ADMT coverage in the trade press treats these rules as a compliance project. Read the approved text and a different shape appears. Article 11 and the articles around it are a list of things a business will have to say, each to a named audience, each on a fixed date, and three of them signed under penalty of perjury by an individual.
ADMT reaches a narrower population than the coverage implies, and the Agency has answered the question almost nobody quotes. At the board meeting of 1 May 2025, CPPA economist Lisa Kim was taken through the revised scope by Chair Urban:
CHAIR URBAN: 10% of the firms would be the only ones subject to the ADMT regulations?
MS. KIM: That is our estimation.
ADMT obligations miss nine out of ten businesses already subject to the CCPA, on the regulator’s own preliminary estimate. Three tests decide it, and they are worth stating compactly before the statements begin.
The CCPA has to reach you. Civil Code section 1798.140(d)(1) covers a for-profit entity doing business in California with annual gross revenue above $26,625,000 in the preceding calendar year, or that buys, sells or shares the personal information of 100,000 or more California consumers or households, or that derives 50 per cent or more of annual revenue from selling or sharing personal information. The figure is adjusted in odd-numbered years under Civil Code section 1798.199.95(d), so a fresh one is due for 1 January 2027.
The technology has to replace the human. Section 7001(e) covers technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. Section 7001(e)(1) sets three cumulative conditions for the human involvement that keeps a system out: the reviewer must know how to interpret and use the output, must review and analyse it alongside other relevant information, and must have authority to make or change the decision. Meet all three and Article 11 never applies.
The decision has to be one of six. Section 7001(ddd) lists the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, and healthcare services. Subsection (ddd)(6) adds the line that removes most of the internet: “Significant decision does not include advertising to a consumer.”
What follows assumes those three are satisfied.
Statement one: to every consumer, before collection, naming the exception you rely on
ADMT triggers a pre-use notice under section 7220, informing consumers about the use and about their rights to opt out and to access. The notice must comply with section 7003(a) to (b) and be presented prominently and conspicuously at or before the point of collection. A notice at collection can carry it if that notice contains everything sections 7220(b) and (c) require.
Two items inside section 7220(c) are heavier than the summaries suggest, and the first is unusual.
Where a business relies on an exception to the opt-out other than the appeal route, section 7220(c)(2)(B) requires it to “identify the specific exception it is relying upon.” That statement goes in the notice, so it is published. Choosing the hiring exception is therefore a public act rather than an internal file note.
Section 7220(c)(5) then requires additional plain language information about how the system works. Point (A) covers “the categories of personal information that affect the output generated by the ADMT”. Point (B) covers the type of output, how it is used, “whether the output is the sole factor in the decisionmaking process or what the other factors are”, and the role of any human who does not meet the section 7001(e)(1) test. All of it is owed in advance, at collection, rather than on request. A layered notice or hyperlink is permitted.
Statement two: to any consumer who asks, including what your inadequate human did
ADMT access under section 7222 is the obligation worth designing for now, because it is the one that cannot be reconstructed later. A business must give plain language explanations of four things.
The specific purpose, which “must not describe the purpose in generic terms, such as ‘to improve our services'”. Information about the logic, which “must enable a consumer to understand how the ADMT processed their personal information to generate an output with respect to them, which may include the parameters that generated the output as well as the specific output”. The outcome, including whether the output was the sole factor and, if not, what else played a role. And a statement that retaliation for exercising CCPA rights is prohibited, with instructions for exercising other rights.
Section 7222(b)(3) carries a detail that should change how systems log. Where a human took part in the decision in a way that does not meet the section 7001(e)(1) test, the business must explain “what that human’s role was in the decisionmaking process.” A failed human review therefore does two things. The technology stays inside the ADMT definition, and the inadequacy of the review becomes disclosable to the consumer on request.
Section 7222(b)(3)(A) extends the same duty forward. Where the business plans to use the output for a further significant decision about that consumer, the explanation must cover that planned use too.
Statement three: to the consumer who appeals, from someone who can actually change the answer
ADMT covered by Article 11 attracts an opt-out right under section 7221(a). Section 7221(b) then lists the circumstances where no opt-out is required at all, and the first is a design choice most businesses will take.
