California Signed 13 AI Bills on September 30. Here Is What They Require.
On September 30, 2026, Governor Newsom signed 13 bills governing how AI is used in employment, healthcare, generative content, legal practice, and dealings with government. One took effect that day. Most take effect January 1, 2027. The one most California employers will feel, SB 947, starts July 1, 2027.
California still has no single horizontal AI statute on the EU AI Act model. It regulates workflows instead: which decisions a system may make, which ones a human must own, and what record shows the human did. Read together, the package asks three questions of any AI-assisted decision. What was the system allowed to do? Who was accountable for the result? Where is the evidence?
The Governor's office framed the package around workers: "AI should expand opportunity – not come at the expense of workers and families." The press release is a fine summary. The chaptered text has the thresholds, exceptions, and gaps, and several of the gaps will decide how these laws are enforced.
Figure 1. Effective dates across the package.
The package at a glance
Two other bills in the package matter mainly to specific sectors. AB 2392 (Ch. 855) directs the Community Colleges and CSU to set GenAI procurement and training standards by January 1, 2028, which vendors selling into higher education should read now. AB 1864 (Ch. 852) requires gene synthesis equipment makers and nucleic acid providers to follow the federal screening framework, with penalties up to $5,000 per day.
Employment
SB 947: a human has to check the system's work
SB 947 (Ch. 859) applies to "automated decision systems," or ADS: any computational process derived from machine learning, statistical modeling, data analytics, or AI that issues a simplified output (a score, classification, or recommendation) used to assist or replace human discretionary decisionmaking. Spam filters, firewalls, antivirus, identity and access management tools, calculators, databases, and datasets are excluded. "Employer" includes public entities, labor contractors, and farm labor contractors.
The statute works in two layers.
The first layer applies to every ADS use. Under new Labor Code section 1522(a), an employer may not use an ADS to violate labor, safety, employment, or civil rights law; to infer an employee's protected status under Government Code section 12940; or to predict and take adverse action against a worker for exercising legal rights. Those prohibitions reach hiring, scheduling, and promotion tools, not only discipline.
The second layer governs discipline and termination. An employer may not rely solely on an ADS for either decision. If the employer primarily relies on an ADS output, it must direct a human to corroborate the decision using the data behind the output or other supporting information. The statute lists examples: supervisory evaluations, personnel files, work product, peer reviews, and "witness interviews, that may include relevant online customer reviews." An anonymous one-star review can now corroborate an algorithm. Use that option sparingly.
If the reviewer cannot corroborate the output, or concludes it is inaccurate, incomplete, or misleading, the employer may not use it for the decision.
The statute never defines "primarily relies." That phrase decides whether the corroboration and notice duties apply at all, so expect it to carry most of the early disputes. An employer that treats every ADS-assisted decision as primary reliance avoids the question entirely, at the cost of more paperwork.
Figure 2. The SB 947 workflow when an employer primarily relies on an ADS.
When an employer primarily relied on an ADS, it must give the employee a written notice at the time it informs the employee of the decision, by email, hyperlink, or another simple written method. The notice must state four things: that the employer primarily relied on an ADS; that a human reviewed the decision and corroborated the output; a human contact for questions and for the employee's right to a "meaningful, objective description" of their own data used by the ADS; and that retaliation is prohibited. The statute sets no deadline for answering a data-description request. Pick one and write it down.
The Labor Commissioner and public prosecutors enforce SB 947. Penalties are $500 per violation, with injunctive relief and attorney's fees available. Section 1526.4 confirms that employers covered by the CCPA remain subject to the California Privacy Protection Agency's automated decisionmaking technology regulations. The CPPA rules govern notice, opt-out, and risk assessment around the technology. SB 947 governs the employment decision itself. Most large California employers will answer to both.
SB 947 does not prescribe a record format. A file for each decision (the ADS output, the materials the reviewer considered, the reviewer's written rationale, and a copy of the notice) is the only practical way to prove corroboration happened. That is a recommended control, and it is the first thing an investigator will ask to see.
SB 951: Cal-WARN notices now name the technology
SB 951 (Ch. 860) does not create a new notice trigger. It adds content to an existing one. When an employer already owes a Cal-WARN notice for a mass layoff, relocation, or termination "caused in whole or in substantial part" by AI or other automated technology replacing or automating positions, the notice must also state:
• the number, classification or occupation, and work location of the affected layoffs;
• the job functions being automated;
• the specific category or type of AI or automating technology responsible; and
• the statement "This notice is for a technology displacement" at the top.
The Employment Development Department must publish a summary of these notices and a quarterly statewide summary of technology displacements. A restructuring memo that credits AI efficiencies is now a public data point.
The causation call ("whole or substantial part") belongs in the WARN analysis before the notice goes out, with the reasoning documented. Existing Cal-WARN penalties apply. SB 951 also directs EDD to report to the Legislature by January 1, 2028 on "technological cessation in hiring," meaning positions that stop being filled because of AI, including recommendations on notice requirements. No employer duty attaches yet. The report requirement tells you where the next bill is headed.
