California signs SB 947, the No Robo Bosses Act, limiting AI in firing decisions

SB 947, known as the No Robo Bosses Act, is a California law that prohibits employers from relying solely on an automated decision system to discipline or terminate a worker.

California Governor Gavin Newsom signed the bill on September 30, 2026, and its employer requirements take effect July 1, 2027.

What it is

The law defines an automated decision system as any computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation.

It is described as the first such law of its kind in the nation to require human oversight of AI used for workplace discipline and termination.

The bill was sponsored by the California Federation of Labor Unions, AFL-CIO.

Newsom had vetoed an earlier version of the bill before this iteration reached his desk.

What it requires

Under the bill, employers that primarily rely on an automated decision system to make termination or disciplinary decisions must have a human reviewer corroborate those decisions using additional information, such as managerial evaluations, peer reviews, and personnel files.

Affected employees must be provided with written notice that AI was primarily used in their termination or disciplinary decision, a description of the employee data used by the system, and a human point of contact who can further explain the decision.

The law also bars employers from using an automated decision system to infer an employee's protected status under the Fair Employment and Housing Act, or to predict and take adverse action against a worker for exercising legal rights.

The provisions are enforced by the California labor commissioner, the state attorney general, or local prosecutors.

What security leaders should do

Security and IT leaders who maintain HR analytics platforms, workforce monitoring tools, or any pipeline that feeds disciplinary or termination recommendations should start mapping which systems meet the law's definition of an automated decision system well before the July 1, 2027 effective date. Because the law requires a human reviewer to corroborate any output that is primarily relied upon, security teams should work with HR and legal to build auditable logs showing what data fed each recommendation and who reviewed it, since the written notice requirement obligates employers to describe the employee data used. Vendor risk reviews for HR technology should now ask whether a tool's scoring or classification logic could be characterized as issuing a recommendation used to assist or replace human discretionary decision-making, since that framing triggers the law's obligations. Teams should also coordinate with compliance on retention and access controls for the underlying data, given that enforcement can come from the labor commissioner, the attorney general, or local prosecutors.