California AI Workplace Law SB 947: A Human Must Corroborate

A PPE alert lands in a supervisor’s queue at 10:14 on a Tuesday. Who reads it, what they write down, and whether anything happens to the person in the frame is what the California AI workplace law, SB 947, will govern from 1 July 2027. The detection is not the regulated act — the decision after it is.

SB 947 is signed: its requirements start on 1 July 2027

SB 947, which its author calls the No Robo Bosses Act of 2026, adds a new part to the Labor Code — Part 5.5.5, commencing with section 1520 — governing how employers use automated decision systems in decisions about their employees. Senator Jerry McNerney introduced it on 2 February 2026. It was amended several times, most recently on the Assembly floor on 21 August 2026.

The bill’s history shows how close it came. It passed the Senate in May, went to the Assembly, and was placed on the Appropriations suspense file on 5 August 2026 — normally where a bill with a fiscal note goes to die quietly. On 13 August the Assembly suspended its own Rule 63, the committee reported it out on a 10–4 vote, and it was read a second time and ordered to third reading. It was amended on the floor on 21 August, passed the Assembly 53 to 14 on 30 August, and the Senate concurred 28 to 10 on 31 August. The Governor signed it on 30 September 2026.

As a non-urgency statute it takes effect on 1 January 2027 under article IV, section 8(c) of the California Constitution, and section 1526.7 delays its operation to 1 July 2027.

The signature is worth reading against what came before. Its predecessor, SB 7, passed both houses in 2025 and was vetoed on 13 October 2025. Governor Newsom’s message called the restrictions “overly broad” and the notification requirements unfocused, and said forthcoming California Privacy Protection Agency regulations should be assessed before new legislation. Fisher Phillips and several other employment firms published the same reading within days.

SB 947 is the narrower answer to that veto. The most consequential change: it drops SB 7’s 30-day pre-use notice, which drew most of the fire, and keeps only the post-use notice.

Current as of 1 October 2026. Governor Newsom approved SB 947 on 30 September 2026 (Chapter 859, Statutes of 2026). It takes effect on 1 January 2027, and its requirements become operative on 1 July 2027. Nothing below is legal advice.

What California’s AI workplace law counts as an automated decision system

An automated decision system, in SB 947’s terms, is any computational process derived from machine learning, statistical modeling, data analytics or artificial intelligence that issues simplified output, including a score, a classification or a recommendation, used to assist or replace human discretionary decisionmaking, and that materially impacts natural persons. Spam filters, firewalls, antivirus software, calculators and databases are carved out.

Read that definition three times and the operative words separate out.

Simplified output. Not a report, not a dashboard, not a video clip. A score, a classification, a recommendation. A detection that returns “no hard hat, zone 4, 10:14” is a classification.

Assist or replace. This is the phrase that catches systems nobody thinks of as decision-making. The process does not have to decide anything. It only has to feed a discretionary decision that a person then makes.

Materially impacts natural persons. The output has to land on somebody.

The bill text also defines employee data broadly — any information that identifies, relates to or describes an employee, however it was collected, inferred or obtained — and counts labor contractors and farm labor contractors as employers. A yard run through a labor contractor is not outside this. The law sets no minimum employer size, covers public employers as well as private ones, and carries a civil penalty of $500 per violation, enforced by the Labor Commissioner or a public prosecutor.

So the question for anyone running safety or security analytics is not whether a camera detection is an automated decision system in the abstract. It is narrower and more answerable: is the output of that detection being used to assist a discretionary decision that lands on a worker?

For most sites, the honest answer is that nobody has ever written it down.

A detection is not a decision

The law’s core duties do not attach to observing. They attach to relying.

From 1 July 2027, it prohibits an employer from relying solely on an automated decision system when making a disciplinary or termination decision. And where an employer primarily relies on such a system’s output for one of those decisions, the employer must direct a human to corroborate the decision, using the data behind the output or other supporting information, such as supervisory evaluations, personnel files, work product, peer reviews or witness interviews. Output that cannot be corroborated cannot be used for the decision.

A camera can report that a hard hat was missing at 10:14. It cannot report why.

Note the threshold word. Not “uses”. Not “consults”. Primarily relies. A detection that starts a conversation is in a different position from a detection that ends one, and the difference is entirely in what the organization does with it.

There is a second set of provisions worth knowing about, because they rule out uses rather than workflows. SB 947 bars using an automated decision system to infer an employee’s protected status, or to predict and take adverse action against a worker for exercising their legal rights. Emotion inference sits in a different law signed the same day: California’s emotion AI workplace law, AB 1883, bars an employer from using a workplace surveillance tool that runs artificial intelligence to infer an employee’s emotional state. Either is a different thing from detecting whether high-visibility clothing is present in a frame.

