Who this is for: Companies deploying AI for decisions affecting California consumers in employment, housing, lending, insurance, education, or healthcare. Privacy and compliance officers, GRC architects, legal counsel advising on CCPA ADMT obligations, and AI product teams building consumer-facing decision systems.
Phased enforcement. The CCPA ADMT regulations (Article 11) were approved September 22, 2025, and became effective January 1, 2026. Risk assessment provisions take effect January 1, 2026. Full ADMT compliance for significant decisions (pre-use notices, opt-out rights) is required by April 1, 2027 for businesses already using ADMT. Businesses adopting ADMT after that date must be compliant before deployment. Penalties: up to $2,500 per violation, $7,500 per intentional violation.
Contents
1. Overview 2. What Counts as ADMT and a Significant Decision 3. Key Obligations 4. Obligation-to-Procedure Mapping 5. Detailed Procedure Cards 6. Compliance Timeline 7. Quick Reference 8. Quick Start 9. References1. Overview
The California Privacy Protection Agency (CPPA) finalized regulations governing Automated Decision-Making Technology (ADMT) under the California Consumer Privacy Act (CCPA). These regulations add Article 11 to the existing CCPA regulatory framework and represent the most detailed state-level requirements for AI-driven decision systems in the United States.
Unlike broad AI governance frameworks, the CCPA ADMT rules focus specifically on decisions that materially affect consumers' lives: employment, housing, lending, insurance, education, and healthcare. The regulations impose four interlocking obligations:
- Pre-use notices: Consumers must be informed before ADMT is used for significant decisions, including what the technology does, what information it processes, and how to exercise rights
- Opt-out rights: Consumers may opt out of ADMT processing for significant decisions, subject to limited exceptions
- Risk assessments: Businesses must conduct and document risk assessments before deploying ADMT for significant decisions, evaluating potential harms and benefits
- Cybersecurity audits: Businesses processing personal information above revenue thresholds must complete cybersecurity audits on a phased schedule
The regulations apply to any business subject to the CCPA that uses ADMT, defined as any technology that processes personal information and uses computation to replace or substantially replace human decision-making.
2. What Counts as ADMT and a Significant Decision
ADMT is defined as any technology that processes personal information and uses computation to replace human decision-making or substantially replace human decision-making. This includes machine learning models, rule-based scoring systems, and algorithmic filtering applied to personal data.
Significant decisions are those that result in the provision or denial of:
| Decision Category | Examples | ADMT Coverage |
|---|---|---|
| Employment | Hiring, promotions, work assignments, compensation, termination | Full ADMT obligations including pre-use notice and opt-out |
| Housing | Rental applications, mortgage eligibility, tenant screening | Full ADMT obligations |
| Lending / Financial | Credit approval, loan eligibility, interest rate determination | Full ADMT obligations |
| Insurance | Coverage decisions, claims processing, premium determination | Full ADMT obligations |
| Education | Admissions decisions, enrollment opportunities, scholarship eligibility | Full ADMT obligations |
| Healthcare | Treatment eligibility, insurance coverage, care prioritization | Full ADMT obligations |
Advertising-only uses of AI were removed from the definition of significant decisions in the final regulations.
3. Key Obligations
| Obligation | Applicability | Compliance Deadline |
|---|---|---|
| Risk Assessment | Any business using ADMT for significant decisions | January 1, 2026 (effective now) |
| Pre-Use Notice | Before ADMT is used for a significant decision | April 1, 2027 (existing ADMT users) / Before deployment (new ADMT users after April 1, 2027) |
| Consumer Opt-Out | California consumers subject to ADMT significant decisions | April 1, 2027 |
| Logic Explanation | Upon consumer request | April 1, 2027 |
| Privacy Policy Update | All businesses using ADMT | January 1, 2026 (effective now) |
| Record Retention | Risk assessments and compliance records | January 1, 2026 (effective now) |
| Non-Discrimination | ADMT used for significant decisions | April 1, 2027 |
| Cybersecurity Audit | Businesses above revenue thresholds | April 1, 2028 ($100M+ revenue) / April 1, 2029 ($50-100M) / April 1, 2030 (<$50M) |
4. Obligation-to-Procedure Mapping
Each CCPA ADMT obligation maps to SWT3 witness procedures that produce cryptographically anchored evidence of compliance.
