California ADMT Regulations: What the Automated Decision-Making Rules Require by 1 January 2027

ADMT stands for automated decision-making technology. The rules are Article 11 of the CCPA regulations, sections 7200 to 7222. They were adopted in a package with rules on risk assessments, cybersecurity audits and insurance companies.

The agency's rulemaking page gives the dates. The board adopted the package on 24 July 2025. The Office of Administrative Law approved it and filed it with the Secretary of State on 22 September 2025. It took effect on 1 January 2026.

The ADMT article has its own compliance date. Section 7200 says a business that uses ADMT for a significant decision before 1 January 2027 must be in compliance no later than that date. A business that starts on or after that date must comply whenever it is using the technology for a significant decision.

Every row is taken from the regulation text or the agency's own pages, read on 12 November 2026. Section numbers refer to Title 11 of the California Code of Regulations.

The table is a map of the article and leaves out detail. The sections that follow give the conditions attached to each duty.

The agency's FAQ lists the thresholds. A business is covered if it has gross annual revenue of $26.625 million or more, a figure the FAQ gives as effective 1 January 2025. It is also covered if it buys, sells or shares the personal information of 100,000 or more California residents or households, or derives 50 percent or more of annual revenue from selling or sharing that information.

The FAQ says the law generally does not apply to nonprofits or government agencies. It also says consumers include California residents who are employees or job applicants, and that earlier exemptions for employee and business-to-business data expired on 31 December 2022. That is why these privacy rules reach hiring and workplace tools.

Employers have a second set of rules to read. The research notes record that California Civil Rights Council regulations on automated-decision systems took effect on 1 October 2025, and that Mayer Brown reports a four-year record-keeping period under them. Those rules come from employment discrimination law and apply separately.

ADMT means any technology that processes personal information and uses computation to replace human decision-making or substantially replace it. Substantially replace means the business uses the output to make a decision without human involvement.

Human involvement has three parts. The reviewer must know how to interpret and use the output, must review and analyze the output and any other relevant information, and must have the authority to make or change the decision. A person who clicks approve on whatever the software recommends would not appear to meet that description.

Ordinary tools are excluded as long as they do not replace human decision-making. The regulation lists web hosting, data storage, firewalls, spam filtering, spellchecking, calculators, databases and spreadsheets, among others. The table shows what counts as a significant decision.

Section 7220 requires the notice to be presented prominently and conspicuously at or before the point when the business collects the personal information it plans to process with ADMT. If the information was collected earlier for another purpose, the notice comes before the new processing. It must be presented in the manner in which the business primarily interacts with the consumer.

The purpose has to be specific. The regulation says a business must not describe it in generic terms such as to make a significant decision. The notice must also say how the technology processes personal information, what type of output it produces, how that output is used, and what the alternative process is for someone who opts out.

A business may fold the notice into its notice at collection if all the required content is there. It may give one consolidated notice for several uses. Trade secrets and information that would undermine security or fraud prevention do not have to be included.

• A plain-language explanation of the specific purpose for which ADMT will be used.
• The right to opt out and how to submit the request, or the right to appeal if the human appeal exception is used.
• The right to access ADMT and how to submit that request.
• A statement that the business may not retaliate against consumers for exercising their rights.
• How the ADMT works: the categories of personal information that affect the output, the type of output, and how it is used in the decision.

Section 7221 requires two or more designated methods for submitting an opt-out. A business that interacts with consumers online must at least offer an interactive form reached from a link in the pre-use notice. A cookie banner does not count by itself. The business may not require an account or a verified request.

Timing is set out in the text. If the consumer opts out before processing starts, the business must not start. If the request comes later, the business must stop processing that person's information with the ADMT as soon as feasibly possible and no later than 15 business days after receiving it. It must also tell its service providers. It must then wait at least 12 months before asking that person to consent again.

There are three exceptions. The first is the human appeal exception: the business gives the consumer a way to appeal the decision to a human reviewer who has authority to overturn it. The second covers admission, acceptance and hiring decisions where the ADMT is used solely to assess the person's ability to perform and does not unlawfully discriminate. The third covers allocation of work and compensation on the same conditions.

A business that relies on an exception has to say so. The pre-use notice must describe the appeal process, or identify the specific exception relied on.

Section 7222 lists what a response must contain. It covers the specific purpose for which ADMT was used with respect to the consumer, information about the logic that lets the person understand how their information produced an output, and the outcome of the decision-making process, including how the output was used.

Generic language is ruled out here too. The regulation gives to improve our services as an example of a purpose description that is not acceptable. If a human took part in a way that falls short of the human involvement standard, the response should say what that person's role was.

Access requests are verified like other CCPA requests. A business may use its existing methods for requests to know, delete or correct. As with the notice, trade secrets and security-sensitive information may be left out.

Section 7150 lists the processing activities that present significant risk to consumers' privacy. Using ADMT for a significant decision concerning a consumer is on the list. A business must conduct a risk assessment before initiating that processing.

For processing that began before the regulations took effect and continues afterwards, the assessment is due no later than 31 December 2027. Risk assessment information for 2026 and 2027 must be submitted to the agency no later than 1 April 2028.

The research notes record the same dates from summaries by the law firms Hunton and Manatt. Cybersecurity audit duties in the same package phase in on a separate schedule tied to revenue, which this article does not cover.

The steps below follow the order of the regulation. Whether a given tool is ADMT, and whether a business is covered at all, are questions for counsel.

The inventory comes first because every later step depends on it. A notice cannot name a specific purpose until someone has written down what each tool decides.

• List each tool that produces a score, ranking or recommendation used in lending, housing, education, employment or health-care decisions.
• For each, record whether a human with authority reviews the output and can change the decision.
• Choose between offering an opt-out and offering a human appeal, and document the choice.
• Draft the pre-use notice with a specific purpose statement and place it where the information is collected.
• Build two opt-out methods and a way to confirm a request was processed.
• Prepare the access response and start the risk assessment.
• Keep a dated record of each notice delivered and each request received.