CCPA ADMT regulations 2027: California's rules for AI hiring and lending tools

Summary. California's automated decisionmaking technology (ADMT) rules under the CCPA bind businesses from 1 January 2027. The California Privacy Protection Agency (now CalPrivacy) Board adopted them on 24 July 2025, the Office of Administrative Law approved them on 22 September 2025, and the package took effect on 1 January 2026 with staggered deadlines. A covered business using ADMT for a significant decision must give a pre-use notice, offer an opt-out unless one of three exceptions applies, and answer access requests. Significant decisions cover lending and financial services, housing, education, employment and pay, and healthcare, not advertising. Job applicants and employees living in California have these rights. Risk assessments already apply to new high-risk processing; older processing must be assessed by 31 December 2027. Hiring tools get a narrow opt-out exception. Lending models do not, though financial privacy carve-outs may take much lender data outside the CCPA. SB 947 separately limits automated discipline and firing from 1 July 2027. The Board considers wording edits to the ADMT sections on 6 November 2026, which do not move the date.

About this article. For HR-tech, lending and AI product teams, their counsel, and vendors serving California businesses. We read the CCPA regulations and statute in the versions effective 1 January 2026, CalPrivacy's FAQ, threshold page and 5 to 6 November 2026 Board papers, and the chaptered text of SB 947 (on CalMatters Digital Democracy, because California's bill site blocked our fetch), all on 1 November 2026. This is general information, not legal advice, so confirm your duties with counsel. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

The dates: what is live, what starts on 1 January 2027, what comes later

The regulations are already law. On 1 January 2027, Article 11, the ADMT article, binds existing uses: section 7200(b) requires a business already using ADMT for a significant decision to comply by that date, and any later use must comply at the time of use. The table draws on the regulations and SB 947.

Audits reach only businesses meeting the section 7120 tests: 50% or more of revenue from selling or sharing personal information, or the revenue threshold plus 250,000 consumers or households, or the sensitive data of 50,000 consumers.

What changed in 2026? Not the ADMT date. CalPrivacy's rulemaking page lists no proposed packages on 1 November 2026, but that may change within days. On 6 November 2026 the Board considers opening formal rulemaking on opt-out preference signals, which our guide to California's browser opt-out signal law covers. The package carries wording edits here too. The hiring exception would refer to performance at work, a defined term, in place of ability to perform. The risk assessment attestation would be signed and given to the best of the signer's knowledge. Metrics reporting would extend to businesses that must do a risk assessment or audit.

Staff expect next steps in 2027, so plan on the current text applying on 1 January 2027. HR-tech teams should watch the employee data track: comments closed on 20 May 2026, and staff plan recommendations in February 2027 and a draft package in May 2027. CalPrivacy's session wrap lists the broader automated decisions bill AB 1018 as held.

Is your tool ADMT? The human involvement test

Section 7001(e) defines ADMT as technology that processes personal information and uses computation to replace, or substantially replace, human decisionmaking, including profiling that does so. It excludes web hosting, networking, caching, storage, firewalls, anti-malware, spam and robocall filtering, spellcheckers, calculators, databases and spreadsheets, as long as they do not replace human decisionmaking.

A business substantially replaces human decisionmaking when it uses the output to decide without human involvement. Human involvement needs a reviewer who:

1. knows how to interpret and use the output to make the decision;

1. reviews and analyses the output and any other relevant information; and

1. has authority to make or change the decision based on that analysis.

This test is where most AI products land in scope. As we read it, a recruiter who clicks approve on an AI shortlist without the training, the information or the authority to change it is not human involvement. Neither is a loan officer who can only escalate. A large language model that drafts a summary a manager reads and then decides on is closer to the line. Document the workflow, not the org chart.

Which decisions are significant, and where the exceptions apply

A significant decision is one that results in providing or denying the services and opportunities below, as defined in section 7001(ddd). The opt-out exceptions are in section 7221(b).

The human appeal exception works for every category. For a lender, landlord or healthcare business it is the only way to avoid offering an opt-out.

Obligation 1: the pre-use notice (section 7220)

The notice must appear prominently at or before the point where you collect the personal information you plan to process with ADMT, in the way you mainly interact with the consumer. If you collected the data for another purpose, the notice must come before the ADMT processing. You may fold it into your Notice at Collection if that carries every required item:

1. A plain-language explanation of the specific purpose. Saying only that you will make a significant decision does not qualify.

1. The right to opt out and how to use it, or how to appeal if you rely on the human appeal exception, or the name of any other exception you rely on.

1. The right to access ADMT information and how to request it.

1. That you may not retaliate against consumers for exercising CCPA rights.

1. How the ADMT works: how it processes personal information, which categories affect the output, what the output is and how you use it, and what happens instead if the consumer opts out. This part may be layered behind a link.

Trade secrets and information that would compromise security, fraud prevention or physical safety can be withheld from item 5 only. One consolidated notice can cover several uses. Section 7003 also applies: readable on small screens, offered in the languages you normally use with California consumers, and accessible, with WCAG 2.1 named as the online benchmark.

