California AI Workplace Laws 2027: The Rules That Reach a Hiring, Monitoring, or Firing Tool

The California AI workplace laws of 2027 reach companies that have employees in California and use software to screen, monitor, discipline, or lay off any of them. By July 1, 2027 the same tool can answer to three regimes, depending on the employer’s size and how it uses the tool. The first is the set of automated-decision regulations under the Fair Employment and Housing Act (FEHA), California’s anti-discrimination law, in force since October 1, 2025. The second is the California Consumer Privacy Act (CCPA) rules on automated decisionmaking technology, due January 1, 2027. The third is the four statutes Governor Newsom signed on September 30, 2026: SB 947 on discipline and termination, SB 951 on layoff notices, and AB 1331 and AB 1883 on surveillance. Three of the four bind on January 1, 2027 and SB 947 on July 1. Each regime has its own enforcer. Under the FEHA regulations, a vendor that screens candidates on your behalf can be sued as your agent, which makes it an “employer” alongside you. Mobley v. Workday let the same theory proceed under federal law.

Key Takeaways

• The FEHA rules already apply. Since October 1, 2025 it is unlawful, subject to any available defense, to use an automated-decision system that discriminates. Anti-bias testing, or its absence, is relevant to the claim, and the system’s data must be kept four years.
• Two dates to calendar. January 1, 2027 for the CCPA’s pre-use notice and opt-out, the AI layoff notice, and the surveillance bans; July 1, 2027 for SB 947’s bar on disciplining or firing by a system alone.
• How much a human decides places the tool. A reviewer who knows how to interpret the output, analyzes it with the other relevant information, and can change the decision takes a tool out of the CCPA rules. Under SB 947, an employer that primarily relies on a tool to discipline or fire must have a human corroborate its output. Nothing takes a tool out of FEHA.
• The Labor Code penalties are not the ceiling. SB 947 sets a $500 penalty and AB 1331 one of up to $500, each enforced by the Labor Commissioner, and on this article’s reading the Private Attorneys General Act (PAGA), the statute that lets an employee sue for state labor penalties on the state’s behalf, reaches both. One employee subject to a violation can then seek the penalty for every coworker subject to the same violation. The likely exception is a claim based only on a missed SB 947 post-use notice.
• The vendor can be a co-defendant. Under the FEHA regulations, a person that screens or hires on an employer’s behalf, including through an automated system, is itself an employer. Mobley v. Workday let the same theory proceed under federal law at the pleading stage. The contract terms that answer it are testing access, records, and indemnity.

Which AI workplace laws take effect in California in 2027?

Six rules from three regimes, and the table below runs them by use, because that is how the question arrives: an HR director asks what the screening tool has to do, not what SB 947 says. The Civil Rights Council, the body that writes FEHA’s regulations, has applied them to automated-decision systems. The CCPA’s rules on automated decisionmaking technology (ADMT) reach an existing use on January 1, 2027; the CCPA applies to a for-profit business above its revenue or data-volume thresholds, and its rules name employment decisions, so applicant and employee data are inside it. The four September statutes arrive on January 1 and July 1, 2027. Each row names the rule, what it requires, the date it binds, who enforces it, and whether a worker can sue.

California AI workplace laws 2027, by use

The three definitions reach the same tool to different depths, and the depth decides which rows apply. FEHA’s term is the widest. An automated-decision system is “A computational process that makes a decision or facilitates human decision making regarding an employment benefit,” so a tool that only ranks candidates for a recruiter is inside it.¹ SB 947’s term is a process that “issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons,” and, beyond its three outright bans, its corroboration, notice, and data-description duties attach only to a disciplinary or termination decision.⁴ The CCPA’s term is the narrowest: technology that uses computation “to replace human decisionmaking or substantially replace human decisionmaking.”³

So a résumé screener whose output a recruiter reads and can overrule is inside FEHA. It is outside SB 947’s corroboration and notice duties, because hiring is not discipline. It is outside the CCPA rules if the recruiter’s review meets the human-involvement test described below. The same screener set to reject candidates on its own is inside FEHA and the CCPA rules.³

If one tool scores, ranks, or flags workers for any decision, it is already inside FEHA. Whether the CCPA rules and SB 947 also reach it turns on how much a human decides.