AB 1883 and AB 1331: two specific surveillance bans
AB 1883 (Ch. 853) does not ban AI workplace surveillance generally. It bars employers from using a workplace surveillance tool that uses AI to recognize, infer, or predict an individual's emotional state, or to collect neural data (information generated by measuring activity of the central or peripheral nervous system). "Workplace surveillance tool" is defined broadly: any system that collects employee data, communications, biometrics, or behavior by means other than direct human observation, including video and audio monitoring, continuous time tracking, geolocation, and photo-optical systems.
The exceptions are narrow. They cover aircraft development and national security, military, space, or defense work, and only where the tool is reasonably necessary to comply with a federal statute, regulation, or binding federal contract. Penalties run up to $500 per violation, recoverable as a statutory penalty to the employee or a civil penalty, not both.
Review tools by function. Call-center quality software that scores agent "sentiment," wellness wearables that report stress, and video analytics that flag "engagement" all warrant a look.
AB 1331 (Ch. 851) bars workplace surveillance in bathrooms absent a court order and gives employees the right to leave surveillance tools outside. Narrow exceptions cover one-time entry and exit checks and identification or safety tools that record no audio or video and contain no embedded AI. Penalties also run up to $500 per violation.
Healthcare
AB 1979: clinical judgment stays with licensed clinicians
AB 1979 (Ch. 854) adds Business and Professions Code section 22758.5. A health facility, clinic, physician's office, or group practice must take reasonable steps to make sure a licensed provider retains the ability to exercise independent professional judgment whenever patient care relies on a clinical decision support (CDS) system. A CDS system is AI that produces a prediction, classification, or recommendation aiding decisions about timing of care, diagnosis, or treatment.
Two prohibitions follow. Covered entities may not use AI to direct, guide, supervise, or instruct unlicensed personnel in a clinical function that requires a license. They may not use AI to independently perform such a function. Trainees using tools within supervised licensure programs are carved out.
Figure 3. AB 1979 boundaries for clinical decision support.
Appointment booking and reminders, patient education materials, payment processing, and documentation or messaging that involves no professional judgment fall outside the CDS definition. The working test for any tool is two questions: what clinical function is it performing, and who holds the license for that function?
AB 1979 also amends the Confidentiality of Medical Information Act. A business offering a "health care chatbot" (a GenAI system with a natural-language interface, marketed as supporting health services, that uses health information) to help individuals manage their information or diagnose, treat, or manage a condition is deemed a provider of health care under Civil Code section 56.06. Consumer health apps that have operated outside CMIA should assume they are now inside it.
SB 503: bias duties split between developer and deployer
SB 503 (Ch. 857) adds Business and Professions Code section 22758 and divides responsibility for "biased impacts," defined as adverse effects on access to care, quality of care, or outcomes based on protected characteristics.
Developers must make reasonable efforts to identify CDS systems with known or reasonably foreseeable bias risk, attempt to mitigate it, and give deployers a statement of intended uses and risks plus documentation covering training data, evaluation methods, data governance, intended benefits, known bias risks, and use recommendations.
Deployers (health facilities, clinics, physician offices, and group practices) must regularly monitor those systems and take reasonable and proportionate steps to mitigate bias risk.
Two details matter in practice. First, "developer" includes a deployer that substantially modifies a system, so a health system that retrains or fine-tunes a vendor model may inherit developer duties. Second, I did not find a standalone penalty provision in SB 503; my read is that exposure will come through licensing, anti-discrimination, and unfair competition theories.
The statute does not dictate contract terms. The deployer's monitoring duty is hard to meet without them. Vendor agreements should require delivery of the SB 503 documentation, notice of material model changes, performance data for monitoring, and cooperation on remediation. A vendor warranty that the tool is "unbiased" covers none of that.
Generative AI and digital content
SB 1000: the AI Transparency Act, rewritten two months in
The California AI Transparency Act (SB 942, as amended by AB 853 in 2025) became operative August 2, 2026. SB 1000 (Ch. 861) rewrote it 59 days later, as an urgency statute effective on signature.
Coverage. The 1,000,000-monthly-user threshold is gone. A covered provider is now anyone who creates, codes, or otherwise produces a GenAI system publicly accessible in California. Systems designed primarily as assistive technology are exempt until January 1, 2029. Exclusively non-user-generated videogames are excluded.
Verification tool. Covered providers must offer a free "disclosure verification tool" that lets users check whether image, video, or audio content was created or altered by the provider's system, outputs any system provenance data, and supports API access.
Latent disclosures. To the extent technically feasible, content must carry an embedded disclosure, permanent or extraordinarily difficult to remove, stating the provider name, system name and version, creation or alteration time, a unique identifier, and whether the content was created or altered. The mechanism must be compliant or interoperable with widely recognized industry standards. The statute names no particular standard.
Manifest disclosures. SB 1000 deletes the prior requirement to offer users a visible "AI-generated" label option. The one disclosure a consumer could see without a tool is gone.
