CCPA Risk Assessment and Automated Decisionmaking Technology Regulations

SUMMARY

Final CCPA regulations establish risk-assessment requirements for specified high-risk processing beginning in 2026 and notice, access, opt-out, and appeal provisions for covered ADMT used in significant decisions beginning January 1, 2027.

WHY IT MATTERS

Hiring is a defined significant decision. Covered businesses must distinguish the regulations' January 1, 2026 effective date and current risk-assessment duties from the later compliance date for Article 11's ADMT rights and notices.

KEY REQUIREMENTS

• Before initiating covered processing on or after January 1, 2026, a covered business must conduct and document a risk assessment; covered processing includes using ADMT for a significant decision and specified uses of sensitive information or automated inference.
• Covered processing begun before January 1, 2026 and continuing afterward must be assessed by December 31, 2027; risk-assessment information for 2026 and 2027 is due to the CPPA by April 1, 2028.
• Beginning January 1, 2027, a covered business using ADMT to make a significant decision must provide a pre-use notice and access rights, plus an opt-out unless a regulatory exception applies.
• The ADMT definition covers technology that processes personal information and replaces or substantially replaces human decision-making; the final rule defines the human involvement required to avoid substantial replacement.
• Risk assessments must be reviewed at least every three years and updated within 45 calendar days after a material change as defined by the regulations.

COVERAGE

Employers: Businesses subject to the CCPA. The CCPA also imposes distinct obligations on service providers and contractors; coverage and role must be analyzed separately.

Workers: California-resident job applicants, employees, and independent contractors whose personal information is within the CCPA and regulations.

Exceptions: The right to opt out has specified exceptions, including a qualifying human-appeal process and limited hiring or work-allocation uses that meet the regulation's conditions.

Exceptions: The regulations exclude listed ordinary technologies from ADMT when they do not replace human decision-making.

Exceptions: CCPA statutory exemptions and role-specific rules remain relevant.

ENFORCEMENT & PENALTIES

California Privacy Protection Agency and California Attorney General enforcement under the CCPA. The CCPA generally does not create a private action for these ADMT provisions.

CHANGE HISTORY

1. 2027-01-01
   effective

   ADMT Article 11 compliance begins

   Businesses using covered ADMT for significant decisions must comply with the pre-use notice, access, opt-out, and applicable appeal provisions.

2. 2026-09-25
   verification update

   Record re-verified

   Official source links, status, and key dates were checked for this maintenance release.

3. 2026-01-01
   effective

   Final regulations became effective

   The regulations took effect, including risk-assessment requirements for covered new processing; Article 11 has a later ADMT compliance date.

4. 2025-09-22
   rule adopted

   Office of Administrative Law approved final regulations

   The final regulations were approved and filed with the Secretary of State.

TOPICS

PRIMARY SOURCES