Instrument	Status as of 1 October 2026	What it reaches
SB 947 (Chapter 859, Statutes of 2026)	Signed 30 September 2026; operative 1 July 2027	Reliance on an automated decision system for discipline or termination
CCPA automated decisionmaking regulations (CPPA)	In effect since 1 January 2026, with the ADMT obligations phasing in from 1 January 2027	Use of automated decisionmaking technology for a “significant decision”, which the rules define to include employment
SB 7 — the 2025 predecessor	Vetoed 13 October 2025	Nothing. Would have required notice 30 days before use, as well as after

The middle row is the one people miss. The California Privacy Protection Agency’s regulations are not a proposal. They took effect on 1 January 2026, they treat employment decisions as significant decisions, and they turn on a concept called human involvement: a person who knows how to interpret the output, reviews and analyzes it, and has the authority to make or change the decision. SB 947 keeps employers the CCPA covers subject to those rules. Two different California instruments, arriving at the same requirement from opposite directions.

Why “a human looks at it” is not the answer

Every operations manager asked about this says the same thing, and they are not being evasive. Nobody has automated discipline. A supervisor reads the alert. A human is in the loop. On most floors that is literally true.

It is also not what either instrument asks for. Three gaps open up under pressure.

The duty is not satisfied by presence. A supervisor who opens the alert, agrees with it, and issues a written warning has read the system’s output, nothing more. The law asks a human to corroborate the decision against the data behind the output or other supporting information, and bars using output that cannot be corroborated. A second, independent source is good practice, not the statutory minimum.

Nothing survives the review. The obligations described here all produce documents: corroborating information, a written notice to the worker, and a description of the worker’s data if they ask for one. A workflow that runs through a group chat and a supervisor’s memory produces none of them. Six months later there is no way to demonstrate what was actually done, which is the same problem as not having done it.

The alert queue has no owner. Ask who is authorized to act on a forklift-proximity alert on the night shift and most sites cannot answer with one name. If nobody owns the decision, nobody is accountable for how it was made — and the record of it is whatever each shift improvised.

Be fair about the timing: none of this binds until 1 July 2027. But the CPPA’s automated decisionmaking obligations apply from 1 January 2027, and the workflow question is identical under both. Building the review step now costs a policy document and a form. Building it after a claim, a citation or a regulator’s request costs considerably more.

What the workflow needs to look like

None of this is a technology change. Every item below is a decision about who does what, written down before the alert arrives.

Separate the detection record from the decision record

A detection log and a personnel file are two different systems with two different retention profiles, two different audiences, and two different legal exposures. When they are the same spreadsheet, every hazard observation becomes a potential piece of employment evidence, and the whole log inherits the sensitivity of its worst row.

Keep the hazard record about conditions: zone, time, what was observed, what was done to fix it. Anything that becomes a personnel matter gets escalated into a separate file, deliberately, by a named person.

Name who is allowed to act on an alert

One name per detection type per shift. Not a role, not a distribution list — a person, and a named deputy. The point is not bureaucracy. It is that “primarily relies” is a factual question about a specific decision, and a decision with no author cannot be defended.

Make corroboration produce an artifact

Beyond the statutory minimum, good corroboration for a camera alert is something the camera did not produce. A supervisor’s own observation, written the same day. The shift’s PPE issue log. The toolbox talk record. The worker’s own account of what happened, recorded before any decision.

The test is simple and worth applying to your current process: could you hand the file to someone who has not seen the clip, and would they reach the same conclusion? If the answer is no, the clip is the decision and the review was a formality.

Draft the notice before you need one

The post-use notice attaches at the moment the employer informs the worker of the decision — not a week later. It has to be a separate, plain-language written communication, and section 1524 fixes its four contents: that the employer primarily relied on an automated decision system, that a human reviewed the decision and corroborated the output, a person to contact about the decision and about the worker’s right to a description of their data, and that retaliation is prohibited. That is a template, and a template written under time pressure on the day of a termination is a template written badly.

Decide the data-access question now

SB 947 lets an employee request, and requires the employer to provide, a meaningful, objective description of the employee’s own data the system used, where an automated decision system was primarily used for a disciplinary or termination decision. Other people’s data in that description has to be anonymized. Nobody can describe data they no longer hold, so this is a retention question as much as a privacy right.