Can an employer rely on AI to discipline or fire someone?

Not on its own, from July 1, 2027. SB 947 adds a part to the Labor Code that opens with three outright bans: an employer may not use an automated decision system to “Prevent compliance with or violate” labor, safety, employment, or civil rights law, to “Infer an employee’s protected status,” or to “Predict and take adverse action against a worker for exercising their legal rights.” Its central rule is one sentence: “An employer shall not rely solely on an ADS when making a disciplinary or termination decision.”⁸

The operative word is “solely,” and the statute builds three tiers around it. Sole reliance is barred. Where an employer “primarily relies upon an ADS output,” it “shall direct a human to corroborate the decision using data that was collected or used to produce the ADS output or other relevant corroborating or supporting information.” The statute’s examples include “Supervisory or managerial evaluations” and “Personnel files.” And where the employer “cannot corroborate the ADS output, or the human reviewer has concluded that the ADS output is inaccurate, incomplete, or misleading, the employer shall not use the ADS output to make a disciplinary or termination decision.” The statute does not define “primarily relies.” On this article’s reading, a tool that flags an employee for a manager who then reads the file and decides may sit in the second tier. An employer that documents what the manager read has its corroboration record either way; if the tool is in the second tier, the post-use notice is also due.⁸

The record is the compliance. An employer that primarily relied on an ADS must hand the employee “a written postuse notice at the time the employer informs the employee of the decision.” The notice must be “written in plain language as a separate, stand-alone communication,” and it must state that the employer primarily relied on an ADS and “That a human reviewed the decision and corroborated the ADS output.” The employee may then request “a meaningful, objective description of the employee’s own data used by the ADS.” In any proceeding under the part for a corroboration violation, once it is shown that “an ADS was used,” the employer “must demonstrate” that it did not primarily rely on the system or that it complied with the corroboration and notice rules. The burden sits with the employer, and the notice and the corroboration file are how it is carried.⁸

Two exemptions turn on the employer’s situation rather than the software. The part does not apply to workers under a collective bargaining agreement that “explicitly waives this part in clear and unambiguous terms,” “expressly provides for the wages or earning, working conditions, and other terms and conditions of work,” and “provides protection from algorithmic management.” Nor does it apply to a system whose use is “required by, or reasonably necessary to comply with” a federal statute, regulation, or contract on aircraft development or national-security, military, space, or defense work. The penalty is $500 per violation, enforced by the Labor Commissioner through its citation procedure and by public prosecutors. Either may also sue for temporary or preliminary injunctive relief, punitive damages, and reasonable attorney’s fees and costs. The part also bars retaliating against an employee who asserts its rights.⁸

If a manager signs off on terminations a system recommends, write down what the manager read and why. From July 1, 2027 that file is the difference between a corroborated decision and a violation.

What must a layoff notice say when AI caused the layoff?

A Cal-WARN notice for a layoff caused in whole or in substantial part by AI must say it is a technology displacement and add three facts about it. SB 951 amends the Cal-WARN Act, the state’s layoff-notice law, for an employer giving notice of a mass layoff, relocation, or termination “caused in whole or in substantial part by an AI system or other automated technology replacing or automating employment positions.” The Act reaches a site that employs, or has employed in the past 12 months, 75 or more people. A mass layoff is 50 or more employees there in any 30-day period. The notice must add “The number, classification or occupation, and work location of layoffs that are substantially due to the replacement or automation by AI or other automated technology.” It must add “The job functions performed by those replaced workers that will be automated by AI or other automated technology.” And it must add “The specific category or type of AI system or other automating technology that substantially resulted in technological displacement.” The notice must carry “the statement ‘This notice is for a technology displacement’ at the top.” The Employment Development Department publishes a summary of the notices it receives on its website and posts a quarterly statewide summary of technology displacements; a separate report to the Legislature on AI’s effects on hiring, due January 1, 2028, is repealed with its section on January 1, 2029.⁹

