Automated Decision-Making Technology (ADMT)
What California's ADMT rules mean for companies that use AI in decisions about people — and what compliance actually looks like, in plain language.
What it covers
California's ADMT framework addresses AI systems that make or assist in decisions producing legal or similarly significant effects on people. "Significant effects" means decisions about employment, credit, insurance, housing, education, criminal justice, or access to essential services — essentially, any algorithmic decision that meaningfully changes someone's options or outcomes.
The rules don't apply only to fully automated decisions. If an AI system recommends, ranks, or scores individuals in a way that influences a human decision-maker, and the outcome has significant effects, the system falls within scope. This is a broader reach than many companies initially expect.
Profiling is also covered. If your system builds consumer profiles used to predict behavior, preferences, abilities, or characteristics — and those profiles inform consequential decisions — the ADMT obligations apply to that profiling activity as well.
Who it applies to
Any business that meets the California Consumer Privacy Act's existing thresholds and uses automated decision-making technology is potentially in scope. This means companies that collect personal information from California residents and either exceed revenue thresholds, process data about large numbers of consumers, or derive significant revenue from selling or sharing personal information.
The obligation runs to the business deploying the AI system, not just the company that built it. If you license an AI tool from a vendor and use it to make decisions about California consumers or employees, your company — not just the vendor — bears the compliance obligations. This distinction catches many companies off guard, particularly those that view AI tools as turnkey products rather than regulated decision systems.
What compliance requires
The ADMT framework creates four main categories of obligations:
Pre-use notice
Before using ADMT to process a consumer's personal information, companies must provide a clear notice explaining that automated decision-making will occur, what categories of personal information will be processed, the purpose of the processing, and how the consumer can exercise their rights. This notice must be provided at or before the point of data collection.
Access-to-logic disclosure
Consumers have the right to request meaningful information about the logic involved in automated decisions that affect them. Companies must be able to explain, in understandable terms, how the system reaches its conclusions — not the raw code, but the factors, weights, and decision criteria that drive outcomes.
Opt-out mechanism
Consumers must have the ability to opt out of automated decision-making in certain contexts. When a consumer opts out, the company must provide a meaningful alternative process — typically human review — that doesn't disadvantage the consumer for exercising their rights.
Impact assessments
Companies must conduct and document risk assessments for their ADMT systems, evaluating potential harms to consumers including the risk of discriminatory outcomes. These assessments must be updated when the system changes materially and must be available to the CPPA upon request.
Key dates
Consumer-rights infrastructure must be in place: pre-use notices deployed, opt-out mechanisms functional, access-to-logic responses ready.
Annual internal attestation window opens. Companies begin their internal compliance review cycle documenting status across all ADMT systems.
First formal attestation filing to the California Privacy Protection Agency. This public filing documents compliance across all in-scope systems.
How Audmit helps with ADMT compliance
Audmit's compliance service covers ADMT across all four phases: identifying which of your AI systems trigger obligations, building the required notices and disclosure frameworks, preparing incident response procedures, and reviewing your AI vendors for sub-processor compliance. Every closure is attorney-reviewed.