Yet.
As of January 1, 2026, that model is subject to the most comprehensive AI governance framework any US state has enacted. If your business meets CCPA thresholds and that model makes decisions without meaningful human involvement — you're already operating under California's Automated Decision-Making Technology regulations.
The compliance clock didn't start when you noticed.
Fines run up to $2,500 per unintentional violation and $7,500 per intentional violation — applied per consumer. A hiring system that has screened thousands of applicants compounds that exposure rapidly. The California Privacy Protection Agency currently has hundreds of active investigations open.
The question isn't whether California regulates AI. It's which of your systems triggered which obligations, and when.
TL;DR
- California's CCPA ADMT regulations — finalized September 2025, effective January 1, 2026 — impose pre-use notices, opt-out rights, access rights, and risk assessments on businesses using automated decision-making for significant decisions affecting California consumers.
- "Significant decisions" cover employment, financial services, housing, healthcare, and education. Advertising was explicitly excluded from the final text.
- Businesses already using ADMT have until January 1, 2027 to implement notice and opt-out requirements. Risk assessments should have started January 1, 2026. CPPA attestations are due April 1, 2028.
The California AI Regulatory Landscape in 2026
California didn't pass one AI law. It built a layered system — AI-specific obligations stacked on top of CCPA/CPRA, targeting different use cases at different entities.
The operationally critical layer for most businesses: the CPPA's ADMT regulations. Adopted unanimously July 24, 2025. Approved by the Office of Administrative Law September 22, 2025. Effective January 1, 2026.
These sit inside the CCPA framework. Same applicability thresholds:
- Annual gross revenue exceeding $26.6 million
- Processing personal information of 100,000+ California residents or households annually
- Deriving 50%+ of revenue from selling or sharing personal information
On top of that: the Transparency in Frontier Artificial Intelligence Act (SB 53, effective January 1, 2026). This targets developers of "frontier models" — systems trained using more than 10^26 floating-point operations. Penalties reach $1 million per violation. If you're not building frontier models, this doesn't apply directly — but it does impose supply chain obligations on companies using frontier model APIs, requiring those providers to document safety practices.
Also in effect: the Generative AI Training Data Transparency Act (AB 2013, effective January 1, 2026), requiring publicly accessible generative AI systems trained on personal information to publish training dataset disclosures. The AI Transparency Act (SB 942) — requiring AI platforms with over one million monthly users to offer AI-content detection tools — takes effect August 2, 2026.
One deliberate choice in the final July 2025 regulations: the CPPA removed every reference to "artificial intelligence" from the ADMT text. Replaced it with a functional definition — technologies that use computation to replace or substantially replace human decision-making. The compliance question isn't "does this use AI?" It's "does this technology replace human judgment in covered contexts?"
Understanding how California's evolving CCPA requirements interact with AI processing — including what the 2026 amendments change for businesses using automated processing at scale — is the foundation for any California AI compliance assessment.
What Is ADMT and What Does "Significant Decision" Mean?
Simple rule-based algorithms. Sophisticated ML models. Both qualify — if they operate on personal information and produce outputs that replace or substantially replace human judgment.
The scope is bounded by "significant decisions." Consumer rights — pre-use notice, opt-out, access — only activate when ADMT makes a significant decision about a consumer. Significant decisions are those that provide, deny, or set terms for:
- Financial or lending services
- Housing
- Insurance
- Education
- Employment or independent contracting — including hiring, work assignment, compensation, promotion, demotion, suspension, and termination
- Healthcare services
- Access to essential goods and services
What's excluded: advertising. A recommendation algorithm surfacing products is not making a significant decision. A credit scoring model approving or denying a loan is. A personalisation engine ranking content is not. An algorithm screening job applications before a human sees them is.
This boundary matters enormously for adtech and martech companies who feared earlier draft versions would capture behavioural advertising.
Profiling is explicitly included — technologies that analyse or predict intelligence, ability, aptitude, job performance, reliability, or similar characteristics. Performance management tools, skills assessment platforms, and behavioural analytics systems used in employment contexts fall squarely within the regulations if they substantially replace human judgment.
The meaningful human involvement exit. Businesses can exit ADMT obligations for a specific system — but only if the human decision-maker can interpret the ADMT's outputs, actually analyses those outputs alongside other information, and has genuine authority to make or change the decision independently of the ADMT's recommendation. A hiring manager who invariably accepts the AI-generated ranking without independent analysis is not providing meaningful human involvement, even if override authority technically exists.