The resolution is not more storage. It is deciding, in advance, which detection metadata is retained long enough to describe and substantiate a decision and which video is not retained at all — a design choice, made once, rather than a default inherited from a recorder’s disk size.

Keep the safety case and the performance case apart

This item does the most work and needs the least technology. Route safety detections to hazard removal, not to individual performance scoring. A blocked-exit alert should reach whoever can move the pallet. A forklift-proximity alert should reach whoever can re-mark the aisle or change the traffic pattern.

That is better safety practice on its own terms — it is what real-time physical safety monitoring on cameras you own is actually for, and it is the posture an inspector rewards under OSHA’s warehouse national emphasis program, which now runs to 2031. It also happens to keep the great majority of safety alerting outside the reach of a statute about disciplinary decisions, because no disciplinary decision is being made.

What an Nsightify detection reports, and what it leaves to people

An Nsightify detection reports that a condition exists at a place and a time. PPE compliance, forklift–pedestrian proximity, restricted-area dwell, blocked exit, person down — each produces a real-time alert that a state was observed, on a site’s existing cameras. It issues no score about a person, ranks nobody, and takes no action. The discretionary decision stays where SB 947 puts it: with a human who has to check.

The limit has to be stated plainly. Nothing in that design stops a supervisor from treating an alert as a verdict. The moment a detection becomes the primary basis for a written warning, the employer is inside the workflow this law regulates, and no vendor architecture changes that. The control is the employer’s written policy and the sequence people actually follow. Using Nsightify resolves no obligation under SB 947, and nothing here is legal advice.

The technical constraints matter for the same reason. Camera-based detection depends on sightlines, lighting, and where a camera was mounted — which was almost never for analytics. Occlusion behind racking is real. A missing-vest classification is a statement about pixels in a frame, which is precisely why it belongs in a hazard workflow as an observation, and not in a personnel file as a finding. Working out what your existing cameras can already tell you is a separate question from deciding who is allowed to act on it.

Frequently asked questions

Can AI fire your employees in California?

Not on its own, from 1 July 2027. SB 947 (Chapter 859, Statutes of 2026) prohibits an employer from relying solely on an automated decision system for a disciplinary or termination decision. Where an employer primarily relies on such a system’s output for one, a human must corroborate the decision, and output that cannot be corroborated cannot be used. Confirm your own position with counsel.

Does California require human review of AI decisions?

SB 947 does, from 1 July 2027. It bars sole reliance on an automated decision system for discipline or termination, and requires a human to corroborate any such decision that primarily relies on the system’s output. Separately, the California Privacy Protection Agency’s automated decisionmaking regulations, in effect since 1 January 2026, treat human involvement as what takes a technology outside their scope. Confirm your own obligations with counsel.

What counts as an automated decision system?

Under SB 947, any computational process derived from machine learning, statistical modeling, data analytics or artificial intelligence that issues simplified output, including a score, a classification or a recommendation, used to assist or replace human discretionary decisionmaking, and that materially impacts people. The word assist carries the weight: a system does not have to decide anything to be inside the definition.

Can my employer use camera footage to discipline me?

Nothing in SB 947 prohibits that. What it changes, from 1 July 2027, is the sequence. Where an automated system’s output is the primary basis for a disciplinary decision, a human must corroborate the decision, and the employer must state in a written notice, at the time it informs the worker of the decision, that it primarily relied on such a system.

Do I have to tell employees about workplace monitoring in California?

SB 947 is not the instrument that answers that. Its notice duty is post-use: it attaches at the moment an employer informs a worker of a disciplinary or termination decision, not at the moment monitoring begins. Notice obligations for the collection of employee personal information sit under the CCPA and its regulations instead. Confirm your own position with counsel.

---

One page to write before July 2027

None of the above needs to wait for 1 July 2027. Take one detection type you already run — PPE is the usual candidate — and answer four questions on one page. Who receives the alert on each shift. Who is authorized to escalate it into a personnel matter. What corroboration that person must gather before they do. How long the underlying record is kept, and where.

That page is the difference between an observation and a decision, and it is the artifact both California instruments are ultimately asking to see. If the honest answer to any of the four is “it depends who is on”, the gap is in the workflow rather than in the statute — and it is the same gap that makes an incident review two years later impossible to run.

Writing that page can raise questions about how camera alerts reach people on each shift, or what an alert actually records. Put them to the Nsightify team.

Keep reading:

• OSHA’s warehouse national emphasis program now runs to 2031
• Real-time physical safety monitoring on cameras you own