Section 7221(b)(1) removes the opt-out obligation where the business provides a method to appeal to a human reviewer with authority to overturn the decision. The conditions mirror the human involvement test:
Designate a human reviewer to review and analyze the output of the ADMT and any other information that is relevant to change the significant decision at issue.
The reviewer must consider what the consumer submits, “must know how to interpret and use the output of the ADMT that made the significant decision being appealed”, and “must have the authority to change the decision based on their analysis”. The route itself must be clearly described, easy to execute, require minimal steps, comply with sections 7003(a) to (b) and 7004, run on section 7021 timelines, and be verified under Article 5.
ADMT used for admission, acceptance or hiring, and for allocation or assignment of work and compensation, gets two further exceptions. Both carry the same condition at sections 7221(b)(2)(B) and (b)(3)(B): the ADMT must work “for the business’s purpose” and must not “unlawfully discriminate based upon protected characteristics.”
Notice what relying on those two requires you to assert. Nobody can responsibly say a tool does not unlawfully discriminate without having tested it, so a privacy regulation has produced a bias testing requirement by implication. Our page on the AI bias audit covers what each jurisdiction does with the result of that test.
Where no exception applies, section 7221(c) requires two or more methods for submitting opt-out requests, at least one reflecting how the business primarily interacts with consumers, with an online business obliged to offer an interactive form reached from a link in the pre-use notice.
Statement four: to yourself, in writing, before the processing starts
ADMT is one of four triggers for the risk assessment obligation, which sits in Article 10 and has been live since 1 January 2026. Section 7150(a) requires the assessment before initiating a covered activity, and section 7150(b) lists what counts. Four entries matter here. Selling or sharing personal information. Processing sensitive personal information. Using ADMT for a significant decision. And using automated processing to infer or extrapolate a consumer’s intelligence, ability, aptitude, performance at work, economic situation, health, preferences, interests, reliability, predispositions, behaviour, location or movements, based on systematic observation of that person as an educational programme applicant, job applicant, student, employee or independent contractor.
Read the third and fourth together. A hiring tool can exit Article 11 through genuine human involvement and still trigger a risk assessment under section 7150(b)(4), because that trigger is keyed to inference from systematic observation rather than to who makes the decision.
ADMT training gets its own trigger at section 7150(b)(6), with a definition much wider than its wording. The provision reaches personal information a business “intends to use” to train ADMT for a significant decision, or to train facial recognition, emotion recognition, identity verification, or physical or biological identification or profiling. The regulation then defines the phrase:
For purposes of this paragraph, “intends to use” means the business is using, plans to use, permits others to use, plans to permit others to use, is advertising or marketing the use of, or plans to advertise or market the use of.
Marketing a capability triggers the assessment. So does planning to market it. A product page describing a feature that does not yet exist is inside section 7150(b)(6).
ADMT risk assessments must contain what section 7152 specifies, and its first requirement is the one most templates fail. The purpose “must not be identified or described in generic terms, such as ‘to improve our services’ or for ‘security purposes.'” The regulation supplies its own acceptable example: a business improving a service by decreasing wait times when processing privacy rights requests may identify that decrease as the purpose. Section 7152(a)(2) requires the categories of personal information processed, including “the minimum personal information that is necessary to achieve the purpose”, which converts a data minimisation judgment into a written finding a regulator can read back.
Section 7155 governs the clock. Review at least every three years, update within 45 calendar days of a material change, and retain “for as long as the processing continues or for five years after the completion of the risk assessment, whichever is later.”
Statement five: to the Agency, under penalty of perjury, by a named executive
ADMT risk assessments reach the Agency in a far thinner form than most readers expect. Section 7157(a)(1) sets the first deadline at 1 April 2028 for assessments conducted in 2026 and 2027, and section 7157(b) lists what is filed: the business name and a contact, the period covered, the number of assessments conducted or updated in total and per section 7150(b) activity, whether they involved each statutory category of personal and sensitive personal information, and an attestation.
The attestation is prescribed word for word, ending “Under penalty of perjury under the laws of the state of California, I hereby declare that the risk assessment information submitted is true and correct.” Section 7157(c) restricts who may sign to a member of executive management directly responsible for compliance, with sufficient knowledge and the authority to submit.