The statute adds no new penalty, and it does not need one. Cal-WARN’s existing remedies stay in place: a civil penalty of up to $500 for each day an employer fails to give the required notice to the Employment Development Department and local officials, excused if the employer pays the affected employees within three weeks, and a civil action by the affected employees. What SB 951 adds is a causation finding the employer makes about itself, in a public filing, naming the system. A notice that says a layoff was “substantially due to” an AI system is the first exhibit in any later dispute about that system, such as an employee’s discrimination charge. An employer that leaves the AI details out when AI was a substantial cause has given a notice that does not meet section 1401(d), and this article reads Cal-WARN’s remedies as attaching to that defect. The judgment call is the “substantial part” threshold, which the amended section does not define.⁹

If a 2027 reduction in force follows an automation project, decide before the notice goes out whether automation was a substantial cause, and have the three facts ready. The notice is a public filing the Employment Development Department summarizes.

What workplace monitoring is now banned?

From January 1, 2027, California bans two uses: surveillance tools in workplace bathrooms and AI tools that infer employees’ emotions or collect neural data. AB 1331 provides that “Unless directed by a court order, an employer shall not use a workplace surveillance tool to monitor or surveil employees in a bathroom located in the workplace.” It gives employees “the right to leave behind workplace surveillance tools that are on their person or in their possession when entering a bathroom.” AB 1883 provides that “An employer shall not use a workplace surveillance tool that uses artificial intelligence on employees” for “Recognizing, or making inferences or predictions about, an individual’s emotional state” or for “Collecting neural data,” meaning data read from the nervous system. AB 1883 carves out a tool used “to ensure safety.” Both bills carry a penalty of up to $500 per violation, enforced by the Labor Commissioner and public prosecutors. AB 1883 adds a line the others lack: “An employee, the Labor Commissioner, or a public prosecutor may recover a penalty under this part as a statutory penalty paid to the employee or a civil penalty, but not both, for the same violation.”¹⁰

The Governor signed both with a warning. His signing message encourages the Legislature “to refine these two measures to address ambiguities and possible unintended consequences,” noting that AB 1331 “may interfere with systems used by employees to access locked facilities” and that AB 1883 “lacks key definitions.” For an employer that means two things. The example the message gives is “systems used by employees to access locked facilities,” such as a badge reader on a locked restroom. AB 1331 already answers part of it. An employer may check tools “for the one-time entry and exit of bathrooms in the workplace.” It also does not violate the ban when an employee carries a required badge or alarm that does not detect or record audio or video and has no embedded or attached AI. And “emotional state” is undefined. So a productivity tool that uses AI to infer stress or mood from tone, facial expression, or typing cadence is inside AB 1883’s words until the Legislature narrows them. A safety tool is outside them only so far as the employer uses it “to ensure safety.”¹⁰

If an AI monitoring tool scores sentiment or stress, turn that feature off for California employees before January 1, 2027. Or document the safety purpose that keeps it inside the carve-out.

What do the FEHA automated-decision regulations already require?

Three things: no discriminatory tool, testing as evidence, and four years of records. They have applied since October 1, 2025. They are easy to miss, because they came from the Civil Rights Council rather than the Legislature. Section 11009(f) of the Council’s regulations provides: “It is unlawful for an employer or other covered entity to use an automated-decision system or selection criteria (including a qualification standard, employment test, or proxy) that discriminates against an applicant or employee … on a basis protected by the Act, subject to any available defense.” The sentence that follows is the one to build a program around. “Relevant to any such claim or available defense is evidence, or the lack of evidence, of anti-bias testing … , including the quality, efficacy, recency, and scope of such effort, the results of such testing or other effort, and the response to the results.” An employer that never tested its tool has no testing to point to, and the plaintiff can point to the gap.¹

