Picture this email landing in the IT queue in late 2027. Legal would want to know which tool flagged an employee for termination, what data it used, and who signed off on the result, and they’d want it by Friday. If the only answer were “the vendor dashboard, I think,” that would be a bad week. That’s the angle I care about with the new California AI workplace laws IT compliance teams are about to inherit. The laws are written for employers and HR. The evidence that an employer followed them, though, is going to live in systems ops runs.
Before anyone panics, let’s look at what Governor Newsom actually signed, and what the text does and doesn’t require. Quick disclaimer: I’m a sysadmin, not a lawyer, and this isn’t legal advice. Talk to counsel about your obligations.
What Got Signed, and What Got Vetoed
On September 30, the Governor’s office announced a batch of AI bills. Four of them deal with AI in the workplace:
- SB 947 (McNerney), automated decision systems in employment, Chapter 859, operative July 1, 2027.
- SB 951 (Reyes), AI-driven layoff notices under the state’s Cal/WARN Act, Chapter 860.
- AB 1331 (Elhawary), workplace surveillance in bathrooms, Chapter 851.
- AB 1883 (Bryan), AI-powered workplace surveillance tools, Chapter 853.
The same day, Newsom vetoed two related bills, which are now marked vetoed on the Legislature’s site. KQED’s rundown describes them. AB 2656 would have required notice to public employees when AI performs work within the scope of their jobs. AB 2575 would have protected health care workers who override AI recommendations they judge unsafe.
Only SB 947 carries its own start date in the text. The other three don’t set one, so the usual January 1 start for new California statutes would apply, but confirm that with counsel.
What the Text Actually Says About California AI Workplace Laws and IT Compliance
I read the chaptered text on the Legislature’s site so you don’t have to. The meatiest bill for us is SB 947, which adds Labor Code sections 1520 through 1526.7. The highlights:
- No robo-firing. Section 1522(b) says an employer “shall not rely solely on an ADS when making a disciplinary or termination decision.” If an employer primarily relies on ADS output, a human must corroborate the decision using the data behind the output or other supporting information, such as supervisor evaluations, personnel files, work product, peer reviews or witness interviews.
- Bad output gets tossed. If the output can’t be corroborated, or the reviewer finds it “inaccurate, incomplete, or misleading,” the employer can’t use it for the decision.
- A data description on request. Under 1522(d), employees can request “a meaningful, objective description of the employee’s own data used by the ADS,” with other people’s personal information anonymized.
- A post-use notice. Section 1524 requires a written, plain-language, stand-alone notice at the time of the decision. It must say an ADS was primarily relied on, that a human reviewed and corroborated the output, who to contact, and that retaliation is prohibited.
- The burden of proof shifts. This is the one ops should circle. Under 1526.1(c), once it’s shown an ADS was used, “the employer must demonstrate” that it didn’t primarily rely on the ADS or that it complied with the corroboration and notice rules. Penalties are $500 per violation.
One definitional detail made me smile. SB 947’s definition of an ADS explicitly excludes spam filters, firewalls, antivirus software, and “identity and access management tools.” Your IAM stack isn’t the regulated thing. It just might be where the evidence lives.
The other three bills are narrower:
- AB 1883 bars using a workplace surveillance tool “that uses artificial intelligence” to recognize or infer an employee’s emotional state, or to collect neural data. Using surveillance tools for safety is still allowed.
- AB 1331 bans surveillance tools in workplace bathrooms unless a court orders it, and lets employees leave tools behind when they go in. Badges required for ID or safety, or to open a locked bathroom, are allowed if they don’t record audio or video and have no embedded AI.
- SB 951 requires layoff notices caused “in whole or in substantial part” by AI to include the number and occupations affected, the job functions being automated, and “the specific category or type” of AI system involved. The notice must be labeled “This notice is for a technology displacement.”
What the Text Doesn’t Say
Here’s where I have to push back on the original framing of this post. None of these four bills contains an explicit logging mandate, an access-log requirement, an audit-trail standard or a record-retention period. “Ops will own the logs” isn’t in the statute. What the statute does is make the employer prove corroboration and notice, and hand over a description of employee data on request. So the logging duty comes from those obligations, not from any line in the text.
What I’d Do Anyway (My Opinion, Not the Law)
Everything below is my own ops recommendation. None of it is required by the text. If SB 947’s burden of proof lands on your employer, I’d rather have the evidence ready than reconstruct it from vendor exports in a hurry.
- Inventory anything that scores people. Performance analytics, productivity tools, ticket-quality scoring, call-center QA. If it issues a score, classification or recommendation about employees, flag it for HR and legal review as a possible ADS.
- Keep the inputs. If a human has to corroborate using “data that was collected or used to produce the ADS output,” that data needs to still exist. Work with counsel on retention, and don’t let the vendor’s default 30-day purge decide for you.
- Log the human step. Record who reviewed an ADS-driven decision, when, and what they looked at. A ticket or workflow record beats an email thread.
- Audit your surveillance stack for AB 1883 features. Some monitoring and meeting tools advertise “sentiment” or emotion detection. Find out what’s turned on, and what’s on by default.
- Check badge and sensor coverage against AB 1331. Know which devices record audio or video and which have embedded AI, and where they work.
- Plan for the data-description request. Figure out now how you’d produce one employee’s data from an ADS while anonymizing everyone else’s.
Is this HR theater? No. These laws carry real penalties and a real burden of proof. But they’re employment laws first. Ops doesn’t own compliance here. Ops owns the systems that will either prove compliance or quietly fail to. I’d pick the first one, and start the inventory well before July 2027.
Not legal advice. Summaries are based on the chaptered bill text and official announcements as of publication.