SB 947 Cleared the Senate 29-9. Your Sourcing Tool Owes 12 Months.
California's No Robo Bosses Act SB 947 forces AI sourcing tools to hand candidates a year of their own data. Audit your stack before Newsom signs.
On May 19, 2026, the California Senate passed SB 947, the No Robo Bosses Act of 2026, by a 29-9 vote. The Assembly has until August 31 to pass it. Governor Newsom has until September 30 to sign. If you run AI sourcing, you have until then to figure out whether your vendor can hand a candidate their own file.
That last sentence is the whole article. Most coverage of SB 947 is filed under "termination law" because the bill's headline restricts AI-driven firing. Read the text. The data-portability clause inside it lands on every ranker, parser, and outbound recommendation engine a recruiter touches, and the timing pairs with the CPPA's finalized ADMT regulations and Newsom's May 21 executive order. Three regimes, three enforcers, one January 1, 2027 compliance date.
What SB 947 actually says, in the parts trade press skipped
Sen. Jerry McNerney (D-Pleasanton), former co-chair of the Congressional AI Caucus, wrote the bill. The California Federation of Labor Unions, AFL-CIO, under Lorena Gonzalez, is the sponsor. They learned from the 2025 veto.
Newsom vetoed SB 7, SB 947's predecessor, citing "unfocused notification requirements" and "overly broad restrictions." So McNerney converted pre-use notice into post-use notice and narrowed the bill's restrictions to disciplinary, termination, and deactivation decisions. What he did not narrow is the definition of an Automated Decision System.
SB 947 defines an ADS as "any computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence" that issues a score, classification, or recommendation that materially impacts a worker. Crowell's client alert reads this as broad enough to capture sourcing rankers, resume parsers, and outbound recommendation engines. It is.
The load-bearing clause is the data-access right. Any worker can request, once every 12 months, "a copy of the most recent 12 months of the worker's own data primarily used by an ADS to make a disciplinary, termination, or deactivation decision." Enforcement runs through the Labor Commissioner at $500 per violation, plus a private right of action with possible punitive damages and attorney's fees.
The word "deactivation" is doing serious work
"Deactivation" is gig-economy vocabulary. It is what happens when a platform cuts a worker without firing them, because they were never an employee in the first place. Drop that word into a sourcing context and it covers exactly what your outbound tool does when it scores a passive candidate, decides not to surface them, and silently buries them in the long tail.
A vendor that sells "pure sourcing" cannot credibly argue this clause doesn't touch them. The CPPA's parallel ADMT regulations already cover hiring, work allocation, compensation, promotion, demotion, suspension, and termination as "significant decisions." Stack SB 947's deactivation language on top and the gap closes. If your tool ranks candidates and the ranking determines who hears from you, the ranking is a decision.
The CPPA regulations are the other half of the bind
The California Privacy Protection Agency finalized its Automated Decisionmaking Technology rules earlier this year. They take effect January 1, 2026, with compliance required by January 1, 2027, which is the date SB 947 would also kick in if signed.
The ADMT rules require pre-use notice, opt-out rights, access rights, and risk assessments any time ADMT is used to make a significant decision about a Californian. Penalties run up to $2,500 per violation and $7,500 per intentional violation, enforced by the CPPA and the California AG.
One AI sourcing incident can now trigger three parallel proceedings: a Labor Commissioner action, a CPPA enforcement matter, and an EDD reporting consequence under Newsom's executive order. The enforcers don't coordinate. They don't have to.
EO N-6-26 is the slow-motion piece
Newsom signed Executive Order N-6-26 on May 21, 2026. It directs the EDD to stand up an AI employment-impact dashboard within 90 days, roughly August 19, 2026, and to publish bi-annual summaries of business feedback on "the role of technological adoption in determining hiring or workforce decisions" through end of 2027.
That dashboard is going to surface vendor names. The EDD is collecting business feedback specifically about hiring and workforce decisions tied to AI adoption. Vendors that are subject to active litigation or enforcement actions are going to show up in those summaries. Procurement teams will read them.
The shortlist paradox
There is a legal escape hatch in the CPPA rules: "meaningful human involvement." Littler's reading is that if a human "knows how to interpret outputs," reviews them, and has authority to overrule, the employer can exit the ADMT regime entirely.
This is where the value proposition of most AI sourcing platforms collapses on contact with the regulation. The whole pitch of a high-throughput ranker is that a recruiter cannot meaningfully review 4,000 candidates against a req. That is the point. If a human were going to read every profile, you wouldn't buy the tool.
The legal escape hatch is meaningful human review. The vendor pitch is meaningful human review never happens.
The vendors that survive 2027 will be the ones that lean into transparency rather than away from it: tools that show the recruiter exactly which signals drove a ranking, expose the underlying evidence in plain text, and let the recruiter overrule with a click. That is how you preserve meaningful human involvement at volume. Black-box scores don't get there.
This is the design philosophy behind Refolk. You ask in plain English, you get a ranked shortlist with the evidence visible inline, and the reasoning for every candidate is human-readable and exportable. When a worker asks for their file, you don't have to reverse-engineer a model. The data primarily used to score them is already the data you saw.
The procurement question every vendor will fail in 2026
Forget the policy whitepapers. There is one question that separates compliant vendors from liabilities:
"Can you export, today, in a human-readable format, the data primarily used to score a single named candidate over the last 12 months?"
Most AI sourcing tools cannot do this. They store models and aggregated signals, not per-candidate decision provenance. The signal that pushed a candidate from rank 47 to rank 312 last March is not retrievable in April. The model has been retrained twice since.