The definitions are wide by design. The regulation’s own examples of an automated-decision system include “Screening resumes for particular terms or patterns” and “Analyzing facial expression, word choice, and/or voice in online interviews.” An agent of an employer is also an employer under the Act, as the vendor section below explains. A proxy is “A characteristic or category closely correlated with a basis protected by the Act.” The records rule reaches the data: employment records, now expressly including “automated-decision system data,” must be kept “for a period of four years.”¹

The regulations impose no notice duty specific to automated-decision systems and no opt-out; those come from the CCPA rules and SB 947. What they impose is liability for the outcome and a four-year evidentiary trail.¹

If you have never run an anti-bias test on your screening tool, plan one with counsel and decide how you will respond to what it finds. FEHA weighs the testing, its results, and your response.

How do the CCPA’s automated-decision rules apply to employers?

For a business subject to the CCPA, the automated-decision rules add notice, an opt-out, and an explanation, for a narrower set of tools, on January 1, 2027. The California Privacy Protection Agency’s rules provide that “A business that uses ADMT for a significant decision prior to January 1, 2027, must be in compliance with the requirements of this Article no later than January 1, 2027.” A significant decision includes “employment or independent contracting opportunities or compensation,” spelled out as hiring, “Allocation or assignment of work” and compensation, promotion, and “Demotion, suspension, and termination.” Automated decisionmaking technology is technology that “uses computation to replace human decisionmaking or substantially replace human decisionmaking.” A human reviewer takes a tool outside the definition only if three things are true. The reviewer knows how to interpret and use its output, reviews it with “any other information that is relevant,” and has “the authority to make or change the decision.”³

Three duties follow for a tool inside it. The business gives a pre-use notice “at or before the point when the business collects the consumer’s personal information that the business plans to process using ADMT.” It offers an opt-out, unless it offers an appeal “to a human reviewer who has the authority to overturn the decision,” or the use is “solely” for assessing a candidate’s “ability to perform at work” to decide whether to hire, or “solely” for the “allocation/assignment of work or compensation,” and in either case the tool “works for the business’s purpose and does not unlawfully discriminate based upon protected characteristics.” And on request it gives “plain language explanations” of the purpose, “the logic of the ADMT,” and “[t]he outcome of the decisionmaking process for the consumer.” The Agency enforces with administrative fines of up to $2,500 per violation and $7,500 per intentional violation, as adjusted under the statute; the Attorney General may sue; and the statute creates no private right of action for these rules.³

SB 947 and the CCPA rules overlap on termination, suspension, and demotion, and the Legislature wrote the overlap in. An employer that complies with SB 947’s notice rules “is not required to comply with any substantially similar notice provisions related to automated decision systems used for employment-related decisions required under any other state law.” That safe harbor yields where the employer is a CCPA business, which stays “subject to any privacy-related automated decisionmaking technology regulation” the Agency adopts. A CCPA business therefore gives both notices. The Agency’s pre-use notice goes before it collects the data, or before it runs data it already holds through the tool; SB 947’s post-use notice goes with the decision.¹¹

If your business is above the CCPA’s thresholds and a tool decides hiring, pay, or termination with no reviewer who can change the outcome, three duties are due January 1, 2027. They are the pre-use notice, the opt-out or appeal path, and an explanation on request.

How do Colorado and Illinois compare?

