US CPRA ADMT

Apply four gates to each use. First, confirm that the entity is a covered CCPA business. Second, identify whether the technology processes personal information and uses computation. Third, decide whether its output replaces or substantially replaces a person's decision; human involvement requires a reviewer who understands the output, considers other relevant information, and can change the result. Routine storage, firewall, calculator, database, and spreadsheet functions remain outside the definition when they do not replace human decisionmaking.

Fourth, connect the output to a significant decision about the consumer. Article 11 covers decisions that provide or deny financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services. Advertising is excluded. A prediction, score, ranking, or recommendation can still be covered when the business uses it to make a listed decision without qualifying human review.

Representative covered examples include software that screens resumes to decide whom to hire, evaluates productivity to allocate work or compensation, screens student work to decide suspension, or scores an exam to decide whether to grant a diploma. These examples depend on how the business uses the output. The same software used only to organize records or assist a reviewer who retains real decision authority may fall outside the ADMT definition.

The regulations became effective January 1, 2026, but Article 11 has a separate compliance date. A business using covered ADMT before January 1, 2027 must comply by January 1, 2027; a use beginning on or after that date must comply whenever it is used. Before processing, provide a Pre-use Notice that states the specific purpose, data categories affecting the output, output type, role of the output and any human reviewer, access right, opt-out or appeal path, and alternative decision process. The same use may also require a risk assessment before it begins or materially changes.

Consumers generally receive access and opt-out rights. An opt-out exception applies only if its conditions are met. One exception replaces opt-out with an appeal to a human reviewer who understands the output, considers the consumer's information, and can overturn the decision. Separate exceptions for specified admission, hiring, work-allocation, and compensation uses require the ADMT to work for the stated purpose and not unlawfully discriminate; document the exact exception rather than treating these fields as categorically exempt.

Keep the ADMT inventory, significant-decision analysis, purpose, data categories, logic and output documentation, Pre-use Notice, access and opt-out tests, exception and appeal analysis, human-review authority, vendor terms, related risk assessment, approval, and January 1, 2027 readiness evidence. Record material changes because they can require the analysis, risk assessment, and notice to be updated.

For each consumer request, retain the receipt date, verification record where required, response or appeal due date, information supplied, outcome, and downstream action. Keep test evidence showing that opt-out routes do not require an account or unnecessary data and that the non-ADMT alternative or human appeal works in the live decision process.

Common failures include classifying a nominal human check as meaningful review when the reviewer cannot change the decision, treating every automated tool as covered, overlooking employment or independent-contractor decisions, using a generic privacy notice instead of a pre-use notice, or claiming an opt-out exception without implementing the required appeal path.