Obligation 2: the opt-out and its three exceptions (section 7221)

Unless an exception applies, you must let consumers opt out. The mechanics are prescriptive:

• Offer two or more methods, one reflecting how you mainly interact with the consumer. Online businesses need at least an interactive form behind an opt-out link in the pre-use notice. A cookie banner alone is not acceptable.

• Do not require an account, extra information beyond what you need to act, or a verifiable consumer request. Let the consumer confirm the request was processed.

• You may offer granular choices, but also a single option to opt out of all ADMT uses for significant decisions.

• Wait at least 12 months before asking an opted-out consumer to consent again, except where the rules allow it.

• If the request arrives before processing starts, do not start. If after, stop as soon as feasible and within 15 business days, and instruct your service providers, contractors and others processing the data for that ADMT to do the same.

The exceptions. Under the human appeal exception, the consumer can appeal to a designated reviewer who considers the consumer's information, knows how to interpret the output and can overturn the decision. The appeal must be easy, with Article 5 verification. Section 7021 names appeals directly: confirm receipt within 10 business days, respond within 45 calendar days, and take up to another 45 only with notice and a reason. The hiring and admissions exception and the work allocation and pay exception each require that the ADMT is used solely for that purpose, works for it, and does not unlawfully discriminate.

An exception removes the opt-out. It does not remove the pre-use notice, the access right, the bar on retaliation or the risk assessment.

Obligation 3: access to ADMT (section 7222)

When a consumer asks, give plain-language answers covering the specific purpose, the logic of the ADMT, the outcome for that consumer and how you used the output, any planned further use of that output, the bar on retaliation, and how to use other CCPA rights. The logic explanation must let the consumer understand how the ADMT processed their information, and may include the parameters and the specific output.

Trade-secret and security limits apply to the logic and outcome items. An aggregate response is narrower than it sounds: section 7222(j) allows one only where you used the ADMT on that consumer more than four times in 12 months. Service providers and contractors must help you answer, and the section 7021 timeline applies.

If you do not log inputs, model version, output and reviewer action per decision, you cannot answer these requests. Our LLM observability comparison covers tools that capture part of that trail.

Risk assessments are already live for new ADMT uses

Article 10 has applied since 1 January 2026. Section 7150(b) lists six activities that need a written risk assessment before they start:

1. selling or sharing personal information;

1. processing sensitive personal information, with a narrow employee carve-out;

1. using ADMT for a significant decision;

1. automated inference about applicants, employees, students or contractors from systematic observation;

1. automated inference based on presence at a sensitive location; and

1. processing personal information to train ADMT for significant decisions, or facial recognition, emotion recognition or identity verification technology.

Review each assessment at least every three years, update it within 45 calendar days of a material change, and keep it for as long as the processing continues or five years after completion, whichever is later. Assessments from 2026 and 2027 are summarised and attested to the Agency by 1 April 2028, then by 1 April each year for the prior year. An executive signs under penalty of perjury, and the Agency or the Attorney General can demand full reports within 30 calendar days.

If you launched a new AI screening or underwriting model during 2026, the assessment should already exist.

SB 947: a second rule for discipline and firing

Governor Newsom signed SB 947, the No Robo Bosses Act, on 30 September 2026. It is Chapter 859 of 2026, sits in the Labor Code and applies from 1 July 2027. Crowell reads it as covering California employers of any size, and employees rather than contractors. Its reliance rules do not reach hiring decisions.

• An employer may not rely solely on an automated decision system for a disciplinary or termination decision.

• If it primarily relies on one, a human must corroborate the decision. Output that cannot be corroborated, or that the reviewer finds inaccurate, incomplete or misleading, cannot be used.

• After a primary-reliance decision, the employee gets a separate written notice and can request a description of their own data used.

• The civil penalty is $500 per violation.

Section 1526.4 keeps CCPA-covered employers subject to CalPrivacy's ADMT rules. As we read it, a human appeal after the decision may satisfy section 7221 for a termination, but from 1 July 2027 a primary-reliance decision also needs corroboration before it is final.

Worked examples: a resume screener and a credit model

Hiring. A California employer receives 5,000 applications for 40 roles. An AI screener ranks them, recruiters read the top 200, and the other 4,800 receive automated rejections. For those 4,800 the tool replaced human decisionmaking. The employer can use the hiring exception if the tool is used solely to assess ability to perform the job and works without unlawful discrimination. If it also scores social media activity or culture fit, that condition is in doubt, so plan for an opt-out or human appeal. Either way, it needs a pre-use notice on the application form, an access process and a risk assessment. California's Civil Rights Council rules, in force since 1 October 2025, separately require keeping employment records, including automated-decision data, for at least four years.

Lending. A lender uses a model to approve or decline instant credit lines for California consumers. Check scope first. The CCPA does not apply to personal information collected, processed, sold or disclosed subject to the Gramm-Leach-Bliley Act or California's Financial Information Privacy Act, and it carves out consumer report activity regulated by the Fair Credit Reporting Act. Much application data may sit outside these rules, so map each input with counsel. A lender's HR data is a different matter.

