California’s New Rules for Automated Decisions Take Effect

California has finalized the first comprehensive American rules governing how businesses may use software to make consequential decisions about people. On 23 September 2025 the Office of Administrative Law approved a long-debated rulemaking package from the California Privacy Protection Agency, and those rules became effective on 1 January 2026. The package adds three obligations to the California Consumer Privacy Act: cybersecurity audits, privacy risk assessments, and a regime for what the agency calls automated decisionmaking technology, or ADMT. The ADMT provisions are the most novel, because they reach directly into the algorithmic and machine-learning systems that increasingly stand between a person and a job, a loan, an apartment, or a course of medical treatment. With the substantive ADMT duties phasing in by 1 January 2027, the rules give businesses a finite runway to inventory their automated systems and decide when to step back from machine-driven judgment.

What the rules actually cover

The regulations define ADMT as technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. That phrasing is deliberately functional rather than tied to any particular technique. It captures a credit-scoring model, an automated resume screener, and a large-language-model assistant alike, so long as the system is doing the deciding rather than merely informing a human who decides. The agency narrowed the concept during the rulemaking: tools that merely assist a human reviewer who retains genuine authority generally fall outside the core ADMT obligations, a line that will invite argument over how much human involvement counts as real.

The obligations attach when ADMT is used to make a “significant decision.” The rules enumerate the categories: decisions providing or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, and healthcare services. Conspicuously absent is behavioral advertising, which earlier drafts had swept in and which drew sustained business objection. The final scope therefore tracks the domains where an erroneous or opaque automated call carries the heaviest personal consequences, and leaves advertising largely outside this rulebook.

The consumer rights the rules create

For covered uses, the regulations build out a familiar triad of privacy rights, recast for the algorithmic context. A business must give a pre-use notice when it deploys ADMT for a significant decision, describing in plain terms that automated technology will be used. Consumers gain a right to opt out of that processing, subject to enumerated exceptions. And consumers gain an access right that is more demanding than the CCPA’s general access right: a business must be able to explain the logic of the ADMT and how its outputs are used in reaching the decision. That explanation duty is where the rules press hardest against modern machine-learning practice, because the “logic” of a complex model is rarely reducible to a clean, human-legible rationale.

A staggered, multi-year runway

Although the rules took effect on 1 January 2026, their teeth arrive on a deliberate schedule. The substantive ADMT duties—notice, opt-out, access, and appeal—phase in with a compliance date of 1 January 2027, giving businesses roughly a year to map their automated systems against the “significant decision” categories and stand up the required consumer-facing mechanisms. Risk assessments must be conducted for covered high-risk processing, with attestations and summaries due to the agency by April 2028. Cybersecurity audit obligations stagger by revenue, with the largest businesses (over 100 million dollars in revenue) facing the earliest April 2028 deadline and smaller firms following in 2029 and 2030. The architecture rewards early inventory work: a business that has already catalogued where it uses ADMT will find each later deadline a documentation exercise rather than a scramble.

Why this rulemaking matters beyond California

No federal statute squarely governs automated decisionmaking, and Congress has not enacted a general AI-governance law. That vacuum gives California’s rules outsized reach. A national lender, employer, or health-services company rarely segregates its decision systems by state, so the path of least resistance is often to apply the California baseline everywhere. For comparison, the European Union’s General Data Protection Regulation has long restricted solely automated decisions with legal or similarly significant effects; California’s approach is narrower in its triggers but more prescriptive operationally, particularly the duty to explain the logic behind an automated decision.

The open questions heading into 2027

Several ambiguities will be litigated or clarified before the obligations bite. The first is the human-involvement line: how much review, by whom, and at what stage converts an automated system into a merely assistive one outside the core duties. The second is the explanation standard—whether a description of a model’s inputs and purpose satisfies the access right, or whether regulators will demand a decision-specific rationale that current architectures cannot readily produce. The third is enforcement posture: the agency has signaled phased compliance, but it retains audit and enforcement authority, and how aggressively it polices the first wave of ADMT disclosures will shape industry practice more than the text alone. None of these is settled as of mid-2026. What is settled is the direction of travel: significant decisions made by machine now carry disclosure, exit, and explanation duties in the largest state economy in the country, and businesses that wait until 2027 to begin will have started late.

This publication offers commentary and analysis on legal developments and does not provide legal advice. Readers tracking the implementation timeline may find related coverage useful through the publication’s ongoing commentary and its case tracker; the privacy questions raised by these rules sit alongside longer-running debates over employee privacy in increasingly monitored workplaces.