California's New AI Laws Turn Controls Into Duties

On September 30, California's governor signed more than a dozen AI bills in a single day. Two of them deserve an AI risk manager's attention more than the rest. SB 947 makes human review of AI-driven firing and discipline decisions a legal requirement, and SB 1000 does the same for machine-readable labels on AI-generated content. Both were good practice before. Now there are penalties for skipping them. For AAISM™ candidates, this is a clear example of how a new law changes what belongs on a risk register.

What Happened

SB 947, the "No Robo Bosses Act," bars California employers from relying solely on an automated decision system to discipline or terminate an employee. When an employer leans primarily on such a system, a person has to check its output against other information before acting, such as supervisor evaluations, personnel records, work product, peer reviews or witness interviews. If the output can't be backed up that way, or turns out to be inaccurate or incomplete, the employer can't use it. Crowell's analysis of the law adds two details that matter for risk owners. The affected employee must get a written notice explaining that an automated system was used and that a human reviewed the decision. And once a worker shows that an automated system was involved, the burden shifts to the employer to prove it followed the rules.

The law takes effect July 1, 2027. The Labor Commissioner, public prosecutors and employees themselves can enforce it, with civil penalties of $500 per violation. It's a narrower second attempt: the governor vetoed an earlier version, SB 7, in October 2025 as too broad. SB 947 covers only employees, not contractors or applicants, applies only to discipline and termination, and drops the requirement to notify workers in advance.

SB 1000 amends the California AI Transparency Act, which took effect in August. According to WilmerHale's summary, it removes the threshold that limited the law to generative AI providers with more than one million monthly users, so smaller providers are now covered. It also replaces the old AI detection tool requirement with a free tool that lets anyone check a piece of content's disclosure. As Kelley Drye notes, the law drops the option of visible labels but keeps the requirement to embed machine-readable provenance data recording whether the content was created or altered by AI. Violations carry penalties of $5,000 per violation per day. SB 1000 was passed as an urgency measure, so it took effect the day it was signed.

What Changes in an AI Risk Program

Neither law asks for anything a mature program shouldn't already be doing. The difference is that the controls now have to work, and you have to be able to prove they do.

• Re-scope the inventory: with the user threshold gone, company size no longer exempts a generative AI provider. On the employment side, the law's definition of an automated decision system is broad enough to catch performance scoring, productivity monitoring and attrition-risk tools, many of which arrive inside HR software rather than as standalone AI projects.
• Design human review as a control, not a signature: a manager clicking approve on an AI recommendation won't satisfy SB 947. Define what counts as corroborating evidence, require reviewers to record it, and test the control the way you'd test any other, by sampling actual decisions and checking the file.
• Treat records as the defense: because the burden shifts to the employer, the review record is what shows compliance. A review that happened but wasn't documented will be hard to prove.
• Push obligations into vendor contracts: SB 1000 requires covered providers to build compliance into their license terms for third parties. If you license a generative model and modify it, you may be the licensee whose changes break compliance. If you buy an HR tool that scores employees, confirm the vendor can explain which of an employee's data the tool used, since workers will be able to ask for that once the law takes effect.
• Plan against two different clocks: SB 1000 is already in force, while SB 947 gives employers until mid-2027. That difference should shape the risk treatment plan, not just the compliance calendar.

A pattern worth remembering for exam-style risk questions: when a regulation turns a recommended control into a required one, the first step is rarely redesigning the control. It's identifying which systems the law actually reaches. You can't assess or treat a risk in systems you haven't inventoried.

Related Reading

For the full exam breakdown, see the AAISM™ Certification Study Guide. On California's earlier AI audit laws, see Third-Party AI Audits Are Becoming Law. On the EU's approach to the same risks, see EU AI Act Enforcement Is Live. On why governance has to come with evidence, see Pledges vs. Proof: Board-Level AI Oversight.

Sources

Office of the Governor of California — Governor signs AI worker protection and transparency bills
Crowell & Moring — California's No Robo Bosses Act is now law
SHRM — Newsom signs revamped No Robo Bosses Act into law
Ogletree — California governor signs bills targeting AI and workplace surveillance
WilmerHale — California finalizes next wave of state AI and privacy regulation
Kelley Drye — California's 2026 legislative session wraps
CalMatters Digital Democracy — SB 1000: California AI Transparency Act