California's No Robo Bosses Act: Where Automation Stops and a Human Starts

On September 30, 2026, California's governor signed SB 947, the "No Robo Bosses Act." It takes effect July 1, 2027. The law applies to every employer in the state regardless of size, covers employees (not contractors), and sets rules for using an automated decision system in discipline or termination. Crowell & Moring's client alert is the clearest summary we've read; the bill text is on the California legislature's site.

We're in New Jersey, and most of our clients are too. So why write about it? Because several of them have California employees, because this is the most specific law yet about where automation stops and a human has to start, and because the line it draws is a sensible one to adopt whether or not a statute makes you.

What the law requires

Per the alert, the core rules are:

• No sole reliance. An employer may not rely solely on an automated decision system for a disciplinary or termination decision.
• Human corroboration. Where the employer "primarily relies" on the system's output, a human must corroborate it. Rubber-stamping isn't enough. If the output can't be corroborated, or the reviewer finds it inaccurate, incomplete or misleading, it can't be used.
• Written notice. When a system was primarily relied on, the employee gets a plain-language, stand-alone notice saying so, naming a human contact, and describing their right to see their own data.
• Data access. Employees can request "a meaningful, objective description" of their own data the system used.
• Two flat prohibitions. No using a system to infer protected status. No acting on a system's prediction that an employee might exercise a legal right.
• Penalties. $500 per violation, enforced by the Labor Commissioner and public prosecutors, with injunctive relief, punitive damages and fees available to plaintiffs. Once system use is shown, the burden shifts to the employer.

The law doesn't define "primarily relies." The alert flags that gap and so will we: it means the safe design is one where the human judgment is visible in the record, not inferred.

Which automations this touches, and which it doesn't

Here's our working list after reading it. This is how we read the summary as builders, not legal advice; check it with counsel before July.

Probably in scope

• A productivity dashboard that flags "underperformers" and feeds a PIP process.
• A scheduling or timekeeping system that auto-generates write-ups for attendance.
• Any scoring model used in layoffs or role eliminations.
• A ticketing or quality system that ranks reps and triggers coaching or discipline.

Probably not in scope

• Routing inbound work to whoever's available.
• Summarizing a meeting or drafting a performance review for a manager to edit.
• Tagging tickets, extracting invoice fields, syncing CRM records.
• Anything that produces information a human reads before deciding, with the decision and the reasoning recorded by that human.

The second list is almost all of what we build. The first list is where some of our clients' vendors live, and that's the part worth auditing.

How we'd build to comply

The law's requirements map onto design choices we already make for other reasons. Spelled out:

Log the inputs, not just the output. If an employee can request a description of their data, the system has to be able to produce it. Store what was fed in, when, and what came out, per decision. A score with no record of what produced it is exactly the output a reviewer can't corroborate.

Make the human step a real step. A "manager approval" that's a button next to a pre-filled recommendation is the rubber stamp the law rules out. We'd design the review so the human records their own reasoning before seeing the system's score, or at minimum writes a reason that isn't the score.

Separate signal from action. The system can flag. A person decides. The flag and the decision should be different records with different authors, so the "primarily relies" question has an answer in the data.

Generate the notice from the record. If the stand-alone notice is a document the workflow produces when a flagged case proceeds to discipline, it gets sent. If it's a step someone remembers, it doesn't.

Audit your vendors' features. Most HR, workforce-management and contact-center platforms now ship "AI insights" that score people. Some of those will become automated decision systems under this law the moment a manager acts on them. Make a list of what's turned on.

Where this sits with the other rules

California also finalized CCPA regulations on automated decision-making technology that bite January 1, 2027 for "significant decisions," and Colorado's replacement AI law has duties starting the same day. We'll cover those together before the year ends. The point for now is that the compliance direction across states is consistent: notice, human review, access to your own data, and no inferring protected traits. Build to that and the state-by-state differences become paperwork rather than redesign.

We covered the wider frame in what the EU AI Act means for a US small business and the compliance side of agent design in SOC 2, HIPAA and AI agents. If you have California staff and an "AI insights" tab somewhere in your HR stack, the audit is a half-day exercise and it's worth doing before the vendor does it for you.