California's Automated Decisionmaking Technology Regulations: What a Business Must Do and When

Last updated: November 2026. Reviewed by Pavel Kolmogorov, California business litigation attorney (State Bar No. 321018).

California's automated decisionmaking technology (ADMT) regulations apply to a business covered by the CCPA that uses technology to make a significant decision about a consumer without human involvement. Such a business must give a pre-use notice, offer an opt-out or a human appeal, and answer access requests. Those duties must be met by January 1, 2027. (Cal. Code Regs., tit. 11, § 7200.) A risk assessment is also required, and for processing that began before 2026 it is due by December 31, 2027. Kolmogorov Law, P.C. advises businesses on AI compliance.

Call (909) 235-6116 or contact us online to discuss whether these regulations reach your business.

The regulations are final, and here is who they cover

The rules were filed on September 22, 2025 and became operative on January 1, 2026. They implement a statute calling for regulations on ADMT access and opt-out rights and on risk assessments. (Civ. Code, § 1798.185, subd. (a)(14), (15).)

They apply only to a "business" as the CCPA defines it. Its main category is a for-profit entity doing business in California that collects consumers' personal information, decides how it is processed, and meets one of three thresholds.

Annual gross revenues above $25,000,000 in the preceding calendar year, as adjusted for inflation ($26,625,000 as posted effective January 1, 2025).
Buying, selling, or sharing the personal information of 100,000 or more consumers or households a year.
Deriving 50 percent or more of annual revenues from selling or sharing personal information.

Three further categories exist, including an entity that controls or is controlled by such a business, shares its branding, and receives consumers' personal information from it, and certain joint ventures. (Civ. Code, §§ 1798.140, subd. (d), 1798.199.95, subd. (d).)

A consumer is any natural person who is a California resident. (Civ. Code, § 1798.140, subd. (i).) The regulations name job applicants, employees, and independent contractors.

What counts as ADMT and as a significant decision

ADMT is any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace it. A business substantially replaces human decisionmaking when it uses the technology's output to make a decision without human involvement.

The reviewer must know how to interpret and use the output, must review the output and any other relevant information, and must have authority to make or change the decision. Tools such as spreadsheets, calculators, and spam filters are excluded, provided they do not replace human decisionmaking. (Cal. Code Regs., tit. 11, § 7001, subd. (e).)

A significant decision is one that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. Employment decisions include hiring, the assignment of work, compensation, promotion, demotion, suspension, and termination. Advertising to a consumer is not a significant decision. (Cal. Code Regs., tit. 11, § 7001, subd. (ddd).)

Software that scores applicants and rejects those below a cutoff, with no qualifying human review, fits both definitions. Our page on the algorithmic pricing law covers pricing tools.

The pre-use notice

A business that uses ADMT for a significant decision must give consumers a pre-use notice. It must be presented prominently at or before the point where the personal information is collected, and it may be part of the notice at collection. Information collected earlier for another purpose requires notice before the ADMT processing. The notice must explain, in plain language:

The specific purpose of the ADMT. A generic phrase is not enough.
The right to opt out, or the appeal process if the business relies on the human appeal exception.
The right to access information about the ADMT.
That the business may not retaliate against a consumer for exercising CCPA rights.
How the ADMT works: the categories of personal information that affect the output, and how the output is used.

Trade secrets and certain security information may be left out of the last item. (Cal. Code Regs., tit. 11, § 7220.)

Opt-out, human appeal, and access requests

The default is an opt-out, with two or more ways to submit the request. The business need not offer an opt-out in three situations:

It provides a way to appeal the decision to a qualified human reviewer who has authority to overturn it.
For admission, acceptance, or hiring decisions, it uses the ADMT solely to assess ability to perform, and the tool works for that purpose and does not unlawfully discriminate.
For decisions on the assignment of work and compensation, it uses the ADMT solely for that purpose, with the same two safeguards.