No assessment is filed. A count and an oath are.
Statement six: to either regulator, within thirty days, the whole file
ADMT risk assessments become consequential through section 7157(e):
The Agency or the Attorney General may require a business to submit its risk assessment reports to the Agency or to the Attorney General at any time. A business must submit its risk assessment reports within 30 calendar days of the Agency’s or the Attorney General’s request.
At any time, to either regulator, thirty calendar days. An attestation signed personally, followed by an open-ended production right, is a sharper instrument than an annual filing, and it means the documents behind the count have to be in a state fit to be read by a regulator on a month’s notice for five years.
Statement seven: to the Agency, that you did not lean on your auditor
Cybersecurity audits reach a different population from ADMT, and the test sits at section 7120(b). One route is deriving 50 per cent or more of revenue from selling or sharing personal information. The other is meeting the gross revenue threshold and having processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding calendar year.
Section 7121(a) staggers the first report by size. April 2028 where 2026 revenue exceeded $100 million, on an audit covering the following calendar year. April 2029 where 2027 revenue sat between $50 million and $100 million. April 2030 where 2028 revenue fell below $50 million. After April 2030 it becomes a rolling annual obligation under section 7121(b).
Section 7124 then requires a certification of completion by 1 April following each audit year, signed by an executive meeting the same three-part test as the risk assessment signer. The prescribed wording goes further than completion:
Under penalty of perjury under the laws of the state of California, I hereby declare that the information contained within and submitted with this certification is true and correct and that the business has not made any attempt to influence the auditor’s decisions or assessments regarding the cybersecurity audit.
A named individual swears to auditor independence. Such an assertion is a governance problem rather than a filing problem, and it needs an owner well before the quarter it falls due.
What the Agency has done, and what it has said about 2027
No ADMT enforcement action exists anywhere yet, which is unremarkable given that Article 11 does not bite until January. The pattern of what this regulator does enforce is more useful than speculation.
| Date | Target | Amount | What the Agency found |
| 12 Mar 2025 | American Honda Motor Co. | $632,500 | Excessive information to exercise rights, asymmetric privacy choices, agent barriers, missing contract terms |
| 6 May 2025 | Todd Snyder, Inc. | $345,178 | Opt-out requests unprocessed for 40 days, verification demanded before opt-out |
| 30 Sep 2025 | Tractor Supply Company | $1,350,000 | No compliant privacy policy, no job applicant notice, no effective opt-out, no third-party contracts |
| 3 Mar 2026 | PlayOn Sports | $1,100,000 | Tracking consent forced to access tickets, opt-out signals ignored, sharing of 13 to 15 year olds’ data |
| 5 Mar 2026 | Ford Motor Company | $375,703 | Mandatory email verification as friction before opt-out |
| 11 Aug 2026 | LocateSmarter LLC | $116,490 | Late data broker registration, partial social security number demanded before opt-out |
Friction in exercising a right runs through most of that record, and Honda, Todd Snyder and Ford are about nothing else. The rest is broader: notice failures and third-party contracting at Tractor Supply, a substantive prohibition on sharing minors’ data at PlayOn, and a registration failure at LocateSmarter. Article 11 creates two new rights exercised through mechanics this regulator has spent two years policing, which is the most reliable available signal about how it will approach them.
Two 2026 actions point at ADMT more directly. On 21 July 2026 the Agency launched its first sectoral audit, targeting gig economy platforms under Civil Code section 1798.199.40. Chief Privacy Auditor Sabrina Ross:
You cannot contest a decision made by an algorithm without the underlying data.
The audit rests on access rights, and the release never mentions the ADMT regulations. The omission is precisely why it matters: the access right is already enforceable, and the Agency is already pointing it at algorithmic decisions eighteen months before Article 11 applies. Then on 7 August 2026 the Audits Division told the Board what comes next. Under “LOOKING AHEAD TO 2027”, the first bullet reads “Automated Decision-Making Technology (ADMT) audits.”
