November 5, 2026 | Venture Commercial Insurance Agency
An automated performance score can look precise while missing the circumstances that explain an employee’s work. When that score influences discipline or termination, the consequences can reach beyond an incorrect management decision to employment litigation, privacy disputes, and questions about insurance coverage.
California’s SB 947, the No Robo Bosses Act of 2026, puts human oversight at the center of these decisions. Governor Gavin Newsom signed the legislation on September 30, 2026. The governor’s office and the bill’s author confirm that employers may not rely solely on automated decision systems to fire or discipline employees, and that human oversight and verification are required. [1][2]
For employers, the practical task is to connect technology controls, employment practices, and insurance before a disputed decision occurs.
What changes under SB 947
Beginning July 1, 2027, primary reliance on an automated decision system for discipline or termination requires human corroboration. Uncorroborated, inaccurate, incomplete, or misleading output cannot support the decision. Covered systems extend beyond generative AI to certain statistical and analytics tools. [3]
Primary reliance also triggers a separate, plain-language notice when the decision is communicated, identifying the automation, human review, a contact, and retaliation protections. Employees may request an objective description of their own input data; other people’s information must be anonymized. Prohibitions address unlawful uses, protected-status inference, and predicting and taking adverse action for exercising legal rights. [3]
Enforcement includes Labor Commissioner and public-prosecutor actions and $500 civil penalties per violation. Certain proceedings shift the burden to employers to establish nonprimary reliance or compliance. Specified collective bargaining and federal-purpose exceptions require individual review. [3]
The management response should be substantive: reviewers need enough information to evaluate a recommendation and explain their decision. A signature alone tells little about whether anyone checked the underlying facts.
Existing discrimination and privacy obligations still matter
Employers should already be examining algorithmic bias. California’s Civil Rights Council regulations, effective October 1, 2025, clarify that automated systems can violate employment discrimination law when they disadvantage people based on protected characteristics. They also require covered employment records, including automated-decision data, to be retained for at least four years. [4]
Federal protections apply as well. The EEOC identifies risks involving tools that screen out qualified people with disabilities, fail to accommodate them, or elicit prohibited medical information. Its guidance illustrates how measuring productivity through keystrokes can disadvantage an employee who uses voice recognition because of a visual disability. [5][6]
Separately, businesses subject to the California Consumer Privacy Act must assess the CPPA’s automated decisionmaking technology rules. Compliance for covered significant decisions begins January 1, 2027. The regulations provide pre-use notice, access, and opt-out requirements, subject to applicable exceptions. Their definition focuses on technology that replaces or substantially replaces human decisionmaking; qualifying human involvement requires understanding, analysis, and authority to change the decision. Applicability therefore needs its own assessment. [7][8]
Where insurance enters the discussion
The insurance analysis below identifies potential coverage questions. It does not establish coverage for an individual claim or predict how insurers will price this law.
Employment practices liability: start with the alleged harm
Employment practices liability insurance, or EPLI, is the first policy to examine when an employee alleges wrongful termination, discrimination, or retaliation. The California Department of Insurance identifies employment-related liability claims as the purpose of this coverage; Travelers likewise describes coverage for defense costs and damages associated with these allegations. [9][10]
Consider a hypothetical warehouse employee whose productivity score falls after an approved accommodation changes how tasks are performed. Management terminates the employee without investigating the discrepancy. A resulting claim might allege disability discrimination as well as failures involving automated review. That combination warrants a detailed EPLI review.
Ask whether the policy’s definitions of an employment wrongful act and a claim encompass the allegations and proceeding involved. Examine AI-specific restrictions, statutory exclusions, retentions, defense arrangements, and whether defense expenses reduce the available limit. Check any requirement to obtain insurer consent before hiring counsel or resolving a dispute. These are policy-review questions, not assurances that a particular form will respond.
Civil penalties and compliance costs need separate treatment
A policy that may defend a discrimination allegation does not necessarily pay a statutory penalty. The Reinsurance Association of America notes that EPLI commonly excludes civil fines and penalties and may exclude other employment-law liabilities. [11]
Employers should distinguish damages, defense expenses, penalties, and the cost of changing business practices. Budget for notices, system changes, training, and recordkeeping as operating responsibilities unless a specific policy provision establishes otherwise. Review the definition of loss and the treatment of statutory remedies with the broker and coverage counsel.
Cyber and privacy: examine employee data and the coverage trigger
Automated employment systems can create a second set of questions about the information collected, disclosed, retained, and shared with vendors. Travelers describes cyber coverage as addressing costs associated with cyber events or security breaches, including forensic work and certain regulatory expenses. That description should not be read as a promise to cover every dispute involving data. [10]
The practical review should ask whether employee information falls within the policy’s protected data, whether privacy liability can respond without a security breach, and how employment-related exclusions operate. Also examine coverage for outsourced processing, regulatory investigations, and legally insurable penalties. A lawful system that produces a disputed employment recommendation presents a different coverage question from a breach exposing personnel files.
Management liability and vendors: check the boundaries
Travelers describes D&O coverage as addressing claims alleging wrongful acts by directors or officers. An allegation that leadership ignored repeated warnings about an employment system could prompt a management-liability review. Employment exclusions, insured capacities, and allocation between policies would still need examination. [10]
Vendor arrangements deserve equal attention. As a risk-management measure, request support for explaining outputs, retrieving relevant records, investigating errors, and responding to claims. Review indemnity provisions, liability caps, and evidence of appropriate technology errors and omissions and cyber insurance. A certificate is only a starting point; the contract and relevant policy language determine how much protection is available.
Prepare around the decision, the evidence, and the claim
Employers can organize preparation around five practical steps:
Map actual uses: Identify systems whose scores or recommendations influence employee decisions, including tools purchased outside HR.
Make review meaningful: Train reviewers to inspect source information, question inaccurate assumptions, consider accommodations, and document their reasoning.
Coordinate records and notices: Establish an owner for employee requests, secure responses, retention, and applicable privacy workflows.
Review coverage before renewal: Give the broker an accurate description of automated employment uses and examine EPLI, cyber, and management liability together.
Plan claim reporting: Check each potentially relevant policy’s notice requirements when a complaint, demand, or investigation arrives, and preserve the evidence supporting the decision.
The strength of an insurance program depends partly on how clearly the organization can explain what happened. Understanding the tool, verifying its output, and preserving the basis for a decision can support both sound employment practices and an effective response when a claim arises.
Sources
Governor of California — September 30, 2026 signing announcement.
Senator Jerry McNerney — No Robo Bosses Act signing announcement.
SB 947, chaptered September 30, 2026 — enacted text reproduced by CalMatters Digital Democracy, Labor Code §§1520–1526.7. The official legislative website blocked direct retrieval; the chaptered text was reviewed through this independent reproduction, rather than relying on summaries of earlier versions.
California Civil Rights Department — approval of automated-decision employment regulations.
EEOC — warning against disability discrimination involving AI and software.
EEOC — Visual Disabilities in the Workplace and the ADA, questions 16–17.
CPPA — approved regulations text, §§7001(e), 7200, 7220–7222.
Travelers — Management and Professional Liability Insurance. Product descriptions provide general context, not the terms of an issued policy.
Reinsurance Association of America — Employment Practices Liability Insurance. General coverage background; actual policy terms and applicable law control.