Illinois is a discrimination rule, Colorado is a disclosure law, and California is both, so a multistate employer builds one program for three different kinds of law. Since January 1, 2026 it is a civil rights violation in Illinois for an employer “to use artificial intelligence that has the effect of subjecting employees to discrimination on the basis of protected classes,” “to use zip codes as a proxy for protected classes,” or “to fail to provide notice to an employee that the employer is using artificial intelligence.” The listed decisions run from recruitment and hiring through promotion, discharge, and discipline. The text says “employees,” and whether applicants are covered is unsettled. The private action runs through a charge to the Department of Human Rights. Colorado’s SB 26-189 is a consumer-protection disclosure law. From January 1, 2027 it reaches “covered ADMT,” technology “used to materially influence a consequential decision,” where to “materially influence” means an output that is “a non-de minimis factor” and “affects the outcome.” It covers “employment or an employment opportunity,” for employees, Colorado-resident applicants, and anyone evaluated for an opportunity in Colorado. As of October 29, 2026, a stipulated order in xAI’s suit holds enforcement back. The Attorney General “shall not initiate enforcement,” including an investigation, of SB 24-205 “or any legislation replacing” it. SB 26-189 replaced it, so the order reaches the new law on its words. The order covers violations occurring on or before 14 days after the court rules on xAI’s preliminary-injunction motion. xAI must file that motion within 28 days after Colorado finally adopts its rules. California’s three regimes sit between them, as the box shows.¹²

California, Colorado, and Illinois compared

One Colorado term changes a California contract. SB 26-189 allocates liability between developer and deployer by relative fault. It then provides that a contract term that “purports to indemnify, defend, or hold harmless” a party against liability “resulting from the developer’s or deployer’s own acts or omissions” in violation of Colorado anti-discrimination law “is contrary to public policy and void.” The vendor indemnity an employer negotiates for its California exposure, discussed below, therefore cannot cover the employer’s own share of a Colorado discrimination claim, and the vendor answers for its own share under the relative-fault rule.¹²

If you hire in all three states, add Illinois’s AI-use notice and Colorado’s adverse-outcome explanation on top of the California table. Neither discharges SB 947’s corroboration, the CCPA opt-out, or the surveillance bans.

Who can sue, and can the vendor be liable?

A worker can sue directly under three of the six rules: FEHA, Cal-WARN, and AB 1883. On this article’s reading, a worker can also sue under two more through PAGA, and the vendor can be a defendant. The table above names the enforcer for each rule; two points sit beneath it. The Labor Code penalties under SB 947 and AB 1331 name the Labor Commissioner and public prosecutors and create no private action. But the Private Attorneys General Act gives an aggrieved employee an alternative. The employee may sue for a Labor Code civil penalty “assessed and collected by the Labor and Workforce Development Agency or any of its departments, divisions.” The employee sues for themselves and for other current or former employees “against whom a violation of the same provision was committed.” Recoveries split 65 percent to the Agency and 35 percent to the employees. SB 947 calls its $500 a “civil penalty,” and the Labor Commissioner, whose division sits inside that Agency, issues it by citation. AB 1331’s penalty is enforced through the same citations; its penalty subdivision does not call it a civil penalty, though its enforcement subdivision routes it through the procedures for “citations and civil penalties issued by the Labor Commissioner,” its legislative digest calls it one, and no employee is named to receive it. AB 1883, signed the same day, writes its surveillance penalty so that an employee could take it as “a statutory penalty paid to the employee,” and AB 1331 has no such sentence. On this article’s reading both penalties are within the Act. If a court read AB 1331’s penalty otherwise, the Act’s default civil penalty, $100 per aggrieved employee per pay period, would likely apply, so the representative action remains either way.⁴

The Act has its own limits. The employee who sues must have personally suffered each violation alleged. The Act bars any action “for any violation of a posting, notice, agency reporting, or filing requirement,” which likely removes a claim based only on SB 947’s written post-use notice, though not the duty to have a human corroborate the system’s output. And an employer that took all reasonable steps to comply before receiving the employee’s notice is limited to 15 percent of the penalty sought. The cap is 30 percent if it takes those steps within 60 days after the notice. A court may depart from either cap where the capped award would be “unjust, arbitrary and oppressive, or confiscatory.” As of October 29, 2026, no decision or agency guidance has applied the Act to either statute. The practical point stands: plan for a representative action across every affected employee, not a single $500 citation.⁴