| CCPA ADMT Obligation | SWT3 Procedure | What It Witnesses | Evidence Produced |
|---|---|---|---|
| Pre-Use Notice | AI-AUTO.1 | Consumer notification before ADMT use | Anchor with notice type, delivery method, timestamp proving notice preceded decision |
| Non-Discrimination | AI-FAIR.1 | Bias disparity measurement across protected classes | Anchor with protected attribute, bias metric, threshold compliance |
| Bias Audit | AI-FAIR.3 | Independent or internal audit of ADMT for discriminatory outcomes | Anchor with audit scope, methodology, findings summary |
| Logic Explanation | AI-EXPL.1 | Explanation generated for consumer request | Anchor with explanation type, factors disclosed, consumer request ID |
| Consumer Opt-Out | AI-HITL.1 | Human review triggered by opt-out request | Anchor with opt-out request ID, human reviewer, decision outcome |
| Risk Assessment | AI-RISK.1 | Risk identification and categorization for ADMT deployment | Anchor with risk category, severity, mitigation status |
| Impact Assessment | AI-IMPACT.1 | Societal impact evaluation of ADMT deployment | Anchor with impact category, affected population, benefit-harm analysis |
| Data Protection Assessment | AI-DPIA.1 | Data protection impact assessment for personal information processing | Anchor with data categories, processing purposes, risk mitigation |
| Privacy Policy Disclosure | AI-TRANS.1 | Privacy policy updated to disclose ADMT use | Anchor with policy version, disclosure scope, publication timestamp |
| Consumer Rights | AI-CONSENT.1 | Consumer consent or opt-out preference recorded | Anchor with consent type, consumer ID hash, preference timestamp |
| Governance Policy | AI-GOV.1 | ADMT governance policy established and maintained | Anchor with policy version, review date, responsible party |
| Cybersecurity Audit | AI-AUDIT.1 | Cybersecurity audit completed per CCPA requirements | Anchor with audit scope, completion date, findings count |
| Data Practices Documentation | AI-DATA.1 | Data collection and processing practices documented | Anchor with data categories, sources, processing purposes |
| Record Retention | AI-LOG.1 | Compliance records retained for required period | Anchor with retention policy, record count, oldest record date |
5. Detailed Procedure Cards
Automated Decision Notification (Pre-Use Notice)
CCPA ADMT requires: Before using ADMT for a significant decision, businesses must provide a pre-use notice to the consumer that includes: (1) a description of the ADMT and its purpose, (2) the categories of personal information processed, (3) the consumer's right to opt out, and (4) how to exercise that right. The notice must be clear, conspicuous, and provided before the ADMT processing begins.
How SWT3 addresses it: The witnessAutomatedDecision() call records the notice delivery method, content scope, and timestamp. The anchor proves the notification was delivered before the ADMT processed the consumer's information. Factor A records the notice type (pre-use, post-adverse). Factor B captures the delivery method (in-app, email, on-screen). Factor C confirms the decision category (employment, housing, lending).
The AI-AUTO.1 anchor timestamp must strictly precede the corresponding AI-INF.1 anchor for the same consumer interaction. This proves the consumer was notified before ADMT processed their data. If an AI-INF.1 anchor exists without a preceding AI-AUTO.1, this indicates an undisclosed ADMT interaction -- a direct violation of Article 11(c).
Risk Assessment for ADMT Deployment
CCPA ADMT requires: Before deploying ADMT for significant decisions, businesses must conduct a risk assessment that evaluates: (1) the categories of personal information processed, (2) potential harms to consumers, (3) expected benefits, (4) whether benefits outweigh potential harms, and (5) safeguards in place to mitigate identified risks. Risk assessments must be updated when the ADMT is materially changed.
How SWT3 addresses it: The witnessRisk() call anchors the risk assessment completion, including risk categories identified, severity ratings, and mitigation status. Each assessment creates a verifiable record that can be produced for the CPPA upon request. When the ADMT is updated, a new anchor with updated risk categories demonstrates the assessment was refreshed.
AI-RISK.1 anchors should exist before any AI-INF.1 anchors for a given ADMT deployment. Cross-reference with AI-IMPACT.1 and AI-DPIA.1 for the full assessment picture. When the model changes (AI-MDL.1 shows a new hash), a corresponding new AI-RISK.1 anchor should appear within a reasonable timeframe, demonstrating the assessment was refreshed for the updated system.
Non-Discrimination and Bias Testing
CCPA ADMT requires: ADMT used for significant decisions must not discriminate against consumers based on protected characteristics. The risk assessment must evaluate whether the ADMT produces discriminatory outcomes and document safeguards to prevent algorithmic discrimination.
How SWT3 addresses it: The witnessFairness() call records bias testing results across protected attributes, including the specific metric used, the threshold applied, and whether the ADMT passed or failed. Paired with AI-FAIR.3 for independent bias audits, these anchors create a continuous record of non-discrimination testing throughout the ADMT lifecycle.
AI-FAIR.1 anchors should appear at regular intervals and after each model update. Factor A identifies the protected attribute tested (race, gender, age, disability). Factor B contains the bias metric value. A FAIL verdict on any AI-FAIR.1 anchor followed by a corrective AI-FAIR.3 audit anchor demonstrates the remediation cycle is functioning.
Consumer Opt-Out and Human Review
CCPA ADMT requires: Consumers may opt out of ADMT processing for significant decisions. When a consumer opts out, the business must provide an alternative process that does not rely solely on ADMT, which may include meaningful human review of the decision.
