Summary
- ADMT means technology that processes personal information and replaces or substantially replaces human decision-making. A human only counts as "involved" if they know how to read the output, actually review it and other relevant facts, and have power to change the decision (Sec. 7001(e)).
- ADMT rules bite only for significant decisions: giving or denying financial or lending services, housing, education admission or credentials, employment or contractor work and pay, or healthcare (Sec. 7001(ddd)).
- Businesses using ADMT this way must give a Pre-use Notice, offer an opt-out through at least two methods (a cookie banner does not count), and answer access requests about how the ADMT was used (Secs. 7220 to 7222). Compliance for existing users starts 1 Jan 2027 (Sec. 7200(b)).
- Opt-out is not needed if the business offers a human appeal with a reviewer who can overturn the decision, or for certain hiring, admission and work allocation tools that work as intended and do not unlawfully discriminate (Sec. 7221(b)).
- Risk assessments are required before high-risk processing: selling or sharing data, processing sensitive data, ADMT for significant decisions, automated profiling of workers, students or applicants, profiling based on presence at sensitive locations, and training ADMT or facial, emotion or identity recognition tech on consumer data (Sec. 7150(b)). An executive must submit a summary and attestation to the CPPA, starting 1 Apr 2028 (Sec. 7157).
- Cybersecurity audits: businesses meeting volume tests (for example over half of revenue from selling or sharing data, or the revenue threshold plus 250,000 consumers or 50,000 consumers' sensitive data) need independent annual audits, phased in from 2028 by revenue (Secs. 7120, 7121).
Who it applies to
- "Businesses" under the CCPA: for-profit entities doing business in California that meet a threshold, such as annual gross revenue above USD 26,625,000 (2025 CPI-adjusted) or other volume tests in Civil Code 1798.140(d).
- Protects California residents as consumers, including employees, job applicants and contractors.
- Extraterritorial: yes. The CCPA turns on doing business in California and handling California residents' data, not on where the company is based. An Indian firm with California customers or staff that meets a threshold is covered.
- Mainly a deployer rule: duties fall on the business making the decision, though vendors will be asked to supply the information.
Key dates
- Notice of proposed rulemaking published
- CPPA Board adopts the regulations
- Office of Administrative Law approves; filed with Secretary of State
- CPPA announces OAL approval
- Regulations effective; risk assessments required before starting new high-risk processing
- ADMT rules apply to businesses already using ADMT for significant decisions (Sec. 7200(b))Upcoming
- Deadline to complete risk assessments for high-risk processing that began before 2026 and continues (Sec. 7155(b))Upcoming
- First risk assessment submissions and executive attestation due; first cybersecurity audit reports for businesses with 2026 revenue above USD 100 millionUpcoming
- First cybersecurity audit reports for businesses with 2027 revenue of USD 50 to 100 millionUpcoming
- First cybersecurity audit reports for businesses with 2028 revenue below USD 50 millionUpcoming
Full date record
| Date | Event |
|---|---|
| 2025-07-24 | Board adopts |
| 2025-09-22 | OAL approval and filing |
| 2026-01-01 | Effective; new high-risk processing needs a prior risk assessment |
| 2027-01-01 | ADMT notice, opt-out and access duties for existing ADMT users |
| 2027-12-31 | Risk assessments for legacy processing due |
| 2028-04-01 | First risk assessment submission and attestation; first audits (revenue above USD 100 million) |
| 2029-04-01 | First audits (USD 50 to 100 million) |
| 2030-04-01 | First audits (below USD 50 million) |
Penalties and enforcement
- CPPA administrative fines and AG civil penalties under the CCPA: up to USD 2,663 per violation, or USD 7,988 for intentional violations or those involving consumers known to be under 16, as adjusted by the CPPA from 1 Jan 2025.
- Risk assessment submissions carry an attestation under penalty of perjury, signed by a member of executive management responsible for compliance (Sec. 7157(b), (c)).
- Risk assessments must be kept for as long as processing continues or five years after completion, whichever is later (Sec. 7155(c)).
- No 2026 amendment package or court challenge to these regulations was found as of 2026-10-19 (limited search). The next CPI adjustment of amounts was not verified.
What it means for an Indian company
- HR-tech, lending, insurtech, edtech, proptech and health-tech SaaS selling to California businesses: your clients will need notice text, opt-out handling, access responses and appeal workflows by 1 Jan 2027. Build these into the product (SC-AI-022 Disclose AI interaction to users, SC-AI-024 Explain AI-assisted decisions, SC-AI-027 Right to contest and human review for individuals).
- Design real human review. A rubber-stamp reviewer does not take a tool out of ADMT. Give reviewers training, the full record and authority to change outcomes (SC-AI-026 Human oversight and override).
- Indian employers with California staff or applicants using AI screening or performance scoring must treat those people as consumers with ADMT rights.
- Risk assessments look a lot like DPIAs; reuse your SC-AI-005 AI risk assessment and SC-AI-006 AI impact assessment (people and society) templates, but add the CCPA-specific fields. A DPDP or GDPR assessment can be reused only if gaps are filled (Sec. 7156(b)).
- Training data: using California consumers' data to train hiring, credit or face recognition models triggers a risk assessment (SC-AI-010 Training and input data governance (provenance, quality), SC-AI-011 Lawful basis and consent for personal data used in AI).
- Cybersecurity audits can lean on your ISO 27001 or SOC 2 evidence, but the auditor must be independent (SC-AI-037 Internal audit of AI).
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when California CPPA ADMT, Risk Assessment and Audit Regulations is done.
Glossary
- ADMT: automated decision-making technology that replaces or substantially replaces human decisions using personal information.
- Significant decision: a decision that grants or denies money services, housing, education, work or pay, or healthcare.
- Pre-use Notice: the notice given before ADMT is used, explaining the use and the opt-out and access rights.
- Risk assessment: a documented weighing of privacy risks against benefits before high-risk processing.
- CPPA: California Privacy Protection Agency, the state privacy regulator.
- OAL: California Office of Administrative Law, which approves state regulations.
- CCPA: California Consumer Privacy Act, the privacy statute these rules implement.
- Attestation: a signed statement, here under penalty of perjury, that assessments were done.
Key takeaways
- Status is in force since 1 Jan 2026, not merely "Passed".
- ADMT duties: Pre-use Notice, opt-out (or a genuine human appeal), and access, for significant decisions only.
- Risk assessment attestations start 1 Apr 2028; cybersecurity audits phase in 2028 to 2030 by revenue.
- Reaches any CCPA-covered business with California consumers or workers, including Indian companies.
Official sources
- CPPA rulemaking page, CCPA Updates, Cyber, Risk, ADMT and Insurance Regulations, accessed 2026-10-19
- Approved regulation text (PDF, 22 Sep 2025), accessed 2026-10-19
- CPPA announcement of OAL approval, 23 Sep 2025, accessed 2026-10-19
- CPPA announcement of 2025 CPI adjustments to fines and thresholds, accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.