A consumer who opts out after processing has begun must be removed from it as soon as feasibly possible, and no later than 15 business days after the request. (Cal. Code Regs., tit. 11, § 7221.)

On an access request, the business must explain the specific purpose for which it used the ADMT, the logic of the tool, and the outcome for that consumer. The logic must be explained so the consumer can understand how the tool processed their information. (Cal. Code Regs., tit. 11, § 7222.)

Risk assessments can be required without any AI

A risk assessment is required before a business begins any of six kinds of processing. They include selling or sharing personal information, processing sensitive personal information (with a limited exception for some employee data), and using ADMT for a significant decision. (Cal. Code Regs., tit. 11, § 7150.)

For processing that began before January 1, 2026 and continues, the assessment is due by December 31, 2027. Assessments must be reviewed at least every three years and updated as soon as feasibly possible, and no later than 45 calendar days, after a material change. (Cal. Code Regs., tit. 11, § 7155.) For assessments conducted in 2026 and 2027, specified information and an attestation by a member of executive management go to the state privacy agency by April 1, 2028. (Cal. Code Regs., tit. 11, § 7157.)

Our California AI compliance guide sets these dates beside the cybersecurity audit schedule.

How the rules are enforced

The California Privacy Protection Agency may impose administrative fines of up to $2,500 for each violation, or $7,500 for an intentional violation. (Civ. Code, § 1798.155, subd. (a).) The Attorney General may seek civil penalties in the same amounts. (Civ. Code, § 1798.199.90, subd. (a).) The higher amount also applies to certain violations involving minors' personal information. Both amounts are adjusted for inflation. (Civ. Code, § 1798.199.95, subd. (d).)

Consumers cannot sue over these rules under the CCPA. Its private cause of action covers only the security breaches defined in the statute and may not rest on any other section. (Civ. Code, § 1798.150, subd. (c).) Our page on CCPA data breach lawsuits covers that claim.

What to do before January 1, 2027

List every tool that screens, scores, ranks, or decides about people, and whether a qualified person reviews its output.
Choose an opt-out or a human appeal.
Ask vendors for what you need to explain a tool's logic, as our page on AI vendor contracts describes.

What to bring to the first meeting

A list of the automated tools in use and what each decides.
Vendor agreements, technical documentation, and current privacy notices.
Figures that bear on the CCPA thresholds.

Frequently asked questions

We use software to score applicants and customers. What do California's automated decision-making rules require of us and when?

If your business is covered by the CCPA and the software makes significant decisions without qualifying human involvement, California requires three things by January 1, 2027: a pre-use notice, an opt-out or human appeal, and responses to access requests. A risk assessment is required too, due by December 31, 2027 for uses that began before 2026.

If a manager reviews every recommendation our software makes, are we still using automated decisionmaking technology under the California rules?

Not necessarily. The California regulations treat a tool as ADMT when its output is used to make a decision without human involvement. The reviewer must know how to interpret the output, must analyze it with other relevant information, and must have authority to change the decision.

Are the CCPA ADMT regulations in effect?

They are final and operative, with a phase-in. The California regulations were filed on September 22, 2025 and became operative on January 1, 2026. A business that uses ADMT for a significant decision before January 1, 2027 must comply with the ADMT article by that date. From then on, compliance is required whenever the technology is so used.

What is a significant decision under the CCPA regulations?

It is a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. California's regulations exclude advertising to a consumer from the definition.

Can a consumer sue a business for violating the ADMT rules?

Not under the CCPA. The California statute limits its private cause of action to the security breaches it defines and bars claims based on other sections. The California Privacy Protection Agency and the Attorney General enforce the rules, with fines or penalties of up to $2,500 or $7,500 per violation, as adjusted for inflation.

Talk to a California AI compliance attorney

If your business uses software to make decisions about applicants, workers, or customers, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is in Irvine, California.

This page provides general information about California law and is not legal advice. The regulations are new, and how they apply depends on the technology, the facts, and the current text.