California AI-in-Employment Rules, EU Penalties, Canada's Screening Rules & Global Compliance Updates: October 2026

The rulebook on AI at work just got rewritten, one signature at a time

Last month, we wrote that enforcement had stopped being theoretical; regulators around the world were sitting up, taking notice, and acting. This month, legislators followed suit with new rules of their own: California's governor signed more than 20 AI bills, Texas began enforcing its AI governance law, and regulators in Brussels, London, and Ottawa published the playbooks (however general) they will use to audit and fine. Meanwhile, three compliance deadlines are now close enough to circle on the calendar.

This month, we'll cover the critical compliance updates every global employer should know about, where AI at work is being regulated first, and which dates matter before the year ends.

5 new global compliance updates 

#1. California rewrites the rules on AI in employment

Governor Newsom signed more than 20 AI-related bills into law between September and October, and the new laws deserve every employer's attention.

Three new AI-in-employment laws take effect 1 January, adding to California's existing automated decision-making rules. Further out, the "No Robo Bosses Act" (SB 947) adds Labor Code requirements for employers using automated decision systems in discipline and termination, effective 1 July 2027. A new restriction on AI-based employee monitoring is already in force, prohibiting employers from using AI surveillance to assess workers' emotional states or collect neural data.

Interestingly, one change makes it harder for individuals to sue over tracking by websites and mobile apps. SB 690 eliminates the private right of action for website "pen register" claims under the California Invasion of Privacy Act (CIPA), shutting down one of the fastest-growing privacy litigation theories in the country.

Key takeaway

If you deploy AI anywhere in the California employment lifecycle, here are three things to do:

• Inventory every automated tool that touches hiring, monitoring, discipline, or termination decisions before 1 January.
• Confirm no tool assesses emotional states or collects neural data; that prohibition is already live.
• Build the human-review and documentation trail now; SB 947's 2027 date rewards early movers.

#2. Texas enforces responsible AI governance, and BIPA bites twice in Illinois

California is not acting alone. The Texas Attorney General is now enforcing the Texas Responsible AI Governance Act (TRAIGA). The law prohibits deploying AI to intentionally discriminate against protected classes, including in recruitment. Penalties are far-reaching, up to $200,000 per violation, with a 60-day cure period and a safe harbour for organisations that align with the NIST AI Risk Management Framework.

Illinois, meanwhile, reminded everyone that the oldest biometric law still has the sharpest teeth. In Cisneros v. Nuance, the Seventh Circuit held that the financial-institution exemption in the Biometric Information Privacy Act (BIPA) is narrow: a voiceprint vendor escaped liability only because its client was a broker-dealer, and the court stressed that biometric identity verification outside finance requires full BIPA notice and consent. Days later, a judge ruled that Apple must face a BIPA trial over claims that the iPhone's Photos app scans faces without consent. As we look forward, we cannot forget the regulations already in place.

Key takeaway

Identity verification is becoming standard in screening workflows, and much of it is biometric. If your vetting process uses voiceprints, face matching, or similar checks on Illinois residents, the exemptions are narrower than vendors tend to suggest. Get the notice and consent documentation in place before the plaintiffs' bar forces your hand.

#3. Europe standardizes the fine print, literally

European regulators have not sat still. After a summer of record penalties, they spent the autumn building the machinery to make those penalties repeatable. The European Data Protection Board (EDPB) opened a consultation on draft guidelines for GDPR administrative fines and corrective powers, running until 13 November. A standardised fining methodology means less variation between Data Protection Authorities (DPAs) and less room to "shop" for a friendlier regulator.

In the UK, the Financial Conduct Authority's (FCA) non-financial misconduct changes went live in September. While there has yet to be any public enforcement, employers should be aware that regulatory references are already required between firms. Substantiated misconduct must now follow an individual from firm to firm and cannot be suppressed by settlement or exit agreements. Hiring firms should read references accordingly.

