# My app uses an AI model to approve, deny or rank people for jobs, loans, housing, school or healthcare. Do California's new CCPA automated decisionmaking technology (ADMT) rules apply to me from January 1, 2027, and what do I have to tell people and keep on record for each decision?

**Short answer:** They apply if you are a business covered by the CCPA and you use technology that processes personal information to replace, or substantially replace, human decisionmaking for a 'significant decision': one that results in providing or denying financial or lending services, housing, education enrollment or opportunities, employment or contracting opportunities or pay, or healthcare services. Advertising is excluded. 'Substantially replace' means using the output without human involvement, and human involvement only counts if the reviewer knows how to interpret the output, reviews it and other relevant information, and has authority to change the decision. The regulations took effect January 1, 2026; a business already using ADMT for significant decisions must comply by January 1, 2027. You then owe consumers a pre-use notice, an opt-out (or, instead, an appeal to a human reviewer who can overturn the decision, plus narrower hiring and work-allocation exceptions), and on request a plain-language explanation of the purpose, the logic, the specific output about them and how it was used, within 45 calendar days. You also need a documented risk assessment covering the ADMT's logic, assumptions, limitations and outputs; for processing already running before 2026 it is due by December 31, 2027, with summary information filed with the California Privacy Protection Agency by April 1, 2028, and it must be kept at least five years. The practical gap for AI builders is per-decision records: you can't explain 'the specific output with respect to the consumer' months later unless you saved it.

## Checklist
1. List every place a model's output decides, or effectively decides, who gets hired, assigned work or paid, admitted, lent to, housed, or treated. Include vendor tools; the rules cover the business that uses the ADMT.
2. For each, decide honestly whether a human with real authority reviews the output and the other relevant information before the decision. A reviewer who rubber-stamps doesn't meet the definition, and then the use is ADMT.
3. Write the pre-use notice: the specific purpose (not 'to make a significant decision'), how to opt out or, if you rely on the human-appeal exception, how to appeal, and how to request access. Show it at or before collection, in the way you mainly interact with the person.
4. If you offer opt-out, build a specific method (a cookie banner isn't one), stop using ADMT for that person within 15 business days of a request made after processing started, and pass the request to service providers who process for you.
5. If you rely on the human-appeal exception instead, name reviewers who understand the model's output, let the consumer submit information, and give them authority to change the result.
6. Log each decision when it happens: a decision reference, the model and version, a hash of the inputs, the output, how it was used (sole factor or one of several), whether a human changed it, and which notice version the person saw.
7. Prepare access responses: purpose, the logic in terms a consumer can follow, their specific output and the outcome. Confirm receipt within 10 business days and answer within 45 calendar days (up to 90 with notice). Trade secrets and security-sensitive details may be withheld.
8. Do the risk assessment before any new ADMT use, update it within 45 days of a material change, review it at least every three years, and keep every version for as long as the processing continues or five years after the assessment, whichever is later.
9. Diary the dates: January 1, 2027 (ADMT compliance for existing uses), December 31, 2027 (risk assessments for processing begun before 2026), April 1, 2028 (first submission to the agency, attested by an executive under penalty of perjury).

## Who do California's CCPA automated decisionmaking (ADMT) rules apply to?
- The regulations define ADMT as any technology that processes personal information and uses computation to replace or substantially replace human decisionmaking, including profiling that does so. Web hosting, databases, spreadsheets, spam filters and similar tools are excluded only as long as they don't replace human decisionmaking, so a spreadsheet formula that automatically rejects applicants can still count.
- Significant decisions are listed exhaustively: financial or lending services (credit, loans, money transmission, deposit accounts, check cashing, installment plans), housing (but not decisions based only on availability or receipt of payment), education admission, credentials, suspension and expulsion, employment and contracting (hiring, work allocation, pay and bonuses, promotion, demotion, suspension, termination) and healthcare services. Advertising to a consumer is not a significant decision.
- Separate exceptions remove the opt-out (not the notice or access duties) for admission, acceptance or hiring when the ADMT is used solely to assess ability to perform and it works for its purpose without unlawful discrimination, and similarly for work allocation and pay decisions.