Consumer Rights Under the ADMT Regulations
Three consumer rights attach to ADMT used for significant decisions.
Right to pre-use notice. Before collecting personal information for ADMT use in a significant decision — or before using already-collected data for such a decision — businesses must provide a notice describing how the ADMT works, what data influences its outputs, and how outputs feed into the decision process. The notice must also describe the alternative process for consumers who opt out. That alternative must exist before you can lawfully operate the ADMT pathway. Pre-use notices can be delivered alongside existing CCPA privacy notices.
Right to opt out. Consumers must receive at least two opt-out methods — accessible, not buried in consent banners. Narrow exceptions exist for fraud prevention or safety purposes, or where businesses have implemented specific evaluation and safeguard requirements. These exceptions require documented compliance, not assumption. The opt-out right applies to ADMT for significant decisions only; it does not override ADMT used for non-significant decision purposes.
Right to access. Consumers may request information about the ADMT used against them — including its logic, the parameters that generated outputs, and the specific output as it related to their case. Businesses must respond within CCPA's standard response timelines.
Risk Assessments: What Must Be Done and When
Risk assessments are a separate obligation. Different timeline.
Businesses must complete assessments before initiating processing activities that present significant privacy risk — including ADMT for significant decisions, personal information used to train ADMT, and automated processing used to infer sensitive personal information.
For processing already underway before January 1, 2026: assessments due by December 31, 2027.
For new processing beginning on or after January 1, 2026: assessments due before processing begins.
Each assessment must evaluate: the ADMT's purposes and benefits, its logic, foreseeable negative impacts, planned safeguards, and policies to limit those impacts. If privacy risks outweigh benefits, the business may not proceed unless risks can be sufficiently mitigated. Assessments must be certified by a senior executive and retained for five years. Review required every three years minimum, or within 45 calendar days of any material change.
By April 1, 2028, businesses must submit an attestation to the CPPA confirming assessments were completed, alongside a summary of assessment findings. The CPPA will know who has and hasn't done this. Enforcement investigators will cross-reference it.
Structuring these risk assessments as integrated documentation that satisfies both California requirements and EU AI Act obligations for organisations operating transnationally reduces duplicated effort and produces governance infrastructure that serves multiple regulatory frameworks simultaneously.
The Compliance Workflow: Five Practical Steps
Most organisations' AI inventories don't exist in a form that makes these obligations easy to assess. Models are owned by different teams, documented inconsistently, and described by their technical architecture — not their regulatory function. Compliance begins with clarity.
Step one: Inventory every AI system and algorithmic tool that processes personal information of California residents. Engineering, product, and legal must work through the actual deployed technology stack together — not documentation that may not reflect reality. Capture: what personal information each system uses as input, what outputs it produces, how those outputs feed into decisions, and what decision domain applies.
Step two: Map each system against the ADMT definition and significant decision taxonomy. Systems processing personal information and producing outputs that replace or substantially replace human judgment in finance, employment, housing, healthcare, or education are in scope. Systems supporting advertising, content recommendation, or internal analytics without making significant decisions about individual consumers are likely out of scope for consumer rights provisions — though they may still trigger risk assessment obligations if they infer sensitive personal information.
Step three: Assess risk level for each in-scope system. Does it use sensitive personal information — health data, racial or ethnic origin, biometric identifiers, precise geolocation, sexual orientation, immigration status? Does it operate on protected class characteristics in employment? Does it affect large numbers of California consumers? High-risk systems require completed assessments before deployment (new systems) or by December 31, 2027 (existing systems).
Step four: Implement consumer-facing infrastructure. Pre-use notices that accurately describe the ADMT. Opt-out mechanisms that are accessible and functional — not buried in privacy policy sub-pages. An alternative decision-making pathway for consumers who opt out. An access request handling workflow for ADMT-specific inquiries. Required for all covered ADMT by January 1, 2027 for existing systems; prior to deployment for systems implemented after that date. Implementing AI consent and control workflows that actually enforce opt-out choices at the processing layer — not just record them in a database — is the technical implementation challenge most legal teams underestimate.