The vendor question has a California answer and a federal one. FEHA’s own definition of “employer” includes “any person acting as an agent of an employer, directly or indirectly,” and the Civil Rights Council’s regulations apply that definition to automated systems. An agent that exercises a function “traditionally exercised by the employer,” screening or hiring among them, “including when such activities and decisions are conducted in whole or in part through the use of an automated decision system,” “is also an ‘employer’ for purposes of the Act.” The federal counterpart is Mobley v. Workday, decided in the federal trial court for Northern California. The court held at the pleading stage that “a third-party agent may be liable as an employer where the agent has been delegated functions traditionally exercised by an employer.” It reasoned that the vendor’s software was alleged to be “not simply implementing in a rote way the criteria that employers set forth, but is instead participating in the decision-making process by recommending some candidates to move forward and rejecting others,” and that nothing in the statutes “distinguishes between delegating functions to an automated agent versus a live human one.” Mobley is a ruling on a motion to dismiss under Title VII, the Age Discrimination in Employment Act, and the Americans with Disabilities Act. In March 2026 the court dismissed, with leave to amend, the FEHA counts for want of a pleaded California connection and an added plaintiff’s ADA claim for want of facts showing an impact on applicants with physical disabilities. The plaintiffs re-pleaded, and in June 2026 the court let both proceed. As of October 29, 2026, a class-certification motion is pending, with a hearing set for March 9, 2027. The agent theory reaches a vendor that performs a delegated function, not every tool. A product that only ranks candidates for a recruiter who decides was not before the court, and whether it is an agent is untested.¹³

Three contract terms follow for the next vendor renewal. First, testing and data: a right to the vendor’s anti-bias testing, its recency, and its results, because the FEHA regulations make “the quality, efficacy, recency, and scope” of testing relevant evidence, and the employer that uses the tool answers the charge whether or not the vendor is also an “employer” as its agent. Second, records: the vendor’s cooperation in producing “automated-decision system data” for four years and the corroboration data SB 947 puts on the employer to produce. Third, indemnity, written for the delegated-function case Mobley describes and written around Colorado’s bar on indemnity for a party’s own acts or omissions if the employer hires there.¹³

If your vendor’s tool rejects candidates before a human sees them, the vendor performs the screening function the FEHA agent definition names. The theory Mobley let proceed at the pleading stage reaches it too. Your contract should treat it as a potential co-defendant rather than a supplier.

What should an employer do before January 1 and July 1, 2027?

Within 30 days: the inventory. List every tool that scores, ranks, flags, monitors, or recommends about applicants or employees, by the use in the table above. For each, record what a human does with the output. Note whether a reviewer who knows how to interpret the output analyzes it and can change the outcome, which places the tool inside or outside the CCPA rules. Note also whether a discipline or termination decision primarily relies on it, which triggers SB 947’s corroboration and notice. Pull the vendor contract for each and note whether it carries testing, records, and indemnity terms. Switch off, for California employees, any monitoring feature that reads emotional state or collects neural data unless its safety purpose is documented.

By January 1, 2027: the notices. If the business is subject to the CCPA, draft the pre-use notice for each tool that makes a significant decision. Deliver it to current employees before their existing data runs through the tool, and build the opt-out or the human-appeal path. If a site employs, or has employed in the past 12 months, 75 or more people, add the three technology-displacement facts and the required heading to the Cal-WARN notice template. Confirm that no surveillance tool monitors a workplace bathroom. Confirm too that any badge or alarm employees must carry does not detect or record audio or video and has no embedded or attached AI. Confirm that the policy lets employees leave other tools behind.

By July 1, 2027: the discipline workflow. Write the corroboration step into the discipline and termination process: who reviews, what they read, and where it is filed. Draft SB 947’s post-use notice as a stand-alone plain-language document that names a human contact and states that retaliation is prohibited. Decide how the employee’s request for “a meaningful, objective description of the employee’s own data” will be answered.