Licensees. A provider must tell licensees their obligations when it grants the license. If the provider knows an identifiable licensee modified the system so it no longer complies, the provider has 72 hours to either terminate the license or notify the licensee. A notified licensee has 96 hours to fix the system or stop using it and report back. No report, or a report showing no fix, goes to the Attorney General. The statute expressly does not require providers to monitor or investigate licensees.
Penalties are $5,000 per violation, with each day a separate violation, and $50,000 per violation for falsely claiming the assistive-technology exemption.
AB 2713: platforms carry the provenance forward
AB 2713 (Ch. 856) refines duties AB 853 already placed on "large online platforms" (social media, file-sharing, and messaging platforms and search engines with more than 2 million unique monthly California users), operative January 1, 2027. Those platforms must detect provenance data, show users whether it identifies content as AI-generated or altered or as captured by a camera or other device, and let users inspect it. AB 2713 lets platforms offer the provenance data as its own download, in a format that cannot easily be attached to unrelated content, and bars platforms from knowingly stripping provenance data or digital signatures where technically feasible. Platforms need not act on provenance data that does not follow widely adopted specifications from an established standards body.
Capture device makers have their own AB 853 obligations starting January 1, 2028.
Figure 4. Provenance duties from GenAI provider to platform user.
SB 1111: digital replicas under the right of publicity
SB 1111 (Ch. 862) adds one sentence to Civil Code section 3344: "voice or likeness includes a digital replica," meaning a computer-generated, highly realistic representation readily identifiable as a person's voice or likeness. Section 3344 already prohibits knowing commercial use of a person's identity without consent; the replica now counts. Existing exemptions for news, public affairs, sports broadcasts, and political campaigns remain. A new Penal Code section 540 makes using a digital replica with intent to impersonate another a form of false impersonation for identity theft purposes.
For marketing teams and agencies, a synthetic voice or face now needs the same consent paperwork as a real one.
Legal practice and government
SB 574: GenAI rules for lawyers, now in statute
SB 574 (Ch. 858) moves several ethics-opinion principles into the Business and Professions Code. Under new section 6068.1, an attorney "shall not delegate the practice of law to generative artificial intelligence." Attorneys using GenAI must take reasonable steps to verify outputs and correct erroneous or hallucinated content.
The confidentiality test is specific: an attorney may not enter confidential, personal identifying, or other nonpublic information into a GenAI system unless access is restricted to the attorney and authorized persons under confidentiality obligations. The answer turns on the contract and the access controls, whatever the product is called.
Attorneys must disclose GenAI use to the court "for all documents submitted to the court." There is no materiality threshold. Firms need a written position on what counts as "use" (drafting, research, a grammar tool built on a language model) before January.
A new Code of Civil Procedure section 128.7 provision bars filing any citation the responsible attorney has not personally verified. Arbitrators may not delegate any part of their decisionmaking to GenAI and may not rely on GenAI-generated information outside the record without advance disclosure to the parties.
SB 1159: AI is not a "person" before government
SB 1159 (Ch. 863) provides that AI systems, autonomous agents, and robots are not a "person," "member of the public," or "participant" under the Public Records Act, Bagley-Keene, the Brown Act, the Legislative Open Records Act, the Administrative Procedure Act, CEQA, and the Coastal Act. The Legislature's stated concern was automated systems flooding agencies with requests and comments.
A natural person may still use AI to help with their own participation if volume and frequency stay reasonably consistent with ordinary human participation. New Government Code section 8319 bars knowingly using AI to falsely represent that a natural person appeared before or submitted information to an agency. Government affairs teams running automated comment or records-request programs should check attribution and volume now.
What to do before January 1
Figure 5. Implementation sequence with statute mapping.
1. Inventory by function. List every system that scores, classifies, or recommends in HR, clinical care, legal, marketing, and customer operations. Record what each one does, not what the vendor calls it. Flag emotion inference, neural data, protected-status inference, and anything feeding discipline or termination.
2. Assign human authority. For SB 947 decisions, define who corroborates, what evidence they must review, and when an output is rejected. For CDS tools under AB 1979, name the licensed role that owns each clinical function.
3. Fix vendor contracts. Require SB 503 documentation, change notices, monitoring data, and remediation cooperation from CDS vendors. Confirm GenAI tools used with client or confidential data meet the SB 574 access test. GenAI providers that license their systems need the SB 1000 notice and 72-hour response process in their license terms.
4. Build the notices. SB 947 post-use notice and data-description process, SB 951 Cal-WARN content and causation analysis, SB 574 court disclosure language, and SB 1000 latent disclosures and verification tool.
5. Keep the evidence. Retain corroboration files, notices, vendor documentation, monitoring results, court disclosures, and replica consents. Few of these statutes prescribe a retention format. All of them will be enforced by someone asking to see the file.
SB 947 takes effect in nine months. The first Labor Commissioner citation under it will turn on a file someone either built or did not.
This article provides general information about recently enacted California legislation and is not legal advice. Application depends on the specific technology, business, and facts.