California AB 2027 explained: proposed limits on AI and worker data

What is California AB 2027 and does it limit AI training on worker data?

AB 2027 is a 2026 California Assembly bill that, as introduced, would have restricted using a worker's personal information to train AI that replicates that worker's job. It was reported held in the Assembly Appropriations Committee in May 2026, which ordinarily means it did not advance that year. We have not linked a primary source for that status, so verify it on the official bill page. As far as we know it is not law. It still signals a policy direction that a company licensing workplace records should plan around.

This is general information, not legal, tax or financial advice. Bill text and status change; check the official California Legislative Information site for the current version and history, and confirm with your own counsel before acting.

What the bill was aiming at

The concern behind bills like this is specific: employee communications, work product and performance data being used to build systems that perform the employee's own role. Records of how people do their jobs are exactly what AI developers want, because agents learn from real workflows, decisions and outcomes. That overlap is why owners should read the bill as a preview of questions that employees, unions and legislators may ask about any licensing deal.

California rules that already apply to personal information

Separately from this bill, California's privacy statute already regulates how businesses handle personal information. The California Consumer Privacy Act text requires notice at collection of the categories of personal information and purposes, requires that use and sharing be reasonably necessary and proportionate, and calls for written agreements limiting use when information is sold, shared or disclosed to service providers or contractors. Whether and how it reaches a given company's employee or business records depends on the company and the data, so ask counsel. Other states have their own rules.

How to plan a license around worker-data risk

• List the systems that hold employee-authored content: email, Slack or Teams, ticket queues, call recordings, performance notes.
• Decide which categories to exclude outright, such as HR files, performance reviews, medical or leave records and anything tied to named individuals.
• Agree redaction and de-identification rules before any work begins, as SourceX requires for every deal.
• Check employee handbooks and notices for promises about how workplace records are used.
• Decide who tells staff, and when, before an agreement is signed.
• Ask counsel whether any state law where employees work adds a notice, consent or restriction.
• Keep the scope narrow enough that one category can be dropped later without unwinding the deal.

What to say when staff ask

How this connects to other risks

A narrowed scope helps with several risks at once. Read what happens if AI law changes after you license for how contracts handle new rules, whether licensed data can be subpoenaed for the legal-process side, and how to answer a customer who asks about AI for the outward-facing conversation. For what failed in earlier attempts, see why data monetization attempts failed. Some companies also ask about the limits of synthetic data as an alternative; sponsors may prefer the portfolio reputational view.

When to wait

If the records are mostly individual employee data, or counsel cannot confirm the legal basis for licensing them, hold off. A company that is not ready now can qualify later once the scope and notices are sorted.

Next step

Check the bill's official status page, then take the checklist to counsel. Advisers who know a US company with 50+ full-time employees at peak (contractors excluded) can register as a partner and make the introduction, and the earnings calculator shows how the program's reward formula works.