Ongoing: the evidence. Run anti-bias testing on each tool on a stated cadence, keep the results, and record the response to them, because FEHA weighs each of those. Retain automated-decision system data for four years. Renegotiate vendor contracts at renewal around the three terms above. For Colorado applicants, add the adverse-outcome explanation workflow, and track the xAI v. Weiser order that holds back Colorado enforcement as of October 29, 2026. For Illinois employees, add the AI-use notice.

Astraea Counsel maps each tool in an employer’s inventory to these duties and drafts the notices and records each one needs. Ask us to map your tools.

Conclusion

The thread through all three regimes is the record: what the tool did, what a human did with it, and what the testing showed. The employers that will be comfortable in 2027 are the ones that can produce that record today. If you want your tools placed on this table and the record built before the dates arrive, contact Astraea Counsel.

“The CCPA rules and SB 947 turn on the same question: when the system spoke, did a person decide? FEHA reaches the tool either way. Employers that can answer that question from their own files are in good shape. Employers that cannot are the ones I expect to see in the first PAGA notices.”—Chanté Eliaszadeh, Principal Attorney, Astraea Counsel APC

Related Resources

• California AI Laws 2026: The AI Regulation Tracker
• California AI Bills Signed September 2026: All Twenty-Seven, With Dates and Penalties
• Not an Agent. Not a Defense: Seven Doctrines That Already Hold AI Deployers Liable
• State AI Law Patchwork: 50-State Compliance Map

Change log

• October 29, 2026: first publication, current to the Civil Rights Council’s regulations operative October 1, 2025, the CCPA rules’ January 1, 2027 compliance date, and the four workplace statutes signed September 30, 2026.

This article provides general information for educational purposes only and does not constitute legal advice. Artificial intelligence and employment regulation is evolving rapidly. Consult qualified legal counsel for advice on your specific situation.

Footnotes

1. Cal. Code Regs., tit. 2, § 11008.1(a) PDF; § 11009(f) PDF; § 11013(c) PDF; § 11008(a), (l) PDF (each operative Oct. 1, 2025, Register 2025, No. 26). ↩ ↩² ↩³ ↩⁴ ↩⁵

2. Cal. Gov. Code § 12960(c), (e)(5) PDF; § 12965(a)(1), (c)(1) PDF. ↩

3. Cal. Code Regs., tit. 11, § 7001(e), (ddd), (ddd)(4) PDF; § 7200(a), (b) PDF; § 7220(a), (b)(2) PDF; § 7221(a), (b) PDF; § 7222(a), (b) PDF; Cal. Civ. Code § 1798.155(a) PDF; § 1798.199.90(a) PDF; § 1798.150(c) PDF. ↩ ↩² ↩³ ↩⁴ ↩⁵

4. S.B. 947, Stats. 2026, ch. 859 (Cal. Lab. Code §§ 1520(c), 1522(a), (b)(1), (b)(2), 1524(a), 1526.1(a), (b), (e), 1526.7) PDF; A.B. 1331, Stats. 2026, ch. 851 (Cal. Lab. Code § 1563(a), (d)) PDF; A.B. 1883, Stats. 2026, ch. 853 (Cal. Lab. Code § 1582(d)(2)) PDF; Cal. Lab. Code § 2699(a), (c)(1), (e)(2), (f), (g)(1), (h)(1), (k)(2), (m) PDF. That the SB 947 and AB 1331 penalties are recoverable under the Private Attorneys General Act, and that its notice bar reaches a claim based only on SB 947’s post-use notice, is this article’s reading of these statutes; as of Oct. 29, 2026, no decision or agency guidance has applied the Act to either part. ↩ ↩² ↩³ ↩⁴ ↩⁵