How SWT3 addresses it: The witnessHumanReview() call records that a human reviewer evaluated the decision after a consumer exercised their opt-out right. Factor A identifies the opt-out request. Factor B records the human reviewer. Factor C captures the decision outcome (affirmed, reversed, modified). This creates an auditable chain from opt-out request through human review to final decision.
Cross-reference AI-CONSENT.1 (opt-out preference recorded) with AI-HITL.1 (human review completed). The time delta between the opt-out request anchor and the human review anchor demonstrates response time. If a consumer opted out but no AI-HITL.1 anchor follows, this indicates the opt-out was not honored.
Cybersecurity Audit
CCPA ADMT requires: Businesses processing personal information above revenue thresholds must complete cybersecurity audits. Audits must assess the business's safeguards for personal information, including information processed by ADMT. Audit results must be retained and available for regulatory review.
How SWT3 addresses it: The witnessAudit() call anchors the audit completion, scope, findings count, and remediation status. The anchor creates a tamper-evident record proving the audit was completed within the required timeframe and that findings were addressed.
AI-AUDIT.1 anchors should align with the phased deadlines: April 1, 2028 for businesses with $100M+ revenue, April 1, 2029 for $50-100M, April 1, 2030 for smaller businesses. Factor A records the audit scope. Factor C records findings count and remediation status. Cross-reference with AI-LOG.1 to confirm audit records are retained.
6. Compliance Timeline
| Date | Milestone | What It Means |
|---|---|---|
| September 22, 2025 | OAL approves final ADMT regulations | Regulatory text finalized |
| January 1, 2026 | Regulations take effect | Risk assessment and privacy policy obligations begin. New ADMT deployments should begin compliance planning. |
| April 1, 2027 | Full ADMT compliance for existing users | Pre-use notices, consumer opt-out, and logic explanation obligations begin for businesses already using ADMT for significant decisions. |
| April 1, 2028 | Cybersecurity audit deadline (Tier 1) | Businesses with $100M+ revenue in 2026 must complete cybersecurity audit. |
| April 1, 2029 | Cybersecurity audit deadline (Tier 2) | Businesses with $50-100M revenue in 2027 must complete cybersecurity audit. |
| April 1, 2030 | Cybersecurity audit deadline (Tier 3) | Businesses with less than $50M revenue in 2028 must complete cybersecurity audit. |
Current status (September 2026): Risk assessment and privacy policy obligations are active. Businesses using ADMT for significant decisions have approximately 7 months to implement pre-use notices and consumer opt-out mechanisms before the April 1, 2027 deadline.
7. Quick Reference
| Examiner Question | Where to Look |
|---|---|
| Was the consumer notified before ADMT was used? | AI-AUTO.1 anchor timestamp must precede the AI-INF.1 anchor for the same interaction. Factor B records the delivery method. |
| Has a risk assessment been completed for this ADMT? | AI-RISK.1 anchor with Factor A identifying the ADMT system. Cross-reference with AI-IMPACT.1 and AI-DPIA.1 for the complete assessment. |
| Can the consumer opt out of ADMT processing? | AI-CONSENT.1 anchors record opt-out preferences. AI-HITL.1 anchors confirm human review was provided as an alternative. |
| Is the ADMT tested for discriminatory outcomes? | AI-FAIR.1 anchors at regular intervals. AI-FAIR.3 anchors for independent audits. Factor A identifies the protected attribute tested. |
| Can the business explain how the ADMT works? | AI-EXPL.1 anchors generated upon consumer request. Factor A identifies the explanation type (logic, factors, data categories). |
| Has the cybersecurity audit been completed? | AI-AUDIT.1 anchor with Factor A recording audit scope and Factor C recording findings and remediation status. |
| Are compliance records retained? | AI-LOG.1 anchors confirm retention policy is active. Factor B records the oldest retained record date. |
8. Quick Start
pip install swt3-ai
# Initialize with the US consumer AI profile
swt3 init --profile us-consumer-ai --tenant YOUR_TENANT
# Run the demo to see witness anchors generated
python -m swt3_ai.demo
# Or use TypeScript
npm install @tenova/swt3-ai
npx swt3-init --profile us-consumer-ai
Full SDK documentation: sovereign.tenova.io/docs
Create a free account: sovereign.tenova.io/signup
9. References
- CPPA: CCPA Updates, Cybersecurity Audits, Risk Assessments, and ADMT
- Skadden: California Finalizes CCPA Regulations for ADMT, October 2025
- Akin: New California Regulations Regarding Employer Use of ADMT
- Thompson Coburn: California's ADMT Rules Under the CCPA
- Related: California SB 942 AI Transparency Act Crosswalk
- Related: Colorado SB 26-189 ADMT Crosswalk
- SWT3 UCT Registry, 280 procedures across 9 namespaces
- SDK Documentation, Python, TypeScript, and 5 additional language SDKs