Where the rules apply, there is no lending exception, so the lender chooses between an opt-out with an alternative underwriting path and human appeal. This arithmetic uses assumed volumes, not industry data, to size the appeal route:

• Decisions per month: 20,000; assumed decline rate 30% = 6,000 declines.

• Assumed appeal rate 5% of declines = 300 appeals a month.

• Assumed 20 minutes of qualified review each = 6,000 minutes = 100 reviewer hours a month.

• At 160 working hours a month, that is about 0.6 of a full-time reviewer.

Double the appeal rate and you need more than one full-time reviewer.

Who must comply, and what enforcement looks like

The CCPA covers for-profit businesses that do business in California and meet one threshold: annual gross revenue above $26,625,000 in the preceding calendar year (the figure adjusted for 2025), buying, selling or sharing personal information of 100,000 or more California consumers or households, or earning 50% or more of annual revenue from selling or sharing it. Thresholds adjust every odd-numbered year, so expect new figures for 1 January 2027. An Indian or UK company that does business in California and meets a threshold is in scope. Our comparison of new US state privacy laws covers other states.

The exemptions for employee and business-to-business data expired on 31 December 2022, and California residents who are employees or job applicants have CCPA rights. Administrative fines currently run to $2,663 per violation, or $7,988 for intentional violations and those involving consumers known to be under 16. Consumers cannot sue over most CCPA violations; certain data breaches are the exception.

Compliance checklist for 1 January 2027

1. Inventory decision systems. Every model, rules engine, vendor tool and LLM workflow touching significant decisions about Californians.

1. Apply the human involvement test. Record who reviews the output, what they see, and whether they can change the decision.

1. Classify the decision and choose a route: opt-out, human appeal, or an exception.

1. Evidence exception conditions with validation and bias-testing records.

1. Write the pre-use notice, with a layered section listing the categories that affect the output.

1. Build the opt-out. Two or more methods, a titled link to a web form, a single opt-out-of-everything option, an alternative decision path and a 15-business-day stop with vendor instructions.

1. Stand up human appeal where chosen: trained reviewers with override authority, verification, 10-business-day confirmation and 45-day handling.

1. Log every decision. Inputs, model version, output, reviewer action and outcome, kept long enough for access requests and the four-year employment records rule.

1. Template access responses per system.

1. Finish risk assessments. New uses before launch; pre-2026 uses by 31 December 2027; plan the 1 April 2028 submission.

1. Fix vendor contracts for access requests, opt-out flow-down and risk assessment inputs.

1. Update the privacy policy, and plan SB 947 corroboration for 1 July 2027.

India note: vendors serving California businesses

Indian HR-tech, lending-tech and analytics firms often sit behind a California employer or lender as service providers. The duties land on the business but flow down: service providers and contractors must help answer access requests, and businesses must instruct them to act on opt-outs within the same 15-business-day window. Expect customers to ask for decision logs, model documentation and bias-testing evidence before January. Our DPDP engineering playbook covers the overlapping logging and notice work for India.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our AI agent security and guardrails service builds the decision logging, human-review interfaces and evaluation pipelines these rules assume, alongside your counsel. Talk to us at /contact-us/.

Last updated: 1 November 2026.

References

1. California Finalizes Regulations to Strengthen Consumers' Privacy, 23 September 2025 — California Privacy Protection Agency

1. CCPA Updates, Cybersecurity Audits, Risk Assessments, ADMT and Insurance Regulations — California Privacy Protection Agency

1. California Consumer Privacy Act Regulations, effective 1 January 2026 — California Privacy Protection Agency

1. Frequently Asked Questions — California Privacy Protection Agency

1. California Consumer Privacy Act, effective 1 January 2026 — California Privacy Protection Agency

1. Agenda Item 9 cover memo, proposed amendments on opt-out preference signals, 6 November 2026 — California Privacy Protection Agency

1. SB 947, Employment: automated decision systems, Chapter 859, Statutes of 2026 — CalMatters Digital Democracy

1. Laws and Regulations, current and preliminary rulemaking — California Privacy Protection Agency

1. Board meeting notice and agenda, 5 to 6 November 2026 — California Privacy Protection Agency

1. Draft Initial Statement of Reasons, opt-out preference signals, Agenda Item 9 — California Privacy Protection Agency

1. Agenda Item 8, Regulations Proposals and Priorities, November 2026 — California Privacy Protection Agency

1. Employee Data, preliminary rulemaking — California Privacy Protection Agency

1. Agenda Item 5, Legislation Update, California 2026 session wrap — California Privacy Protection Agency

1. Newsom Signs McNerney's No Robo Bosses Act of 2026, 30 September 2026 — Office of Senator Jerry McNerney

1. California's No Robo Bosses Act Is Now Law, 6 October 2026 — Crowell and Moring

1. Civil Rights Council Secures Approval for Regulations to Protect Against Employment Discrimination Related to Artificial Intelligence, 30 June 2025 — California Civil Rights Department

1. Updated Monetary Thresholds in CCPA, posted 17 December 2024 — California Privacy Protection Agency