-state employers: apply the California process wherever California employees are affected, and align it with the CCPA ADMT pre-use notice and FEHA bias controls so one evidence pack serves all three.
• Unionised workforces: check whether existing agreements meet the clear waiver and algorithmic management protection test; most will not without renegotiation.

Where security, identity and AI agents fit

Security teams own several of the tools most likely to trigger SB 947. Insider risk scores, DLP alerts and user behaviour analytics often start investigations that end in discipline. Those findings now need human corroboration from the underlying evidence, not the risk score. Investigation runbooks should require the analyst to confirm the raw events, account for shared or compromised credentials (an alert tied to an account is not proof the employee acted), and record the conclusion. Where AI agents summarise cases or draft recommendations for managers, they are part of the ADS chain: log their inputs and outputs, restrict what employee data their service identities can read, and keep the records with the case file. See the Employee Monitoring and Privacy Guide and the Human-in-the-Loop for AI Agents Guide.

Detection, evidence and measurement

• Evidence to retain per decision: ADS output and version, data inputs, reviewer identity, materials reviewed, corroboration conclusion, notice copy and delivery date, data request and response.
• Logging: record which users and service accounts accessed ADS outputs about an employee, so access can be shown to be need-to-know.

Metrics: percentage of discipline and termination decisions with a documented ADS reliance classification; percentage of primary-reliance decisions with recorded corroboration (target 100); percentage of notices issued on the decision date; median time to answer data requests; rate at which reviewers reject ADS output (a rate near zero suggests rubber-stamping); and open vendor contracts lacking data description terms.

Framework mapping

Common failure patterns

• Rubber-stamp review. A manager clicking "approve" on a score is not corroboration; record what was checked.
• Missing the non-AI tools. Attendance and productivity analytics meet the ADS definition even when nobody calls them AI.
• Treating a security alert as proof. Compromised or shared credentials make an account-level alert unreliable evidence of personal misconduct.
• No vendor data rights. Without contract terms, the employer cannot describe what data the vendor's system used.
• Notices sent late or bundled. The notice must be separate and given at the time of the decision.
• Retaliating against requesters. Treating a data request as a sign of conflict creates a fresh violation.

Practitioner checklist

• Record SB 947 (Chapter 859, Statutes of 2026) with its 1 July 2027 operative date in the regulatory register.
• Inventory every system whose output reaches discipline or termination, including security tools.
• Ban sole reliance on ADS output in HR policy and workflow.
• Publish a corroboration standard and reviewer record template.
• Prepare post-use notice and data description templates.
• Add data and logic description terms to ADS vendor contracts.
• Update insider risk and investigation runbooks to require raw-event corroboration.
• Train managers and HR on corroboration and anti-retaliation.
• Align with SB 951, AB 1883, CCPA ADMT and FEHA ADS obligations.

Standards and references

• CalMatters Digital Democracy: SB 947 Employment, Automated Decision Systems, chaptered bill
• Reed Smith: A Closer Look at Recently Enacted Senate Bill 947
• Akin: California Enacts Limits on Automated Decision Systems in Employment Discipline
• Covington Inside Privacy: New California AI Employment Laws
• WilmerHale: California Finalizes Next Wave of State AI and Privacy Regulation
• NIST: AI Risk Management Framework

This guide summarises California SB 947 and related workplace AI laws as at 11 November 2026, and is not legal advice. Related NHI Mgmt Group resources: California AI Laws Guide · NYC Automated Employment Decision Tools (AEDT) Law Guide · Employee Monitoring and Privacy Guide · Human-in-the-Loop for AI Agents Guide · EU AI Act Article 14 Guide