## What must you tell a consumer who asks about an automated decision under the CCPA?
- An access response must explain the specific purpose, information about the logic that lets the consumer understand how the ADMT processed their personal information, which may include the parameters and their specific output, and the outcome: whether the output was the sole factor, which other factors played a role, and what any human's role was where it didn't amount to human involvement.
- That is a question about one past run. Models are updated, prompts change and hosted providers keep logs on their own schedules, so the specific output and version used for a person's decision need to be saved by you when the decision is made, and tied to the notice and policy in force that day.
- Opt-out requests also create a record obligation: you need to show that processing stopped within 15 business days and that service providers were told, and you may not ask the person to consent again for 12 months.

## What does a CCPA risk assessment for ADMT have to include?
- For ADMT used for significant decisions, the risk assessment report must identify the logic of the ADMT, including assumptions and limitations, and its output and how the business will use it to make the decision, alongside the purpose, categories of personal information, retention, number of consumers, disclosures, recipients, benefits, negative impacts and safeguards.
- The agency or the Attorney General can demand the full reports at any time, and the business must hand them over within 30 calendar days. Keeping assessments, decision logs and the model versions they describe consistent is what lets you answer that quickly.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Record a signed receipt for this automated screening decision when it's made: the model and dated version, a hash of the inputs and of the output, and our decision reference and notice version, so we can answer a CCPA access request about this exact decision later."

```json
{
  "tool": "record_ai_run",
  "arguments": {
    "model": "<model id and dated version>",
    "provider": "<model provider or in-house>",
    "prompt_sha256": "<sha256 of the exact input features or prompt>",
    "output_sha256": "<sha256 of the exact output, e.g. score and reason codes>",
    "params": {
      "decision_ref": "<your decision id, no names>",
      "decision_type": "hiring_screen",
      "notice_version": "<pre-use notice version shown>",
      "policy_version": "<scoring policy or prompt version>",
      "used_as": "one_factor_of_several"
    },
    "ran_at": "2026-11-10T22:00:00Z"
  }
}
```
- Needs an API key. Send hashes and your own references only, never names, emails or the applicant's data. Params are stored as a hash, so keep the exact params object with your decision record.
- If a human reviewer approves or changes the outcome, request_human_approval can bind their decision to a hash of the final result and the run receipt, giving a signed, timestamped record that the review happened before the decision went out; verify_human_approval checks it for free.
- verify_ai_run is free and needs no key, so an auditor or the agency can check that the output you produce for an access request matches the hash recorded at decision time. The receipt shows what you recorded and when, not that the model is fair, accurate or compliant.

_Rightshold doesn't decide whether the CCPA applies to you, write notices, run risk assessments or handle consumer requests. It records the hashes and references you send and lets anyone check them later. Requirements are summarized from the CCPA regulations (Cal. Code Regs. tit. 11, §§ 7001, 7021, 7150-7157, 7200-7222) as published by the California Privacy Protection Agency, effective January 1, 2026, and checked on November 10, 2026. Not legal advice; talk to a privacy lawyer about your use._

## Sources
- [California Privacy Protection Agency: CCPA Regulations, effective January 1, 2026 (Articles 10 and 11: risk assessments and ADMT)](https://www.cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf)
- [California Privacy Protection Agency: Laws and regulations](https://cppa.ca.gov/regulations/)
- [Manatt: California Finalizes Rules on Automated Decisionmaking, Risk Assessments and Cybersecurity Audits](https://www.manatt.com/insights/newsletters/client-alert/california-finalizes-rules-on-automated-decisionmaking-risk-assessments-cybersecurity-audits)
- [Morrison Foerster: CCPA Regulations on Cybersecurity, Risk Assessments, and ADMT: Across the Finish Line](https://www.mofo.com/resources/insights/251007-ccpa-regulations-on-cybersecurity-risk-assessments)

## Related
- [How to show a customer or regulator that a human reviewed an AI decision before it went out](https://www.rightshold.com/answers/how-to-show-a-customer-or-regulator-that-a-human-reviewed-an-ai-decision-before-it-went-out)
- [How to prove which model version, prompt and settings produced an AI output](https://www.rightshold.com/answers/how-to-prove-which-model-version-prompt-and-settings-produced-an-ai-output)
- [How long do you have to keep AI agent logs under the EU AI Act?](https://www.rightshold.com/answers/how-long-do-you-have-to-keep-ai-agent-logs-under-the-eu-ai-act)
- [Verified AI Runs](https://www.rightshold.com/verified-ai-runs)

_Not legal advice. Updated 2026-11-10. JSON: https://www.rightshold.com/answers/do-californias-ccpa-automated-decisionmaking-rules-apply-to-your-ai-app-by-january-1-2027.json_