ADMT guidance from the regulator is the one thing missing here, and the absence belongs on the record. The Agency told its Board on 27 February 2026 that Quick Guides and Compliance Checklists for cybersecurity audits and risk assessments would arrive in Spring 2026, an ADMT Quick Guide and Checklist in Summer 2026, and consumer education about ADMT rights in the autumn. None of the three has appeared among the Agency’s published business resources. Planning on the assumption that official guidance lands before the deadline is planning on a programme that has already slipped twice.
Meanwhile the Agency’s superseded draft fact sheet on ADMT is still served from its website and still surfaces in search. The fact sheet carries its own disclaimer, “These draft rules are not in effect and are subject to change”, and describes profiling for behavioural advertising as in scope with “NO EXCEPTIONS TO OPT-OUT”. Both provisions were deleted before adoption, along with work and educational profiling, public-space profiling and training uses as ADMT triggers. Section 7201, which would have carried additional requirements for physical or biological identification or profiling, does not exist in the approved text at all.
When each statement falls due
| Date | Statement |
| Live since 1 Jan 2026 | Risk assessment, written before the processing starts, under sections 7150 and 7152 |
| 1 Jan 2027 | Pre-use notice, opt-out or appeal route, and access explanations, under sections 7220 to 7222 |
| 1 Jan 2027 | Next CCPA revenue threshold adjustment due under Civil Code 1798.199.95(d) |
| 31 Dec 2027 | Risk assessments completed for processing already underway on 1 Jan 2026 |
| 1 Apr 2028 | Risk assessment attestation to the Agency, covering 2026 and 2027 |
| 1 Apr 2028 | First cybersecurity audit certification, 2026 revenue above $100 million |
| 1 Apr 2029 | First cybersecurity audit certification, 2027 revenue $50 million to $100 million |
| 1 Apr 2030 | First cybersecurity audit certification, 2028 revenue below $50 million |
| Any time | Full risk assessment reports to the Agency or the Attorney General, within 30 calendar days |
ADMT gets the only transition provision in the 127-page package, at section 7200(b). A business using ADMT for a significant decision before 1 January 2027 has until that date to comply, and a business adopting it later must comply at any time it is in use. Nothing extends that. In California Privacy Protection Agency v. Superior Court (2024) 99 Cal.App.5th 705, decided on 9 February 2024, the Third District directed a trial court to vacate an order staying the Agency’s earlier regulations for twelve months, finding “no clear, unequivocal language mandating a one-year delay between approval and enforcement.” The Supreme Court denied review on 24 April 2024. Read narrowly, as it should be, that decision says a court may not impose a delay the statute does not require, which is a different thing from saying the Agency will move quickly.
The design decision the CCPA answer does not settle
ADMT and the FEHA definition part company in a way that a survey of the ranking pages found none of them mentions.
California’s Civil Rights Council regulations on automated decision systems, in force since 1 October 2025, define their subject at 2 CCR section 11008.1(a) as “a computational process that makes a decision or facilitates human decision making regarding an employment benefit”. Facilitates. A tool that informs a human decision sits inside the FEHA definition precisely because a human is deciding.
So the human involvement an employer builds to escape section 7001(e) leaves it squarely inside the FEHA rules, which carry evidential exposure on anti-bias testing, four-year retention of automated decision system data, and agent liability. Different agencies enforce the two under different statutes. A design decision that solves one solves nothing in the other.
Govern365.ai holds the mapping from a provision to the artefact that proves it, with the audience and the due date attached, so a human involvement record, an access explanation, a risk assessment and an attestation sit against sections 7001(e)(1), 7222, 7150 and 7157 rather than in a folder somebody has to interpret in 2028. One record usually answers more than one regime: the same system file supports a CCPA risk assessment, an AI system inventory entry and an EU AI Act classification. Our AI compliance evidence guide sets out the artefact types across regimes, GDPR and AI covers the European treatment of automated decisions, and third-party AI risk management covers what to ask the vendor whose tool makes the decision.
Three ADMT decisions are worth settling this quarter. Decide, in writing, whether each system passes the three limbs of section 7001(e)(1), because naming a reviewer is not evidence and the access right will eventually ask what that reviewer actually did. Choose deliberately between the opt-out and the appeal route, remembering that the alternative exceptions have to be published in the notice and require you to assert the tool does not discriminate. And name now the executive who will sign the 2028 attestation, because that person needs to be able to stand behind five years of documents they did not write.