Step five: Build documentation and audit readiness. Risk assessments must be retained, certified, reviewed, and updated on schedule. ADMT inventories must stay current as deployments evolve. Third-party vendors providing ADMT to your business don't absorb your compliance obligation — you remain responsible and must collaborate with vendors to access the information about ADMT logic that consumer access rights require.
California vs the EU AI Act: Two Different Logics
Same high-risk domains. Structurally different compliance mechanisms.
The EU AI Act is product-focused and provider-centric. It classifies AI systems by inherent risk tier and regulates the systems themselves — conformity assessments, technical documentation, EU database registration, human oversight requirements. Primary obligations fall on providers. High-risk categories under Annex III substantially overlap California's significant decision domains — employment, credit, healthcare, education — and additionally cover biometric identification, critical infrastructure, and law enforcement.
California's ADMT framework is consumer-focused and deployer-centric. It doesn't regulate AI systems as products or require conformity assessments. It grants California consumers specific rights regarding how businesses use ADMT against them — and requires businesses to document that ADMT use is justified. Obligations fall on deployers: businesses using the technology, not developers building it.
The practical consequence for businesses subject to both: EU AI Act technical documentation, risk assessment, and human oversight requirements are more demanding for in-scope systems than California's. But California's consumer-facing obligations — pre-use notice, opt-out mechanisms, access rights — require operational implementation the EU conformity framework doesn't specifically mandate in the same form.
Build a complete EU AI Act compliance programme for a high-risk system and you'll satisfy a significant portion of California's risk assessment requirements as a byproduct. You'll still need to implement California-specific notice and opt-out infrastructure separately.
Integrate the assessments. Don't run parallel programmes.
Common Mistakes That Generate Compliance Risk
Assuming vendor use transfers compliance obligation. It doesn't. California's ADMT regulations are explicit: a business cannot escape liability by contracting with a third-party ADMT provider. The business using that vendor's system to make significant decisions remains responsible for pre-use notices, opt-out mechanisms, access rights, and risk assessments. And must collaborate with the vendor to access ADMT logic information that access rights require.
Classifying systems by internal name, not regulatory function. Teams describe their tools as "recommendation engines," "scoring tools," "efficiency platforms." The regulations don't care. A performance management tool that assigns numeric scores to employees — and that managers routinely accept without independent analysis — is making a significant employment decision. Internal naming changes nothing.
Deploying ADMT before building the alternative pathway. The opt-out right is meaningful only if a genuine non-ADMT alternative exists. Businesses with no process for making employment or credit decisions without ADMT cannot legally offer an opt-out they cannot honour. The alternative pathway must exist before the ADMT pathway goes live.
FAQ
Does California regulate AI?
Yes. California regulates AI through multiple laws: the CCPA's ADMT regulations (effective January 1, 2026 for risk assessments, January 1, 2027 for consumer rights), the Transparency in Frontier AI Act (effective January 1, 2026 for frontier model developers), and the Generative AI Training Data Transparency Act (effective January 1, 2026 for generative AI developers).
What is ADMT under CPRA?
Automated Decision-Making Technology is any technology that processes personal information and uses computation to replace or substantially replace human decision-making. It includes profiling technologies that analyse or predict human characteristics.
Do I need to disclose AI usage to users?
Yes, if your ADMT makes significant decisions concerning California consumers. Pre-use notices are required before collecting personal information for ADMT use, or before using already-collected data for a significant decision via ADMT.
Can users opt out of AI decisions?
Yes, for significant decisions. Businesses must provide at least two accessible opt-out methods and must have a non-ADMT alternative process in place for consumers who exercise that right.
How does California compare to the EU AI Act?
The EU AI Act is product-focused and provider-centric, regulating AI systems through conformity assessments and technical documentation. California's ADMT framework is consumer-focused and deployer-centric, granting consumer rights and requiring risk justification. Both cover similar high-risk decision domains through structurally different compliance mechanisms. Organisations subject to both should integrate their assessments rather than running parallel programmes.
California's AI compliance obligations aren't approaching.
They're here. Risk assessments required from January 1, 2026. Consumer rights infrastructure due by January 1, 2027. CPPA attestations due by April 1, 2028. A regulator with active investigations in the hundreds and the institutional knowledge to find compliance gaps.
The window for proactive preparation is now — not after the first enforcement action lands.