5. S.B. 951, Stats. 2026, ch. 860 (Cal. Lab. Code § 1401(d)(1)) PDF; Cal. Lab. Code § 1403 PDF; § 1404 PDF. ↩

6. A.B. 1331, Stats. 2026, ch. 851 (Cal. Lab. Code §§ 1561(a), 1563(a), (b), (d)) PDF. ↩

7. A.B. 1883, Stats. 2026, ch. 853 (Cal. Lab. Code §§ 1581(a), 1582(a), (b), (d)) PDF. ↩

8. Cal. Lab. Code §§ 1522(a), (b)(1), (b)(2), (c), (d), 1524(a), (b), 1526, 1526.1(a), (b), (c), (d), (e), 1526.5, 1526.6(a) (S.B. 947, Stats. 2026, ch. 859) PDF. ↩ ↩² ↩³ ↩⁴

9. Cal. Lab. Code §§ 1400.5(b), (e), 1401(d)(1), (d)(2), 1402.7(b), (e) (S.B. 951, Stats. 2026, ch. 860) PDF; Cal. Lab. Code § 1400 PDF; § 1403 PDF; § 1404 PDF. ↩ ↩²

10. Cal. Lab. Code §§ 1561(a), (b)(1), (b)(3), (c)(2), 1563(a), (b), (d) (A.B. 1331, Stats. 2026, ch. 851) PDF; Cal. Lab. Code §§ 1580(e), 1581(a), (b), 1582(a), (b), (d)(1), (d)(2) (A.B. 1883, Stats. 2026, ch. 853) PDF; Office of Governor Gavin Newsom, signing message on A.B. 1331 and A.B. 1883 (Sept. 30, 2026) PDF, https://www.gov.ca.gov/wp-content/uploads/2026/09/SIGN-msg-AB-1331.pdf. ↩ ↩²

11. Cal. Lab. Code §§ 1524(a), 1526.3, 1526.4 (S.B. 947, Stats. 2026, ch. 859) PDF; Cal. Code Regs., tit. 11, § 7220(b)(2) PDF. ↩

12. Colo. S.B. 26-189, 2026 Colo. Sess. Laws ch. 131, §§ 1, 5 (C.R.S. §§ 6-1-1701(2)(a), (3)(a), (4)(b), (5), (6)(b), (13), 6-1-1703, 6-1-1704(1) to (3), 6-1-1705(1)(a), 6-1-1706(1), (3), (4), 6-1-1707(1), (2), (7)(a), 6-1-1709(1)) PDF; Ill. P.A. 103-0804 (H.B. 3773, enacted Aug. 9, 2024), §§ 5, 99 PDF, https://www.ilga.gov/Documents/legislation/publicacts/103/PDF/103-0804.pdf; 775 ILCS 5/2-101(N) PDF; 775 ILCS 5/2-102(L) PDF PDF, https://www.ilga.gov/Documents/legislation/ilcs/documents/077500050K2-102.htm; 775 ILCS 5/7A-102(A)(1), (C-1), (D)(4) PDF, https://www.ilga.gov/Documents/legislation/ilcs/documents/077500050K7A-102.htm; X.AI LLC v. Weiser, No. 1:26-cv-01515-DDD-CYC (D. Colo. Apr. 27, 2026), ECF No. 24 (minute order) PDF, https://storage.courtlistener.com/recap/gov.uscourts.cod.253513/gov.uscourts.cod.253513.24.0.pdf. ↩ ↩²

13. Cal. Gov. Code § 12926(d) PDF; Mobley v. Workday, Inc., 740 F. Supp. 3d 796, 806—08 (N.D. Cal. 2024) PDF; Mobley v. Workday, Inc., No. 23-cv-00770-RFL, 2026 U.S. Dist. LEXIS 47180, at *6—10 (N.D. Cal. Mar. 6, 2026) (ECF No. 267) PDF; Mobley v. Workday, Inc., No. 23-cv-00770-RFL (N.D. Cal.), docket (ECF Nos. 287, 360, 418), https://www.courtlistener.com/docket/66831340/mobley-v-workday-inc/ (last visited Oct. 29, 2026); Cal. Code Regs., tit. 2, § 11008(a) PDF; § 11009(f) PDF; § 11013(c) PDF; C.R.S. § 6-1-1707(7)(a) PDF. ↩ ↩²