Frequently asked questions
Who has to comply with the CPPA ADMT regulations?
A business subject to the CCPA that uses the technology to make a significant decision concerning a consumer, under section 7200(a). The Agency’s own preliminary estimate, given to its Board on 1 May 2025, was that roughly 10 per cent of CCPA-covered firms fall within Article 11.
What counts as ADMT under the California regulations?
Section 7001(e) covers technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. Substantially replace means using the output to make a decision without human involvement, and section 7001(e)(1) defines human involvement through three cumulative conditions: the reviewer knows how to interpret and use the output, reviews and analyses it alongside other relevant information, and has authority to make or change the decision.
Does human review take a system outside the ADMT rules?
Yes, where the review meets all three conditions in section 7001(e)(1). A reviewer who rubber-stamps the output, or who lacks authority to change the decision, does not qualify. Human review does not remove an employment tool from the California Civil Rights Council regulations, which reach technology that merely facilitates human decisionmaking.
What is a significant decision under the CCPA ADMT rules?
Section 7001(ddd) lists the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, and healthcare services. Section 7001(ddd)(6) states that significant decision does not include advertising to a consumer.
Does the ADMT opt-out always apply?
No. Section 7221(b)(1) removes the obligation where the business offers an appeal to a human reviewer with authority to overturn the decision, on stated conditions. Sections 7221(b)(2) and (b)(3) provide further exceptions for hiring and for work allocation and compensation, each conditional on the technology working for the business’s purpose and not unlawfully discriminating. Section 7220(c)(2)(B) requires the chosen exception to be identified in the pre-use notice.
What must a business disclose in response to an ADMT access request?
Section 7222(b) requires plain language explanations of four things. The specific purpose, which cannot be generic. Information about the logic, sufficient for the consumer to understand how their personal information generated the output. The outcome, including whether the output was the sole factor and what else contributed. And, where a human took part without meeting the section 7001(e)(1) test, what that human’s role was.
When are the CPPA ADMT obligations enforceable?
1 January 2027. Section 7200(b) gives a business already using the technology for a significant decision until that date, and requires a business adopting it later to comply at any time it is in use. Section 7200(b) is the only transition provision in the package.
When is the first CCPA risk assessment submission due, and what goes in it?
1 April 2028, covering assessments conducted in 2026 and 2027, under section 7157(a)(1). The filing is a count and an attestation signed under penalty of perjury by a qualifying executive, not the assessment itself. Section 7157(e) allows the Agency or the Attorney General to demand the full reports at any time, due within 30 calendar days.
Do the ADMT rules cover behavioural advertising or AI training?
No. Both were in earlier drafts and neither survives in Article 11. Advertising is expressly excluded from significant decision. Training moved to Article 10, where section 7150(b)(6) reaches personal information a business intends to use to train ADMT for a significant decision, and defines “intends to use” to include planning to use, permitting others to use, and advertising or marketing the use.
Which businesses are subject to the CCPA in the first place?
Under Civil Code section 1798.140(d)(1), a for-profit entity doing business in California meeting any of: annual gross revenue above $26,625,000 in the preceding calendar year, the figure effective 1 January 2025; buying, selling or sharing the personal information of 100,000 or more California consumers or households; or deriving 50 per cent or more of annual revenue from selling or sharing personal information.
Has the CPPA published guidance on ADMT compliance?
No. The Agency told its Board on 27 February 2026 that Quick Guides for cybersecurity audits and risk assessments would arrive in Spring 2026 and an ADMT Quick Guide in Summer 2026. None has appeared among its published business resources as at 16 September 2026. Its superseded draft ADMT fact sheet, describing rules deleted before adoption, is still served from its website.
Who signs the CCPA attestations, and what do they swear to?
Sections 7157(c) and 7124(c) both require a member of executive management who is directly responsible for compliance, has sufficient knowledge, and has authority to submit. The risk assessment attestation is sworn under penalty of perjury as true and correct. The cybersecurity audit certification adds that the business “has not made any attempt to influence the auditor’s decisions or assessments.”