The UK's scrutiny is expanding beyond financial services, too. The Information Commissioner's Office (ICO) announced that ten leading AI developers have made, or committed to, privacy changes under its supervision, and said its scrutiny now extends to AI agents. This change has a significant impact on modern AI tools across the UK, and more is to be expected.

One counterpoint worth knowing: the EU's push to simplify GDPR stalled this month as member states work out how to negotiate updates. The simplification effort may be slowing down, but enforcement is not.

Key takeaway

The Uber fine we covered last month was the warning shot before a possible barrage. The fining guidelines are the artillery manual.

Regulators are standardising penalties, meaning organisations that improperly process EU personal and candidate data will face more consistent consequences, regardless of which regulator handles the case. The only "out" is to document a lawful basis and provide appropriate human oversight.

#4. Canada puts screening vendors under the microscope

Canada's Office of the Privacy Commissioner (OPC) released draft guidance on third-party service providers, open for comment until 4 December. It sets out what the Personal Information Protection and Electronic Documents Act (PIPEDA) expects when organisations hand personal data to vendors: due diligence before contracting, contractual safeguards, and ongoing oversight. Sign and forget is no longer an option. For employers that rely on background check and screening partners, this is the document their privacy teams will be marking against. It also suggests that further announcements, and changes, can be expected in the new year.

The OPC also asked the Federal Court to decide a question with long-term implications for online information: whether PIPEDA gives individuals a right to have search results delisted. A ruling in favor would reshape how long online information about a person remains findable in Canada.

Key takeaway

Canadian employers will increasingly be asked to show their homework on screening vendors. They will need to answer what they assessed before contracting, how bona fide risk was established, what the contract requires, and how they verify it. Employers should ask vendors for supporting documentation.

#5. Key deadlines in India, Australia, and the U.S.

Three dates to circle before the year ends!

India, 13 November. Consent manager registration under the Digital Personal Data Protection (DPDP) Rules formally opens. There is one hiccup, however: the Data Protection Board that processes registrations still has no appointed members. The obligation arrives on schedule; the machinery may not. Keep your May 2027 compliance plan moving and watch for appointments. Once the Board is staffed, enforcement will follow quickly.

Australia, 10 December. The Tranche 1 transparency requirements for automated decision-making (APP 1.7) take effect. Privacy policies must disclose automated decisions that significantly affect individuals, and human sign-off does not exempt a decision the system effectively steers. Under Tranche 1, the Children's Online Privacy Code must also be registered by the same day. Meanwhile, Tranche 2 has moved from promise to paper: an exposure draft of the Privacy Amendment Bill, released 31 August, includes a fair and reasonable test, a right to erasure, and 72-hour breach notification.

United States, 11 December. Federal funding runs out. If Congress does not pass a new funding bill or continuing resolution, past lapses are the guide: E-Verify goes offline, and EEOC operations largely pause. Employers with high-volume hiring should know that I-9 obligations continue: they must still complete and retain Form I-9s whether or not E-Verify is available.

Key takeaway

None of these dates is a surprise, and that is the point. Regulators are publishing their timelines in advance and expecting organisations to arrive prepared. Those who treat published deadlines as a surprise should expect penalties.

AI at work is now a regulated activity. Treat it like one.

The thread running through October is that using AI on people at work, whether to hire them, monitor them, or let them go, is no longer a grey area in a growing list of jurisdictions. California and Texas are writing the rules into statute. Europe is standardising how violations get priced. Canada is asking who you trusted with the data and why. The common demand is the one we keep returning to: evidence of a lawful basis, a necessary purpose, and human accountability for the outcome.

This is where Fama comes in.

As organisations look to balance effective risk mitigation, privacy-first practices, and compliance, Fama's policy-based social media screening is designed to surface behaviours that violate your policies and create workplace risk while respecting individual privacy and evolving global regulatory standards. With AI-at-work rules multiplying across jurisdictions, a compliant, defensible, and documented approach to screening isn't just good practice; it's a competitive advantage.

Learn how Fama compliantly screens for what matters most, request a demo.