If the vendor's answer involves "we'd have to talk to engineering," they are not compliant. If the answer is a screenshot of a dashboard, that is not "the data primarily used." If the answer is a model card, you are buying a class action.
What an AI sourcing audit looks like in Q3 2026
Run this on every tool your recruiters touch, not just the screening platforms. SB 947's definition of ADS doesn't distinguish between "screening" and "sourcing." Anything that produces a score, classification, or recommendation is in.
- Map every ADS in your funnel. That includes the rediscovery engine inside your ATS, the auto-ranker in your sourcing tool, any resume parser that emits a fit score, your outbound sequencer if it prioritizes who gets contacted, and any video interview tool. The Workday/HiredScore stack alone may surface three separate ADS instances.
- Test the 12-month export. Pick three real candidates from last quarter. Ask each vendor to produce the data primarily used to score them. Time it.
- Identify predictive behavior analysis. SB 947 bars ADS use for predicting beliefs, intentions, personality, or emotional state. If your video interview tool scores "engagement" or your sourcing tool scores "likely to switch," flag it.
- Audit customer ratings as inputs. SB 947 prohibits using customer ratings as the sole or primary input to employment decisions. This catches sales-team rankers that lean on NPS or CSAT.
- Document meaningful human involvement. For every ADS that survives, write down which named human reviews outputs, what training they have, and how they can overrule. If you can't, the escape hatch is closed.
The audit is also a sourcing strategy. Tools like Refolk that surface the reasoning per candidate let you run an audit by exporting a shortlist and reading it. The audit artifact and the recruiter workflow are the same document.
What the litigation already tells you
You don't have to wait for SB 947 to see how this plays.
In Mobley v. Workday, Judge Rita Lin in the Northern District of California held that Workday could be treated as an "agent" of employers under the ADEA for algorithmic screening. She conditionally certified a collective action in May 2025. The "vendor as agent" doctrine is now live federal law in California.
In Kistler v. Eightfold AI, filed January 2026 in California state court by Outten & Golden and Towards Justice, with former EEOC chair Jenny Yang leading, plaintiffs allege Eightfold compiled "consumer reports" on applicants, scoring them 0 to 5 against more than 1.5 billion data points, without FCRA or ICRAA disclosures.
And in Harper v. Sirius XM Radio, filed in the Eastern District of Michigan in August 2025, plaintiffs allege an AI hiring tool excluded Black applicants through shortlisting signals correlated with race: educational background, employment history, zip code. Sourcing, not just screening, is the litigation frontier.
The federal lawsuits are arriving at the same conclusion SB 947 starts from: candidates have a right to see the data used to decide about them. The fastest way to survive both is to buy tools where the data is visible by default. The slowest way is to keep buying black-box rankers and hope the regulator skips your file.
What to do before September 30
The Assembly vote is the next hinge. If SB 947 reaches Newsom in something close to its current form, the data-access right is the load-bearing wall, which means he is likely to sign. The veto risk lives elsewhere, in the predictive-behavior and customer-rating restrictions. The 12-month clause is the part to plan around.
Three moves between now and Q4:
- Reopen vendor contracts written in 2024 or 2025. Most don't include data-portability clauses scoped to the SB 947 language. Add them now while you still have leverage. After January 1, 2027, vendors will be writing the terms.
- Move the highest-volume sourcing workflows to tools where the reasoning is exportable. If your recruiters can already see and edit the criteria that drove a ranking, the candidate file writes itself. This is one of the reasons teams have moved outbound discovery to Refolk: ask in plain English, get a ranked shortlist, and the per-candidate evidence is the same artifact a compliance request would need.
- Train recruiters on meaningful human involvement, in writing. The CPPA escape hatch requires documentation. A Loom video of a sourcer reviewing outputs is worth more than a vendor whitepaper.
The recruiters who win 2027 are not the ones with the biggest stack. They are the ones whose stack can answer a single candidate's question in under an hour.
FAQ
When does SB 947 take effect if Newsom signs it?
The likely effective date is January 1, 2027, the same date employers must comply with the CPPA's finalized ADMT regulations. The Legislature has until August 31, 2026 to pass the bill, and Newsom has until September 30, 2026 to sign or veto. That gives talent teams roughly one fiscal quarter to audit and replace non-compliant tools.
Does SB 947 apply to sourcing tools or just screening tools?
The bill's ADS definition covers any computational process that issues a score, classification, or recommendation that materially impacts a worker. The data-access right attaches to disciplinary, termination, or "deactivation" decisions. "Deactivation" is broad enough to capture passive-candidate ranking decisions made by outbound sourcing tools, and the parallel CPPA ADMT rules explicitly cover hiring decisions. Sourcing is in scope under at least one of the two regimes, regardless of how a vendor markets itself.
What is the single best procurement question for an AI sourcing vendor right now?
"Can you export, today, in a human-readable format, the data primarily used to score a single named candidate over the last 12 months?" If the vendor cannot demonstrate this in a live test, they are not architected for SB 947 or the CPPA ADMT rules. Most current tools store models and aggregated signals rather than per-candidate decision provenance, which is why this question filters the market quickly.
How does this interact with Mobley v. Workday and the Eightfold lawsuit?
Mobley established that AI sourcing and screening vendors can be treated as agents of the employer under federal anti-discrimination law in California. Kistler v. Eightfold extends a parallel theory under FCRA and ICRAA, alleging vendors compile consumer reports without proper disclosure. SB 947 codifies a state-level version of the same access-and-dispute regime. Employers are now exposed under federal anti-discrimination law, federal credit-reporting law, and California state law, with three separate enforcers, for the same underlying tool choice.